workflow-pr — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited workflow-pr (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
full checklist for every pull request.
JavaScript/TypeScript:
pnpm typecheck && pnpm build && pnpm test
# or: npm run typecheck && npm run build && npm testPython:
mypy . && python -m pytest && ruff check .With Makefile:
make typecheck && make build && make testBefore committing, verify:
/Users/username/...)pull_request_template.md in repoCheck every 60-90 seconds until checks complete:
Understanding Check Status:
mergeable: true → Only means no git conflictsmergeable_state: "clean" → ALL checks passed, safe to mergeMergeable State Values:
| State | Meaning | Action |
|---|---|---|
"clean" | ✅ All passed | Safe to merge |
"unstable" | ⚠️ Pending/failing | Wait, poll again |
"blocked" | ❌ Protection rules | Check requirements |
"behind" | ⚠️ Needs update | Update branch |
When reviews complete:
After pushing fixes:
SUCCESSTwo gates must pass:
| Gate | Check |
|---|---|
| Gate 1 | mergeable_state == "clean" |
| Gate 2 | unresolved_thread_count == 0 |
Both must be TRUE to merge.
Only after both gates pass:
gh pr merge --mergeConfirm merge was successful and report status.
| Situation | Action |
|---|---|
| Checks fail 3x | Pause, ask for guidance |
| Unclear feedback | Ask clarifying questions |
| Merge blocked | Check protection rules, report |
| Checks stuck | Run local validation, ask permission |
mergeable_state is "unstable"Fix: Always check mergeable_state, poll again if unstable
mergeable: true as approvalFix: mergeable ≠ mergeable_state. Check the latter.
Fix: After every push, re-fetch comments for new threads
Fix: After addressing each comment, mark thread resolved
# Check PR status
gh pr status
# View checks
gh pr checks <number>
# View comments
gh pr view <number> --comments
# Merge (only when both gates pass)
gh pr merge <number> --merge~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.