github-issues — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited github-issues (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Never pass multiline Markdown through --body "...". Shell quoting can leak literal \n into GitHub.
Always write Markdown to a temp file and use --body-file:
cat > /tmp/body.md <<'EOF'
## Summary
- ...
## Tests
- `...`
EOF
gh pr create --body-file /tmp/body.md
# or
gh pr edit <number> --body-file /tmp/body.md
# or
gh issue create --body-file /tmp/body.mdgh issue view <number>For non-trivial bodies, always write the draft to a temp file first. Do not inline long Markdown with shell quoting.
cat > /tmp/issue.md <<'EOF'
### What happened?
...
EOF
gh issue create --repo OWNER/REPO --title "Short title" --body-file /tmp/issue.mdBefore creating issues in someone else's repo, check templates/contributing docs and keep the report concise.
gh api repos/OWNER/REPO/contents/.github/ISSUE_TEMPLATE --jq '.[].name'
gh api repos/OWNER/REPO/contents/CONTRIBUTING.md --jq .content | base64 --decodeIf gh issue create prompts for confirmation, review the preview carefully before accepting.
fix: description (#1) or fix: description (fixes #1) — auto-closes on merge to default branch([#1](https://github.com/owner/repo/issues/1))fixes #1 — does NOT auto-close, must close manuallyAlways thank the reporter and mention the fix version:
gh issue close <number> --comment "Fixed in v1.2.3. Thanks for the report!"For npm packages, simulate fresh install:
npm pack --pack-destination /tmp/
cd /tmp && mkdir test && cd test
echo '{"name":"test"}' > package.json
bun add /tmp/package-name-1.0.0.tgz
./node_modules/.bin/command --help~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.