bridge-promote — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited bridge-promote (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Routes commits from user/* to the right upstream based on scope: frontmatter (or path inference). See CLAUDE.md § Tier Model.
| Commit scope | Goes to | How |
|---|---|---|
scope: core (or unset, on CORE-allowlist path) | OSS upstream (e.g. bks-lab/open-bridge:main) plus your org overlay if configured | Cherry-pick to local development, then PR to the OSS upstream |
scope: org | Your org overlay only (e.g. <your-org>/<your-bridge>:development) | Cherry-pick + PR to your org's overlay repo |
scope: user / private | stays local on user/{name} | No-op |
If you don't have an org overlay configured, only scope: core commits get promoted; scope: org commits stay on your user branch.
Read the referenced file ONLY when triggered.
| Argument | Effect | Default |
|---|---|---|
(none) | Full promote workflow with scope-routing | — |
--dry-run | Analyze only, don't cherry-pick or push | false |
--repo <name> | Force destination (matches a name in upstreams[]), skip auto-routing | auto |
user/*. Refuses on development or main.bridge-config.yaml.upstreams[] defines available targets — thetemplate ships the shared OSS upstream (bks-lab/open-bridge, contribute: true) by default; optionally a <your-org>/<your-bridge> overlay.
gh authenticated. **No push access to theupstream required** — open-bridge PRs go fork-based (gh repo fork once, push the branch to your fork, gh pr create --repo bks-lab/open-bridge). See the bridge-contribute skill (skills/bridge-contribute/references/workflow.md § Step 5).
scripts/leak-patterns-internal.txt(local-only) — your customer/person patterns for the safety gate.
User wants to...
├── Promote commits (auto-routed by scope) → references/workflow.md
├── Dry-run analysis only → references/workflow.md (stop after Step 4)
├── Force one specific upstream → references/workflow.md § --repo override
├── Scan branch for contributions → bridge-contribute skill (/contribute)
├── Adapt/generalize content → bridge-contribute skill § Adapt mode
└── Questions about CORE/USER/ORG split → Answer from CLAUDE.md § Tier ModelBefore any cherry-pick or push, a mandatory two-layer content-safety gate runs — per destination repo:
python3 scripts/no-scrub-leak.py {outgoing files} — universalclasses (absolute user paths, key/token shapes) plus your own roster from scripts/leak-patterns-internal.txt (you maintain your customer/PII regexes there; the shipped scanner cannot know them).
rules/promote-safety.md — the OSS upstreamuses the strictest blocklist (no org/customer/personal leaks); your org overlay may use a relaxed one (customer refs OK, personal blocked). See bridge-config.yaml.promote.content_blocklist.
REFUSE path: personal-PII or roster hits exclude the affected files/commits from the PR — no override flag. Remediation: adapt via /contribute --adapt and re-scan, or drop them. Clean items still ship.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.