pr-message — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited pr-message (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Draft a PR message for merging the current branch into main and hand the user a single fenced Markdown block they can paste into the GitHub UI or into gh pr create --body-file -.
This skill is repo-local to py-cv-claw. It does not call gh and does not open or edit PRs.
maindev; whatevergit rev-parse --abbrev-ref HEAD returns)
Print what you inferred at the top of your reply. Do not ask the user to confirm base/head unless head is main itself (in which case stop and ask — there's nothing to merge).
git rev-parse --abbrev-ref HEAD — confirm head branch.git log --oneline main..HEAD — commits on the branch.git diff main...HEAD --stat — file-level shape (note thetriple-dot: changes on HEAD relative to the merge base, ignoring work added to main since the branch diverged).
git diff main...HEAD — read enough of the actual diff toverify commit messages tell the truth. Commits sometimes mis-describe their scope; the diff is ground truth.
when any of these hold:
git log main..HEAD is empty — no commits to describe.main.main that muddy thediff. Offer: "Want me to describe only commits authored on this branch (git log main..HEAD --no-merges), or include the merges?"
drafting only when:
don't unify them (e.g. one commit is a dep bump, another is an unrelated feature, no shared narrative).
terse / generic.
Otherwise: draft silently. Most branches in this repo are tightly themed — don't manufacture ambiguity.
(feat:, fix:, refactor:, docs:, chore:). Fall back to descriptive prose if commits are mixed types.
should understand what's in this PR without opening it.
## Summary
1–2 sentences. The "why," not the "what." Name specs implemented,
issues closed, or design docs referenced — but only if they're
actually present in the diff or commit messages. Never invent links
or issue numbers.
## Changes
Grouped bullets by area. Group labels are derived from the diff;
typical groups in this repo:
- **Code** — anything under `src/cvclaw/`.
- **Skills** — `skills/cv-claw/` and `.claude/skills/`.
- **Docs** — README.md, CLAUDE.md, `.claude/specifications/`.
- **Templates** — `src/cvclaw/templates/` (the bundled root).
- **Build/CI** — pyproject.toml, Makefile, .github/.
Skip groups with no changes. Each bullet ≤1 line; reference files
or subsystems (`src/cvclaw/cli.py`, "ingest.md") rather than commit
hashes. Bold the group label.
## Test plan
Markdown checklist. Use only steps the repo actually supports —
read `Makefile` and `pyproject.toml` to ground each step. For this
repo that's typically:
- [ ] `make lint` is clean.
- [ ] `uv run cv-claw render resumes/example.json` succeeds.
- [ ] Any spec-specific manual smoke tests called out in the
relevant `.claude/specifications/SPEC-*.md`.
Do not invent CI jobs, test suites, or pytest invocations that
don't exist in this repo.PR message for <head> → <base>`,drafted from N commit(s) across M changed file(s).`
markdown … ``) containing thetitle on the first line, a blank line, then the body. This makes the whole thing one copy-paste.
<title>
## Summary
<1–2 sentences>
## Changes
- **<Group>** — <bullet>
- **<Group>** — <bullet>
## Test plan
- [ ] <step>
- [ ] <step>gh pr create invocations; this skill produces hand-drafted Markdown the user pastes manually.
section. Caveats fold into Summary or as inline bullets in Changes.
(no test suite exists, no CI workflow exists), don't list it.
commits.** If .claude/specifications/SPEC-foo.md is touched in this PR, mention it; if it isn't, don't.
wants the PR opened, they will say so separately and the global gh pr create flow handles it.
gh pr create / gh pr edit / gh pr view.tell the user there's nothing to merge.
that the branch is behind and may need a rebase before opening the PR.
(e.g. "PR message into release/0.2"). Honor the requested base; use <base>...HEAD for the diff range.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.