gh-pr — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited gh-pr (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Create a pull request from the current branch using gh pr create.
# Inspect branch state (check commits ahead of base)
git status --short --branch
git log --oneline --decorate
# Create and push branch if needed
git checkout -b <branch>
git push -u origin <branch>
# Write PR body
cat > /tmp/pr-body.md << 'EOF'
## Description
<!-- Please include a summary of the changes and the related issue. Please also include relevant motivation and context. -->
Fixes # (issue)
## Type of change
<!-- Please delete options that are not relevant. -->
- [ ] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Test
<!-- How was this tested? -->
---
Assisted-by: {HARNESS_NAME}:${MODEL_NAME}
EOF
# Create PR with labels
gh pr create \
--draft \
--base main \
--head <branch> \
--title "<title>" \
--body-file /tmp/pr-body.md \
--label "<label>"--draft). Mark as ready only when the user explicitly asks you to do so.--label when creating PRs. Choose based on repository conventions (e.g., bug, enhancement, documentation, chore)feat/, fix/, chore/ followed by a short descriptionAssisted-by: {HARNESS_NAME}:${MODEL_NAME} to the PR body.Minimize (fold/hide) all comments on a PR created by a specific user. Uses the GitHub GraphQL API minimizeComment mutation with OUTDATED classifier. Covers three types of comments:
IC_* node_idPRRC_* node_idPRR_* node_id# Issue comments (top-level PR comments)
gh api "/repos/{owner}/{repo}/issues/{pr_number}/comments" \
--jq '.[] | select(.user.login == "{username}" and (.body | startswith("## PR Self-Test Report"))) | {id, node_id, body_preview: .body[0:100]}'
# Inline review comments (file-level)
gh api "/repos/{owner}/{repo}/pulls/{pr_number}/comments" \
--jq '.[] | select(.user.login == "{username}") | {id, node_id, path, body_preview: .body[0:80]}'
# PR reviews (summary-level)
gh api "/repos/{owner}/{repo}/pulls/{pr_number}/reviews" \
--jq '.[] | select(.user.login == "{username}") | {id, node_id, body_preview: (.body // "")[0:100], state}'# For each comment's node_id, run:
gh api graphql -f query='
mutation($subjectId: ID!, $classifier: ReportedContentClassifiers!) {
minimizeComment(input: {subjectId: $subjectId, classifier: $classifier}) {
minimizedComment {
isMinimized
minimizedReason
}
}
}
' -F subjectId="{node_id}" -F classifier=OUTDATED# Check one comment via GraphQL
gh api graphql -f query='
query {
node(id: "{node_id}") {
... on IssueComment { isMinimized minimizedReason }
... on PullRequestReviewComment { isMinimized minimizedReason }
... on PullRequestReview { isMinimized minimizedReason }
}
}
'OUTDATED is the recommended classifier for old test reports and stale review comments.select(.user.login == "{username}") to only target comments by a specific user.startswith("## PR Self-Test Report") to target only self-test report comments.IC_* node_id prefix, review comments use PRRC_*, and PR reviews use PRR_*.minimizeComment mutation works on all three types uniformly.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.