create-pr — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited create-pr (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Create a pull request from the current branch using project conventions.
/create-prRun these commands to understand the current state:
# Get current branch name
git branch --show-current
# Check if branch needs pushing
git status -sb
# Get commits on this branch not on main
git log main..HEAD --oneline
# Get diff summary against main
git diff main...HEAD --statParse the branch name to find the ticket number:
{type}/{TICKET-NUMBER}-{description}feat/AB-123-sanitize-input → AB-123AB-123, SSP-456)If no ticket found, ask the user.
Use the /jira-ticket skill or the Jira MCP tools directly to get ticket details for the PR description:
mcp__jira__jira_get with:
path: /rest/api/3/issue/{ticketNumber}
jq: "{key: key, summary: fields.summary, description: fields.description}"Use conventional commit format based on branch prefix:
| Branch Prefix | PR Title Format |
|---|---|
feat/ | feat(<scope>): <description> |
fix/ | fix(<scope>): <description> |
refactor/ | refactor(<scope>): <description> |
chore/ | chore(<scope>): <description> |
docs/ | docs(<scope>): <description> |
perf/ | perf(<scope>): <description> |
Infer the scope from changed files (e.g., offers-cms, web, api).
Analyze the actual code changes (use git diff main...HEAD) to write a meaningful description.
Check for a repo-specific PR template at .github/pull-request-template.md or .github/pull_request_template.md. If found, use that format. If not, ask user for confirmation on generating the body ourselves.
# Push branch with upstream tracking
git push -u origin {branch-name}Create the PR targeting main:
~/.claude/skills/create-pr/scripts/gh-pr-create.sh --base main --title "{title}" --body "$(cat <<'EOF'
{body}
EOF
)"If the script is unavailable, fall back to:
gh pr create --base main --title "{title}" --body "$(cat <<'EOF'
{body}
EOF
)"Once the PR is created, close the bead for this work — this is the preferred close point in a PR workflow (the commit was done in /complete-task, which deliberately left the bead open for this step). Reopen later if review demands major changes.
Skip this whole step silently if bd is unavailable or the repo has no beads database.
bd list --status=in_progressMatch by the Jira key from §2 appearing in the bead title/description, or an obvious 1:1 correspondence to the branch.
bd close <bead-id> --reason="PR #<number> created: <pr-title>"AskUserQuestion. If none match, skip silently — don't invent one. bd update <bead-id> --status=in_progressNote: /ready-to-merge already closes a bead only "if still in_progress" post-merge, so closing here is compatible — by merge time it's normally already closed and that step no-ops.
Output the PR URL so the user can view it, and note the bead that was closed (or left open, if none matched).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.