# Thanks Star

> Safely thank open-source maintainers by starring the verified upstream GitHub repository after an agent successfully downloads, clones, installs, or adds a skill, plugin, template, tool, or dependency. Use whenever an agent completes an external GitHub-backed acquisition, or when the user asks to appreciate the source. Default to auto after one explicit first-install confirmation; support ask and…

- **Type:** Skill
- **Install:** `agentstack add skill-952jo-thanks-star-thanks-star`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [952JO](https://agentstack.voostack.com/s/952jo)
- **Installs:** 0
- **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [952JO](https://github.com/952JO)
- **Source:** https://github.com/952JO/thanks-star/tree/main/skills/thanks-star

## Install

```sh
agentstack add skill-952jo-thanks-star-thanks-star
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Thanks Star

Thank the verified upstream repository only after a download, clone, or install succeeds. Treat a GitHub star as an external account change, not as part of the download permission.

## Requirements

- Use Python 3.9 or later.
- Use an authenticated GitHub CLI session (`gh auth status`).
- Resolve `` to the directory containing this `SKILL.md` before running the bundled script.
- Never request, print, or store a GitHub token. Let `gh` manage authentication.

## Workflow

1. Preserve the exact source supplied to the successful download or install command. Prefer an `OWNER/REPO` value, GitHub URL, installed Skill directory, or local Git checkout.
2. Confirm the acquisition succeeded. Do not star after search, preview, failed download, failed clone, or failed install.
3. Immediately after installing this Skill, or at its first activation when same-turn invocation is unavailable, read the policy:

   ```text
   python /scripts/thanks_star.py --json policy show
   ```

4. If `onboarding_required` is `true`, ask exactly one standing-authorization question before any GitHub lookup:

   > Thanks Star 默认使用自动模式。是否确认今后在 Agent 成功获取开源项目后，自动为明确识别出的 GitHub 上游仓库点 Star？每次新增点赞都会提示您。

   Handle the answer as follows:
   - Explicit yes: run `policy set auto --authorize-account-changes`, then continue with the preserved source.
   - Explicit no: run `policy set off` and stop.
   - Explicit request for per-repository confirmation: run `policy set ask`, then continue in `ask` mode.
   - No answer or ambiguous answer: stop. Do not resolve a repository or change GitHub.
5. If the configured policy is `off`, stop without resolving or starring anything.
6. Run the operation with the preserved source:

   ```text
   python /scripts/thanks_star.py --json thank 
   ```

7. Handle the returned `status` exactly:
   - `initial_confirmation_required`: follow step 4. This is a defensive result when onboarding was skipped; make no GitHub lookup first.
   - `confirmation_required`: the user selected `ask`; ask, “已确认上游为 `OWNER/REPO`。是否给该仓库点 Star？” Run again with `--approve` only after an explicit yes.
   - `starred`: always tell the user, “您已为 `OWNER/REPO` 点赞。” Localize when the conversation uses another language.
   - `already_starred`: say it was already starred only when useful; never imply a new change.
   - `skipped_unverified`: do not ask for approval and do not star. Briefly identify the unresolved source when relevant.
   - `disabled`: make no account change and do not nag the user.
   - `would_star`: report that this was a dry run; never imply an account change.

8. In `ask` mode, after approval for this exact repository, run:

   ```text
   python /scripts/thanks_star.py --json thank  --approve
   ```

Do not reuse one-repository approval for another repository. In configured `auto` mode, do not ask again; notify after every new star.

## Policy modes

When no policy exists, default to `auto` with `onboarding_required: true`. This pending state is not authorization and performs zero GitHub lookup or mutation until the user confirms once.

- `auto`: the default after one-time standing authorization; star verified upstream repositories without further questions and notify after every new star.
- `ask`: require explicit approval for each previously unstarred repository.
- `off`: perform no lookup and no star action.

Show or change the policy with:

```text
python /scripts/thanks_star.py --json policy show
python /scripts/thanks_star.py --json policy set ask
python /scripts/thanks_star.py --json policy set off
```

After explicit first-time or later standing authorization, enable `auto` with:

```text
python /scripts/thanks_star.py --json policy set auto --authorize-account-changes
```

Never add the authorization flag based only on a download, installation, generic automation request, or silence.

## Source rules

- Accept only public repositories on `github.com`.
- Resolve GitHub-declared forks to the root source repository.
- Resolve a declared mirror only when its upstream is itself an unambiguous GitHub repository; otherwise skip it.
- Use installer-injected `metadata.github-repo`, `metadata.github-ref`, and `metadata.github-tree-sha` together as Skill provenance.
- Prefer a local Git `upstream` remote. If it exists but is not GitHub, skip instead of falling back to a GitHub mirror in `origin`.
- Otherwise inspect `origin`, then verify it through the GitHub API.
- Skip local archives without trusted provenance, non-GitHub sources, private repositories, deleted repositories, and malformed inputs.
- Never star every repository owned by an author or organization.
- Never star the fork or mirror merely because it was downloaded.
- Never guess an upstream from a package name, README text, search result, or repository contents.
- Never unstar a repository.

The GitHub API's fork and mirror metadata cannot identify an undeclared manual copy. If the available evidence cannot establish provenance, skip.

## Read-only inspection

Inspect resolution without checking or changing star state:

```text
python /scripts/thanks_star.py --json inspect 
```

Preview the complete configured policy decision without changing GitHub:

```text
python /scripts/thanks_star.py --json thank  --dry-run
```

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [952JO](https://github.com/952JO)
- **Source:** [952JO/thanks-star](https://github.com/952JO/thanks-star)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-952jo-thanks-star-thanks-star
- Seller: https://agentstack.voostack.com/s/952jo
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.