Is pr-analysis safe to install?

SaferSkills independently audited pr-analysis (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/pr-analysis/SKILL.md · 1 file

skills/pr-analysis/SKILL.md1.6 KB · Markdown

name: pr-analysis

description: Use this workflow skill for a deep, read-only PR review covering intent, code quality, regression risk, test gaps, and feedback status; prefer it over check-ci when the request is broader than CI triage.

PR Analysis

Perform a read-only PR review that covers intent, correctness, regression risk, tests, and existing feedback.

Workflow

Resolve the PR with gh pr view <pr> --json ... and capture the head branch, base branch, title, and body.
Gather context with gh pr diff, gh pr diff --stat, gh pr checks, review comments, conversation comments, and review verdicts.
Use gh api graphql only when you need unresolved review thread state.
Read full changed files from the PR branch and the base branch, not just diff hunks.
Find related callers, interfaces, and tests in the local codebase.
If validation is warranted, run the lightest relevant repo validation rather than a blanket heavy build.
Produce findings first, then open questions, then a short summary.

Repo Rules

Prefer gh for PR metadata and CI data.
Prefer repo validations:
TypeScript: bun run lint, bun run build, bun test
Fast checks: bash scripts/all_fast_validate_checks.sh
Android or iOS only when the PR actually touches those areas
Keep the analysis read-only unless the user explicitly asks for fixes.
When saving large diffs or logs, put them in scratch/.

Output Structure

Findings ordered by severity with file:line references
Open questions or assumptions
Brief change summary and residual risks

pr-analysis— agent skill

Is pr-analysis safe to install?

PR Analysis

Workflow

Repo Rules

Output Structure

Audit the pieces. Scan the whole. Decide.