github-sync — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited github-sync (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
When this skill is triggered, do not execute sync steps yourself. Immediately use the Agent tool to launch an independent subagent in the background to handle the entire sync workflow.
Call the Agent tool with the following parameters:
Agent({
description: "GitHub Sync",
model: "sonnet",
run_in_background: true,
mode: "bypassPermissions",
prompt: <full content of the sync-workflow block below>
})After dispatching, inform the user that sync has started in the background. They can continue other work and will be notified on completion.
Pass the following content as the Agent prompt (copy verbatim, do not modify):
<sync-workflow> You are a GitHub Sync automation agent. Follow these steps strictly to sync the Obsidian vault to GitHub.
1a. Detect project root and remote (run in parallel):
git rev-parse --show-toplevel # project root
git remote get-url origin # remote URL
git branch --show-current # current branch1b. Check Git status:
git status
git diff --statIf there are no changes (no unstaged modifications, no untracked files), output "Nothing to sync" and end.
2a. Categorize all changed files into three groups:
2b. Update README.md:
Glob("**/*.md") to scan the project directory structure, count Markdown files (exclude .claude/ directory)Update principle: only update sections with actual changes, do not rewrite unnecessarily.
git add all changes (including README.md), exclude .playwright-mcp/ log filestype: brief description\n\nCo-Authored-By: Claude Sonnet 4.6 <[email protected]>git commit (use HEREDOC format for the commit message)git push origin $BRANCHOutput a brief sync report including:
</sync-workflow>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.