contributor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited contributor (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Automated open source contribution workflow that takes you from a GitHub repo URL to merged PRs, with built-in safeguards against common contribution failures.
Open source contributions fail for predictable reasons: fixing in the wrong layer (your PR gets closed because the maintainer preferred an upstream fix), colliding with other contributors, not following project conventions, or over-engineering a simple fix. This workflow prevents each of those failures through systematic pre-checks.
Before writing any code, gather intelligence about the project and its contribution landscape.
Ask the user for:
pydantic/pydantic-ai)Use gh CLI to find issues worth contributing to:
# Get open issues with metadata
gh issue list -R <owner>/<repo> --state open --limit 50 \
--json number,title,labels,assignees,comments
# Check for competing PRs on each candidate
gh pr list -R <owner>/<repo> --state open \
--search "<issue_number> in:title,body"Filter criteria (apply in order):
bug, good first issue, help wantedFor each candidate issue, read the full comment thread:
gh issue view <number> -R <owner>/<repo> --json body,commentsExtract:
This is the single most common failure mode. Before committing to any fix:
# Check if maintainers reference another repo
gh issue view <number> -R <owner>/<repo> --json comments \
| grep -i "upstream\|genai-prices\|separate repo\|other repo"
# Check related repos for recent PRs mentioning this issue
gh pr list -R <owner>/<related-repo> --state open --limit 10 \
--json title,body | grep -i "<issue_number>\|<issue_keywords>"If there's any signal the fix belongs elsewhere, stop and ask the user before proceeding.
Never submit a PR cold. Always communicate your intent first.
Before writing code, leave a comment on the issue with your proposed approach. This serves two purposes: it claims the work (politely), and it gives maintainers a chance to redirect you before you waste effort.
Template:
Hi, I've been looking into this and traced the root cause to <X>.
Before I open a PR, I wanted to confirm the preferred approach:
A) <approach A — e.g., fix in this repo by modifying X>
B) <approach B — e.g., upstream fix in related-repo>
I can implement either direction. Happy to adjust based on your preference.Wait for maintainer response before proceeding to code. If no response after 24-48 hours on an active project, proceed with the most conservative approach (smallest scope fix in the current repo).
Plan to open as a Draft PR first. Convert to ready-for-review only after:
gh repo fork <owner>/<repo> --clone --remote
cd <repo>Don't assume main. Check what recent merged PRs target:
gh pr list -R <owner>/<repo> --state merged --limit 10 \
--json baseRefName,mergedAtUse the most common baseRefName from recent merges.
Check these files in order (read whichever exist):
CONTRIBUTING.md
.github/CONTRIBUTING.md
.github/PULL_REQUEST_TEMPLATE.md
.github/PULL_REQUEST_TEMPLATE/Extract:
ls .github/workflows/Read the CI config to know what checks will run on your PR. Identify the commands for:
Follow the project's documented setup process. Run the full test suite once to establish a passing baseline before making any changes.
git checkout -b fix/issue-<number>-<short-desc> <base-branch>Run the project's test suite. All existing tests must pass. Your new test must also pass. If the project has type checking or linting, run those too.
Language-specific verification:
pytest, mypy, ruff (or whatever the project uses)npx tsc --noEmit, project test commandcargo check && cargo testgo build ./... && go test ./...If the project uses pre-commit hooks:
pre-commit run --all-filesFix any issues before committing.
# Configure author
git config user.name "<user's name>"
git config user.email "<user's email>"
# Commit with DCO sign-off
git commit -s -m "<type>: <description>
Fixes #<issue-number>"Rules:
Fixes #<number> or Closes #<number> to auto-linkGenerated by Claude, Co-Authored-By: claude, or any AI attributiongit push -u origin fix/issue-<number>-<short-desc>Create a Draft PR following the project's template:
gh pr create --draft --title "<type>: <short description>" \
--body "$(cat <<'EOF'
## Summary
<1-2 sentences describing the fix>
Fixes #<issue-number>
## Changes
- <bullet points of what changed>
## Test plan
- <how this was tested>
EOF
)"Don't panic. Common reasons and responses:
| Reason | Response |
|---|---|
| Fix moved upstream | Ask to contribute to the upstream repo instead |
| Approach rejected | Ask what approach they'd prefer, offer to redo |
| Duplicate | Acknowledge, offer to help review the other PR |
| Scope too large | Offer to split into smaller PRs |
Template for closed PRs:
Thanks for the feedback. I understand the fix direction has shifted to <X>.
Would it be helpful if I submitted a PR to <upstream-repo> instead?
Happy to contribute wherever it's most useful.Address review feedback promptly. Make each revision a new commit (don't squash during review — the maintainer may want to see the evolution). Only squash if the maintainer asks.
These are real failure modes from production contributions:
main when the project develops on dev. Prevention: Phase 3.2 branch detection.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.