pr-workflow-270aa4 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited pr-workflow-270aa4 (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill to prepare a merge request or pull request end to end without losing project conventions or accidentally pushing to the wrong branch.
Based on analysis of PR/MR templates and conventions from 16 top projects (react, vscode, electron, turborepo, hermes-agent, biome, vllm, dify, and more).
Every project template falls into one of these tiers. Match the project, not your habit.
## Summary + ## How did you test this change?
Two sections, no checkboxes. Forces concise prose over checklist theater. React says: "If you leave this empty, your PR will very likely be closed." VS Code doesn't even provide sections — contributors organically produce 5–10 labeled sections because the culture demands it.
## Summary + ## Test Plan + ## Docs
Documentation is a first-class deliverable. Biome treats docs updates as a required section alongside code and tests. Turborepo contributors write mini-design-documents with ### Why, ### What I changed, and ### Notes.
Checklist-heavy templates with 7–12 items. Electron enforces: "PRs submitted that do not follow this template will be automatically closed."
Electron adds a mandatory Release Notes section (Notes: Fixed ...). Open WebUI requires a full Keep a Changelog breakdown.
## Purpose / ## Test Plan / ## Test Result
Every PR pastes actual test output. vLLM: universally followed, even draft PRs include Purpose → Test Plan → Test Result. Codex internal PRs add ## Why / ## What / ## Impact / ## Validation.
Issue-first, discussion-first policies. Open WebUI requires:
CopilotKit: "Please PLEASE reach out to us first before starting significant work." Opencode: "AI-generated descriptions may be IGNORED or CLOSED."
5 of 16 top projects (31%) now require AI-assistance disclosure in PRs.
| Project | Disclosure format |
|---|---|
| ohmyzsh | Explicit checkbox: "If I used AI tools... I've disclosed it below" |
| biome | HTML comment at template top; "This PR was implemented with AI assistance from Codex" |
| dify | From <Tool Name> line in Summary |
| vllm | "AI assistance was used; every line was reviewed per AGENTS.md" |
| electron | Policy link in checklist: "Using a coding agent / AI? Read the policy" |
Rule: Add AI-assistance disclosure only when the project template, CONTRIBUTING, or repository policy requires it. Use the project's preferred format exactly. Do not add a generic disclosure line by default, and never invent the tool name or reviewer statement.
gh or glab is available, render the body as normal Markdown in preview — not in a fenced code block.gh or glab is unavailable, output manual form fields and stop.main, master, dev, develop, or a release branch with source:target refspecs unless explicitly requested.Match the repo's convention. 13 of 16 projects use Conventional Commits:
feat(scope): summary
fix(scope): summary
docs: summary
refactor(scope): summaryExceptions: vLLM uses [Area] prefix, Codex internal uses [Module].
Every well-written PR body across all 16 projects has these three:
VS Code: npm run typecheck-client && npm run eslint vLLM: pytest tests/config/test_config.py -v with pass counts
Optional but common:
## How did you test this change?
yarn test ReactDOMFloat-test --runInBand
✓ 84 passed, 0 failed
yarn lint
✓ No errors
yarn flow
✓ No errorsNot this:
## Testing
- [x] Tested manuallygit status --short --branch, git remote -v, git branch --show-currentgit log/git diff to understand what's being submitted.gitlab/merge_request_templates/*.md, especially Default.md.github/PULL_REQUEST_TEMPLATE.md, .github/pull_request_template.md, .github/PULL_REQUEST_TEMPLATE/*.mdCONTRIBUTING.md as supplementary constraints, not template replacementreferences/template-sources.md and synthesize from the Tier A pattern (Summary + Test Plan + Related)gh pr list --limit 5 --json title,body)git log --format=%s)[Area], or plain)Show in reading-oriented format:
glab mr create with --push, -H, project templates, file-backed descriptionsgh pr create --base <target> --head <source> --title <title> --body-file <file>glab mr create, do not assume GitHub-style file flags exist. Current verified glab supports --description <text>, but not --description-file; write long descriptions to a temporary file only as a staging aid, then pass the file content via --description "$(cat "$file")" or an equivalent safely quoted variable.gh pr create, pass long descriptions with --body-file <file>.$, shell syntax, or Markdown code blocks unless they are already held in a safely quoted variable.git push -u <remote> <source> (never source:target)Use glab for GitLab, gh for GitHub. If both available, decide from git remote -v.
Before using non-routine CLI flags, inspect the local command's --help. Do not assume GitHub gh flags exist in GitLab glab, and do not assume a newer online CLI reference matches the installed binary.
For GitLab command details, prefer the official GitLab AI Skills glab skill when installed locally. If it is not installed, use its public reference as guidance:
When no CLI available, provide copyable blocks:
Provider:
Source branch:
Target branch:Title:Description:Then stop. Don't ask for submission confirmation when it can't be performed.
Load references/template-sources.md only when no project-native template exists or when the user asks why the generated template has those sections.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.