pr-monitor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited pr-monitor (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Monitors Dependabot and Snyk dependency upgrade PRs, automatically merging them when builds pass. Handles javax/jakarta compatibility validation and provides detailed status reporting.
gh CLI must be authenticatedGet PRs from today or specific PR numbers:
# Get all PRs from today
gh pr list --json number,title,createdAt,author --jq '.[] | select(.createdAt | startswith("'$(date +%Y-%m-%d)'"))'
# Or use specific PR numbers provided by userFor each PR, check:
Use the bundled pr-monitor.sh script (see Tool Usage below).
PASSING builds:
gh pr merge <number> --squash --autoPENDING builds:
FAILING builds:
CLOSED/MERGED:
Poll every 2 minutes (120 seconds) for up to 2 hours:
Use the bundled pr-monitor.sh script:
.opencode/skills/pr-monitor/pr-monitor.sh <pr_numbers_or_'today'>Examples:
# Monitor all PRs from today
.opencode/skills/pr-monitor/pr-monitor.sh today
# Monitor specific PRs
.opencode/skills/pr-monitor/pr-monitor.sh 2001 2005 2006
# One-time check (no loop)
.opencode/skills/pr-monitor/pr-monitor.sh --check-once 2001The script provides real-time status:
[2026-05-04 20:54:25] Iteration 1/60
-------------------------------------------
PR #2017: ✅ PASSING - Attempting to merge...
PR #2017: 🎉 MERGED SUCCESSFULLY
PR #2001: ⏳ PENDING - Buildkite still running
PR #2005: ❌ FAILING - Buildkite: FAILURE
PR #2006: ✅ MERGED
Next check in 120s...Cannot fetch PR status:
gh authentication: gh auth statusgh pr view <number>Merge fails:
jakarta-namespace incompatibility:
After fixing build issues (like in today's session):
@dependabot rebase in PR comments.opencode/skills/pr-monitor/pr-monitor.sh today--squash merge by default (matches MockServer convention)--auto flag to enable auto-merge queue (waits for required checks)MAX_ITERATIONS at top of pr-monitor.sh, default 60)SLEEP_INTERVAL at top of pr-monitor.sh, default 120)gh CLI allows 5,000 requests/hour; each PR check uses ~2-3 API calls, so monitoring up to ~20 PRs at 2-minute intervals is well within limitsUser: "monitor the PRs raised today and merge them when builds pass"
Agent: I'll monitor all dependency PRs from today and auto-merge them when builds pass.
[Runs: .opencode/skills/pr-monitor/pr-monitor.sh today]
[Output shows monitoring progress...]
Agent: All PRs processed:
- PR #2017: ✅ MERGED
- PR #2001: ✅ MERGED
- PR #2005: ✅ MERGED
- PR #2006: ✅ MERGED~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.