ci: add Tessl skill-review-and-optimize workflow with /apply-optimize

[popey]

Hey @thymikee 👋

Following up on the skill improvements PR that was merged — this adds a GitHub Action that automatically reviews and optimizes SKILL.md files on future PRs, so your skills stay aligned with best practices as they evolve without manual effort.

What this adds

.github/workflows/skill-review.yml — runs on every PR that touches a SKILL.md:

• Posts Tessl scores + AI-suggested improved skill content as a single PR comment
• Uses tesslio/skill-review-and-optimize

.github/workflows/skill-optimize-apply.yml — triggered by a /apply-optimize comment on a PR:

• Commits the AI-suggested improvements directly to the PR branch — no copy-paste needed

🔑 One-time setup required

Add a TESSL_API_TOKEN secret to this repo:
Settings → Secrets and variables → Actions → New repository secret

Get a free token at https://tessl.io/account/api-keys.

Without the token the action still posts review scores and feedback — just without the AI optimization suggestions.

What stays the same

• Non-blocking by default — no red CI unless you add fail-threshold
• Only fires on **/SKILL.md PRs — no noise on other changes
• Contributors need no Tessl account — only the repo owner needs the API token for optimization

---

Honest disclosure — I work at @tesslio where we build tooling around skills like these. Not a pitch — just saw room for improvement and wanted to contribute.

Want to self-improve your skills? Just point your agent (Claude Code, Codex, etc.) at this Tessl guide and ask it to optimize your skill. Ping me — @popey — if you hit any snags.

Thanks in advance 🙏

[hongkongkiwi]

The apply workflow checks out the repository default branch for an issue_comment event and never checks out the pull request’s head ref. A /apply-optimize comment can therefore run against the wrong revision, and the action’s write token is not scoped to the intended PR branch. Checkout the PR head explicitly and restrict the command to an exact, authorized comment before allowing it to commit.