github-issues — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited github-issues (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Never pass multiline Markdown through --body "...". Shell quoting can leak literal \n into GitHub.
Always write Markdown to a temp file and use --body-file:
cat > /tmp/body.md <<'EOF'
## Summary
- ...
## Tests
- `...`
EOF
gh pr create --body-file /tmp/body.md
# or
gh pr edit <number> --body-file /tmp/body.md
# or
gh issue create --body-file /tmp/body.mdFor PR inspection, use the pr-review skill. This skill handles GitHub issue and PR mechanics such as reading templates, using --body-file for multiline Markdown, and checking existing comments before closing or posting.
gh issue view <number>For non-trivial bodies, always write the draft to a temp file first. Do not inline long Markdown with shell quoting.
cat > /tmp/issue.md <<'EOF'
### What happened?
...
EOF
gh issue create --repo OWNER/REPO --title "Short title" --body-file /tmp/issue.mdBefore creating issues in someone else's repo, check templates/contributing docs and keep the report concise.
gh api repos/OWNER/REPO/contents/.github/ISSUE_TEMPLATE --jq '.[].name'
gh api repos/OWNER/REPO/contents/CONTRIBUTING.md --jq .content | base64 --decodeIf gh issue create prompts for confirmation, review the preview carefully before accepting.
fix: description (#1) or fix: description (fixes #1) — auto-closes on merge to default branch([#1](https://github.com/owner/repo/issues/1))fixes #1 — does NOT auto-close, must close manuallyUse the maintainer-reply skill before drafting or posting issue and PR replies. Read the conversation first; do not apply a generic thank-you or mention a fix version when it is unknown or irrelevant.
When closing with a reply, mention the fix version when known and thank the reporter when appropriate to the conversation:
gh issue close <number> --comment "Fixed in v1.2.3. Thanks for the report!"For npm packages, simulate fresh install:
npm pack --pack-destination /tmp/
cd /tmp && mkdir test && cd test
echo '{"name":"test"}' > package.json
bun add /tmp/package-name-1.0.0.tgz
./node_modules/.bin/command --help~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.