github-projects-manager — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited github-projects-manager (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Execution layer for GitHub Projects V2 operations. The project-advisor skill handles governance and decision-making; this skill handles the actual CLI and GraphQL commands.
Scope, Approval, Root Cause, Person Days, etc.)
#number)workflow/projects/{slug}.yaml for field values, governance rules, andstate mappings
workflow/contexts/customer-a.yaml),read project_custom_fields for field-specific overrides and readonly field lists
Every issue creation follows this exact sequence — no shortcuts:
Step 1: gh issue create --repo {org}/{issue_repo} --title --body --label
Step 2: gh project item-add {number} --owner {org} --url {issue_url}
Step 3: Verify — confirm the item appears on the boardAfter creation, immediately classify with at minimum:
Status (from project config default)Approval)
gh project item-edit (preferred)For standard project fields, use the gh project item-edit CLI command. This is simpler than GraphQL and works for single-select and number fields:
# Single-select field
gh project item-edit --project-id "$PROJECT_ID" \
--id "$ITEM_ID" \
--field-id "$FIELD_ID" \
--single-select-option-id "$OPTION_ID"
# Number field
gh project item-edit --project-id "$PROJECT_ID" \
--id "$ITEM_ID" \
--field-id "$FIELD_ID" \
--number 0.5
# Text field
gh project item-edit --project-id "$PROJECT_ID" \
--id "$ITEM_ID" \
--field-id "$FIELD_ID" \
--text "E16"Before setting fields, resolve all required IDs:
# Get Project ID from item-add output, or:
PROJECT_ID=$(gh api graphql -f query='
query($org: String!, $num: Int!) {
organization(login: $org) {
projectV2(number: $num) { id }
}
}' -f org="$ORG" -F num=$NUM \
--jq '.data.organization.projectV2.id')
# Get all field IDs + option IDs in one call:
gh project field-list $NUM --owner $ORG --format json \
| jq -r '.fields[] | "\(.name) | \(.id) | \(.options // [] | map("\(.name)=\(.id)") | join("; "))"'Cache field IDs for the duration of a run — they don't change between calls within the same session.
For complex operations or when gh project item-edit fails, use the GraphQL patterns documented in references/graphql-patterns.md.
For batch field updates (e.g. transitioning 16 items from Org Internal to Submitted):
& + wait) — max 10 concurrentwait completesUpdated N/M items successfullyWhen called by a coordinator skill (e.g. customer-a-coordinator), the caller provides:
workflow/contexts/customer-a.yaml)Read project_custom_fields from the bound context for:
workflow/projects/{slug}.yaml before anyoperation. Never hardcode field values, emojis, or status names.
project_fields_readonly,never write to it even if the caller requests it.
fails, report the failure — don't silently skip.
"In Review" before "Done" — never skip to Done directly.
| Error | Cause | Fix |
|---|---|---|
| "Could not resolve to a ProjectV2" | Wrong project number or org | Check workflow/projects/{slug}.yaml |
| "Resource not accessible" | Token lacks project scope | gh auth refresh -s project |
| "Field value not found" | Emoji mismatch or typo | Re-read field-list, use exact option name |
| "Item not found" | Issue not on board yet | Run gh project item-add first |
| Invalid option ID | Schema drift | Re-fetch gh project field-list |
references/graphql-patterns.md — Full GraphQL mutation and query patternsworkflow/projects/{slug}.yaml — Per-project field configsproject-advisor skill — Governance rules and decision framework~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.