project-advisor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited project-advisor (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Governance layer for project management. Reads per-project configuration from workflow/projects/*.yaml to know field values, governance rules, and state mappings. Actual execution (creating issues, updating fields) goes through the github-projects-manager skill.
This skill is cross-cutting — applies to every repo that uses GitHub Projects or Azure DevOps Boards, not just The Bridge.
Configuration lives in workflow/projects/*.yaml. Each file defines one project:
projects/
├── _schema.yaml # Schema documentation
├── _template.yaml # Blank template for new projects
├── examples/ # Neutralized examples (CORE layer)
│ ├── operational.yaml # Type A: management, coordination
│ ├── technical.yaml # Type B: software development
│ ├── minimal.yaml # Type C: workshops, experiments
│ └── ado-project.yaml # Azure DevOps integration
└── {slug}.yaml # Actual project configs (USER layer)When creating issues or updating fields: always read the matching workflow/projects/{slug}.yaml first. Use the field values defined there — never hardcode emojis, status names, or priority values.
User intent?
├─ "Set up a GitHub project" → references/setup.md
├─ "Create issue" / "Track this" → Issue Governance (below) + references/execution.md
├─ "Show board" / "What's active?" → Board Overview (below)
├─ "Check board health" → references/governance.md (R1-R7) + execution.md (jq queries)
├─ "Update issue status/fields" → references/execution.md (CLI + GraphQL patterns)
├─ "Convert drafts to issues" → references/execution.md (Draft-to-Issue section)
├─ "Add a new project" → Create workflow/projects/{slug}.yaml from _template
└─ General project question → Answer from governance.md + project configWhen creating an issue (execution patterns in references/execution.md):
workflow/projects/*.yaml (by project number or name)fields: for valid values, governance: for rules_template.yamlproject.type:operational → has assignment + dependency fieldstechnical → has stage + size fieldscustom → minimal fields, check what's available Issue proposal:
Title: {derived from conversation}
Repo: {from config project.issue_repo}
Project: #{number} {name}
Fields: (per config)
Status: {config fields.status.default}
Priority: {suggested from config values}
Type: {suggested from config values}
[y] Create [e] Edit [n] Cancelgithub-projects-manager skillQuery active items (exclude done_states from config), show grouped by status with assignee and priority.
Read governance.rules from project config. At minimum:
K-level (Critical — from config `governance.level: strict|standard`):
done_requires_review: must go through review_states before done_statesreview_needs_comment: mandatory comment using review_comment_templatedone_only_by_user: only human can mark donenever_delete: use Declined, never deleteW-level (Workflow):
assignee_on_in_progress: must have assignee when in progresscomment_on_status_change: comment on every transitionSee references/governance.md for the full K/W/B rule set with board health validation checks (R1-R7).
| Level | K rules | W rules | B rules |
|---|---|---|---|
strict | Enforced | Enforced | Suggested |
standard | Enforced | Suggested | Optional |
relaxed | Enforced | Informational | Informational |
state_map in project config feeds into tracker normalization~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.