oma-scm — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited oma-scm (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Perform Git operations with explicit scope, traceable commits, and recoverable history.
oma-pm; security/testing review -> use oma-qa.Requested Git operation, repository state, and effective scm settings from project configuration.
Requested Git changes or an advisory plan, commit/branch identifiers, checks performed, and unresolved work.
Git CLI; project configuration and hooks. Read the references below only for the selected operation.
Inspect branch, upstream, staged/unstaged changes, and existing authorization. Select the commit path below or the configuration-management resource for broader operations.
resources/cm-operations.md.resources/merge-risk.md before selecting merge order or recovery steps.| Failure | Recovery |
|---|---|
| Unrelated dirty or staged files | Keep them outside the requested commit; never silently absorb them into an amend |
| Commit hook rejects a message | Fix the message or actual defect according to the hook; do not bypass it |
| Push is non-fast-forward | Fetch, inspect divergence, and integrate locally; do not retry with force |
| Conflicting changes | Preserve both intents, resolve, and run affected checks before completion |
| Likely secrets in the proposed diff | Stop before staging and identify the affected path without exposing the value |
Report created commits/refs and verification. A failed commit, rejected push, or unresolved conflict is not completion.
git status -sb
git diff --staged
git diff
git log --oneline -5resources/conventional-commits.md for message syntax, type, footer, and branch naming; apply repository hook/config limits. git add -- <specific-files>
git diff --cached --check
git diff --cached
git commit -F <message-file>git add -A or git add . without explicit authorization, and never include credentials or secret files.--force-with-lease, never plain --force.scm.require_pr_for_default_branch is true, use a topic branch and PR for default-branch changes, unless the user explicitly requested a direct push.Determine whether the target commit is shared using git log --oneline @{u}..HEAD when an upstream exists. If there is no upstream, inspect remote refs before assuming a commit is unshared. Keep unrelated staged changes out of the operation.
Git operations change the index, local commits/refs, worktrees, and possibly remote refs. Read only relevant project configuration; never copy credential values into messages or reports. Apply .agents/skills/_shared/core/execution-policy.md to authorization and verification.
resources/conventional-commits.md (commit requests)resources/cm-operations.md (governance/history/worktree tasks)resources/merge-risk.md (large merges)resources/codeowners-playbook.md (CODEOWNERS work)resources/onboarding-risk-signals.md (repository-risk assessment)../oma-observability/SKILL.md §Integrations (release markers and baseline comparisons)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.