pr-workflow-7d3776 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited pr-workflow-7d3776 (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill to prepare a merge request or pull request end to end without losing project conventions or accidentally pushing to the wrong branch.
Based on analysis of PR/MR templates and conventions from 16 top projects (react, vscode, electron, turborepo, hermes-agent, biome, vllm, dify, and more).
Every project template falls into one of these tiers. Match the project, not your habit.
## Summary + ## How did you test this change?
Two sections, no checkboxes. Forces concise prose over checklist theater. React says: "If you leave this empty, your PR will very likely be closed." VS Code doesn't even provide sections — contributors organically produce 5–10 labeled sections because the culture demands it.
## Summary + ## Test Plan + ## Docs
Documentation is a first-class deliverable. Biome treats docs updates as a required section alongside code and tests. Turborepo contributors write mini-design-documents with ### Why, ### What I changed, and ### Notes.
Checklist-heavy templates with 7–12 items. Electron enforces: "PRs submitted that do not follow this template will be automatically closed."
Electron adds a mandatory Release Notes section (Notes: Fixed ...). Open WebUI requires a full Keep a Changelog breakdown.
## Purpose / ## Test Plan / ## Test Result
Every PR pastes actual test output. vLLM: universally followed, even draft PRs include Purpose → Test Plan → Test Result. Codex internal PRs add ## Why / ## What / ## Impact / ## Validation.
Issue-first, discussion-first policies. Open WebUI requires:
CopilotKit: "Please PLEASE reach out to us first before starting significant work." Opencode: "AI-generated descriptions may be IGNORED or CLOSED."
5 of 16 top projects (31%) now require AI-assistance disclosure in PRs.
| Project | Disclosure format |
|---|---|
| ohmyzsh | Explicit checkbox: "If I used AI tools... I've disclosed it below" |
| biome | HTML comment at template top; "This PR was implemented with AI assistance from Codex" |
| dify | From <Tool Name> line in Summary |
| vllm | "AI assistance was used; every line was reviewed per AGENTS.md" |
| electron | Policy link in checklist: "Using a coding agent / AI? Read the policy" |
Rule: If AI tools (Hermes, Claude Code, Codex, Copilot, etc.) contributed to the PR, disclose it. Use the project's preferred format. For projects without a format, add: > 🤖 AI assistance: <tool name>. Every line reviewed.
gh or glab is available, render the body as normal Markdown in preview — not in a fenced code block.gh or glab is unavailable, output manual form fields and stop.main, master, dev, develop, or a release branch with source:target refspecs unless explicitly requested.Match the repo's convention. 13 of 16 projects use Conventional Commits:
feat(scope): summary
fix(scope): summary
docs: summary
refactor(scope): summaryExceptions: vLLM uses [Area] prefix, Codex internal uses [Module].
Every well-written PR body across all 16 projects has these three:
VS Code: npm run typecheck-client && npm run eslint vLLM: pytest tests/config/test_config.py -v with pass counts
Optional but common:
## How did you test this change?
yarn test ReactDOMFloat-test --runInBand
✓ 84 passed, 0 failed
yarn lint
✓ No errors
yarn flow
✓ No errorsNot this:
## Testing
- [x] Tested manuallygit status --short --branch, git remote -v, git branch --show-currentgit log/git diff to understand what's being submitted.gitlab/merge_request_templates/*.md, especially Default.md.github/PULL_REQUEST_TEMPLATE.md, .github/pull_request_template.md, .github/PULL_REQUEST_TEMPLATE/*.mdCONTRIBUTING.md as supplementary constraints, not template replacementreferences/template-sources.md and synthesize from the Tier A pattern (Summary + Test Plan + Related)gh pr list --limit 5 --json title,body)git log --format=%s)[Area], or plain)> 🤖 AI assistance: Hermes. Every line reviewed by human.Show in reading-oriented format:
glab mr create with --push, -H, project templates, file-backed descriptionsgh pr create --base <target> --head <source> --title <title> --body-file <file>--body-file; don't inline bodies with backticks/$/Markdown code blocksgit push -u <remote> <source> (never source:target)Use glab for GitLab, gh for GitHub. If both available, decide from git remote -v. For GitLab details, prefer the official glab skill:
When no CLI available, provide copyable blocks:
Provider:
Source branch:
Target branch:Title:Description:Then stop. Don't ask for submission confirmation when it can't be performed.
Load references/template-sources.md only when no project-native template exists or when the user asks why the generated template has those sections.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.