team-pr — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited team-pr (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Run the PR phase. Two modes:
branch has slice commits ready. $ARGUMENTS/task.md and $ARGUMENTS/design.md exist.
tree has commits or staged changes ready to ship. Treat the current branch as the work source.
$ARGUMENTS is the artifact directory: docs/plans/<id>/. If empty, the discovery block below resolves it for the resume path (discovery only augments resume — the standalone path is unchanged).
The PR description is grounded in $ARGUMENTS/design.md. The ticket identifier (if any) is read from $ARGUMENTS/task.md's frontmatter.
Resolve the artifact directory by running this self-contained block (one bash call — agent threads reset cwd between calls):
# Three-tier artifact-directory discovery (archetype A).
# ID_RE + PHASE_FILES canonical from hooks/session-start-recover.mjs.
# PHASE_FILES recency mirrors findActiveTopic() in session-start-recover.mjs.
# NOTE: this block is duplicated across 8 skills by design (see docs/architecture.md); future: shared discover-topic.sh.
ID_RE='^([A-Za-z][A-Za-z0-9_]*-[0-9]+|[0-9]{4}-[0-9]{2}-[0-9]{2})-[a-z0-9][a-z0-9-]*$'
PHASE_FILES="task questions research design structure plan"
# design.md is a lenient discovery proxy: the canonical PR-phase predecessor is
# "aggregate gate passed" (no single artifact), so we key on design.md to mean
# "topic progressed far enough to have design context". team-pr also runs standalone.
PRED="design.md" # predecessor artifact this skill consumes
# Tier 1 — explicit: $ARGUMENTS names an existing dir → use verbatim.
if [ -n "$ARGUMENTS" ] && [ -d "$ARGUMENTS" ]; then
echo "$ARGUMENTS"; exit 0
fi
# Tier 2 — discover: newest ID_RE dir under docs/plans/ that holds PRED.
best=""; best_mtime=-1
# Assumes cwd is the repo/worktree root (where docs/plans/ lives).
for dir in docs/plans/*/; do
name="$(basename "$dir")"
printf '%s' "$name" | grep -qE "$ID_RE" || continue # ID_RE filter
[ -f "$dir$PRED" ] || continue # predecessor filter
m=-1
for p in $PHASE_FILES; do
f="$dir$p.md"
[ -f "$f" ] || continue # skip racing/absent
s="$(stat -f %m "$f" 2>/dev/null || stat -c %Y "$f" 2>/dev/null)" || continue
[ "${s:-0}" -gt "$m" ] && m="$s" # max-mtime over PHASE_FILES
done
[ "$m" -gt "$best_mtime" ] && { best_mtime="$m"; best="$dir"; }
done
[ -n "$best" ] && { echo "$best"; exit 0; }
# Tier 3 — none found: print nothing → fall to AskUserQuestion (prose below).$ARGUMENTS for the resume path(tier 1 explicit arg, or tier 2 discovery of a directory holding design.md). When the path came from tier 2 (no explicit arg), announce the resolved directory to the user before proceeding, so an auto-picked topic is never silent.
hard-error. The working tree may still have commits to ship: fall through to the Standalone path in ## Execution, which detects the base branch (archetype B) and stops with "Nothing to ship." only when there is nothing ahead of the base.
Follow skills/progress-tracking/SKILL.md: when this procedure has two or more steps, seed one todo item per step before starting and mark each complete as you go.$ARGUMENTS/repos.md if present. When present, you are inmulti-repo mode — read the ## Worktrees section to get each repo's worktree path.
multi-repo: every repo's worktree from repos.md), check whether it has commits ahead of its base branch. Skip any with no commits.
git -C <worktree-path> symbolic-ref refs/remotes/origin/HEAD \
| sed 's@^refs/remotes/origin/@@'Falls back to main per repo.
$ARGUMENTS/task.md exists: read ticketId fromits frontmatter. Read $ARGUMENTS/design.md for the "why" behind the changes.
changes worth shipping. If neither, report "Nothing to ship." and stop. (Standalone mode is single-repo only.)
taking responsibility for correctness.
In multi-repo mode, update each repo's CHANGELOG.md with the entries belonging to that repo's commits.
is not a human gate; opening the PR requires no approval. Push the branch and open the PR as a draft (gh pr create --draft). Any uncommitted final changes (typically CHANGELOG.md) land as a single trailing ship commit before the push. In multi-repo mode this opens one draft PR per repo with commits and cross-links them.
draft PR per repo. Cross-link the PRs in their bodies (see PR Body Template below).
ticketId is non-null:any board automation moves it to its done state — when the PR merges. For GitHub, put Closes #<n> in the PR body; for another tracker use its PR↔issue link. This link is what drives the eventual move to done on merge, so the orchestrator never closes tickets by hand.
tracker-agnostic: if the project defines no tracker-move mechanism, skip silently. Never block the pipeline on a tracker update.
ticketId in the completion report.push that adds, removes, or changes commits on a PR's branch — the initial open and every follow-up push (review feedback, fixups, rebases) — must be followed by re-reading the current PR body against the now-pushed commits and updating it (gh pr edit --body) so the Summary, Changes, and How-to-Verify sections still match what the branch actually does. Never leave a stale description after a push. In multi-repo mode, do this for each repo's PR whose branch you pushed.
opening a PR — the user may need to iterate on the branch (push follow-up commits, address review feedback). Clean up only after the PR is merged or when the user explicitly asks. When that happens, cherry-pick or rebase commits onto the target branch in that repo, then let Claude Code (or git -C <repo-path> worktree remove) remove the worktree; in multi-repo mode, run cleanup for every involved repo. After removing the worktree, bring the repo's local default branch up to date with the merge: git -C <repo-root> pull --rebase origin <base> (rebase, never a merge commit — the project keeps linear history). Do this for every involved repo in multi-repo mode. Finally, delete the feature's local planning docs (rm -rf docs/plans/<id>, verified untracked) as part of the same teardown — see worktree-isolation.
## Summary
[2-3 bullets drawn from $ARGUMENTS/design.md — what and why]
## Design Decisions
[Key decisions reviewers should understand]
## Changes
[Brief description, organized by component]
## How to Verify
- [ ] [Automated verification command]
- [ ] [Manual verification step]
## References
- Design: $ARGUMENTS/design.md
- Plan: $ARGUMENTS/plan.mdIn multi-repo mode, append a ## Companion PRs section to each PR listing the URLs of every other PR opened for the same topic, so a reviewer can navigate the full change set:
## Companion PRs
This change spans multiple repos. The companion PRs are:
- [<repo-name>] <pr-url>
- [<repo-name>] <pr-url>Open the PRs first to obtain URLs, then edit each PR's body to add the section once all URLs are known.
Before creating the ship commit, update CHANGELOG.md per skills/changelog/SKILL.md:
git log.feat:, fix:, perf:, security:,and any BREAKING CHANGE: footer. Exclude chore:, test:, refactor:, ci:, docs:.
[Unreleased] in CHANGELOG.md. Create the filewith the Keep a Changelog header if it does not exist.
CHANGELOG.md change in the ship commit.If there are no user-facing commits, skip the changelog update and note this in the completion report.
When creating the commit, apply skills/git-commit/SKILL.md:
feat:, fix:, refactor:, etc.The implementer already committed each slice atomically during Implement. The PR may contain multiple commits (one per slice). The ship commit is only used if there are uncommitted final changes (e.g., changelog).
Report the outcome (draft PR URL and commit hash).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.