issue-to-pr-resolver — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited issue-to-pr-resolver (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Implement GitHub issue #$ARGUMENTS in homeassistant-ai/ha-mcp end-to-end.
Read the issue:
gh issue view "$ARGUMENTS" --repo homeassistant-ai/ha-mcp --json title,body,labels,comments,authorCreate a worktree from repo root:
cd "$(git rev-parse --show-toplevel)"
git checkout master && git pull origin master
git worktree add "worktree/issue-$ARGUMENTS" -b "feature/issue-$ARGUMENTS"
git -C "worktree/issue-$ARGUMENTS" submodule update --init --recursive
cd "worktree/issue-$ARGUMENTS"AGENTS.md for patterns, naming, error handling)src/ha_mcp/tools/ need E2E testscd tests && uv run pytest src/e2e/ -n2 --dist loadscope -v --tb=shortPhilosophy: Work autonomously. Don't ask about every small decision. Fix unrelated test failures encountered. Document all choices for the final summary.
If a non-obvious choice has significant consequences, create two mutually exclusive PRs (one per approach) and let the user choose.
git push -u origin "feature/issue-$ARGUMENTS"
PR_NUMBER=$(gh pr create --draft \
--repo homeassistant-ai/ha-mcp \
--title "<descriptive title>" \
--body "Closes #$ARGUMENTS
## What does this PR do?
[description]
" | grep -oE '[0-9]+$')Wait for CI:
gh pr checks "$PR_NUMBER" --repo homeassistant-ai/ha-mcp --watchBefore marking ready (gh pr ready), update the PR description to reflect all changes made.
Repeat until all checks green and no unresolved threads:
Check for issues:
gh pr checks "$PR_NUMBER" --repo homeassistant-ai/ha-mcp
gh api repos/homeassistant-ai/ha-mcp/pulls/"$PR_NUMBER"/comments \
--jq '.[] | {id, path, line, author: .user.login, body}'
gh api graphql -F pr="$PR_NUMBER" -f query='query($pr: Int!) { repository(owner:"homeassistant-ai", name:"ha-mcp") { pullRequest(number:$pr) { reviewThreads(first:100) { nodes { id isResolved comments(first:1) { nodes { databaseId body } } } } } } }'Resolve each comment (both steps required):
# 1. Reply on the inline thread
gh api repos/homeassistant-ai/ha-mcp/pulls/"$PR_NUMBER"/comments/<COMMENT_ID>/replies \
-f body="✅ Fixed in [commit]. [explanation]"
# or: -f body="📝 Not addressing because [reason]."
# 2. Resolve the thread via GraphQL
gh api graphql -f query='mutation($threadId: ID!) { resolveReviewThread(input: {threadId: $threadId}) { thread { id isResolved } } }' \
-f threadId="<PRRT_...>"After pushing fixes, wait and re-check:
gh pr checks "$PR_NUMBER" --repo homeassistant-ai/ha-mcp --watchOnce all checks pass and all threads resolved:
gh pr comment "$PR_NUMBER" --repo homeassistant-ai/ha-mcp --body "## Implementation Summary
**Choices Made:**
- [key technical decisions with rationale]
**Problems Encountered:**
- [issues faced and how resolved]
- [unrelated test failures fixed, if any]
"Report to user: PR number, status, key choices.
## Future improvements without the user explicitly confirming the work is out of scope.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.