n8n:create-pr — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited n8n:create-pr (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Creates GitHub PRs with titles that pass n8n's check-pr-title CI validation.
<type>(<scope>): <summary>| Type | Description | Changelog |
|---|---|---|
feat | New feature | Yes |
fix | Bug fix | Yes |
perf | Performance improvement | Yes |
test | Adding/correcting tests | No |
docs | Documentation only | No |
refactor | Code change (no bug fix or feature) | No |
build | Build system or dependencies | No |
ci | CI configuration | No |
chore | Routine tasks, maintenance | No |
API - Public API changesbenchmark - Benchmark CLI changescore - Core/backend/private APIeditor - Editor UI changes* Node - Specific node (e.g., Slack Node, GitHub Node)(no-changelog) suffix to exclude from changelog git status
git diff --stat
git log origin/master..HEAD --oneline.claude/plans/ or .agents/plans/ when present)that matches the current branch's ticket ID (e.g. if branch is scdekov/PAY-1234-some-feature, check for PAY-1234.md). If a plan file exists, ask the user whether they want to include it in the PR description as a collapsible <details> section (see Plan Section below). Only include the plan if the user explicitly approves.
proceeding (see Security Fixes below).
git push -u origin HEAD.github/pull_request_template.md as thebody structure, then populate each section with actual content before creating the PR:
https://linear.app/n8n/issue/[TICKET-ID]) and any GitHub issue links gh pr create --draft --title "<type>(<scope>): <summary>" --body "$(cat <<'EOF'
<populated body based on pull_request_template.md>
EOF
)"Based on .github/pull_request_template.md:
module via N8N_ENABLED_MODULES, an enterprise license, a feature flag, or similar), note which env vars/license are needed so the tester can deploy a correctly configured instance
https://linear.app/n8n/issue/[TICKET-ID]closes #123 / fixes #123 / resolves #123All items should be addressed before merging:
release/backport label added if urgent fix needs backportingfeat(editor): Add workflow performance metrics displayfix(core): Resolve memory leak in execution enginefix(Slack Node): Handle rate limiting in message sendfeat(API)!: Remove deprecated v1 endpointsrefactor(core): Simplify error handling (no-changelog)chore: Update dependencies to latest versionsThe PR title must match this pattern:
^(feat|fix|perf|test|docs|refactor|build|ci|chore|revert)(\([a-zA-Z0-9 ]+( Node)?\))?!?: [A-Z].+[^.]$Key validation rules:
If a matching plan file was found in a repository plan directory and the user has approved including it, add a collapsible section at the end of the PR body (after the checklist, before EOF):
<details>
<summary>Implementation plan</summary>
<!-- paste plan file contents here -->
</details>This repo is public. Never expose the attack vector in any public artifact. Describe what the code does, not what threat it prevents.
| Artifact | BAD | GOOD |
|---|---|---|
| Branch | fix-sql-injection-in-webhook | fix-webhook-input-validation |
| PR title | fix(core): Prevent SSRF | fix(core): Validate outgoing URLs |
| Commit msg | fix: prevent denial of service | fix: add payload size validation |
| PR body | "attacker could trigger SSRF…" | "validates URL protocol and host" |
| Linear ref | URL with slug (leaks title) | URL without slug or ticket ID only |
| Test name | 'should prevent SQL injection' | 'should sanitize query parameters' |
Before pushing a security fix, verify: no branch name, commit, PR title, PR body, Linear URL, test name, or code comment hints at the vulnerability.
When in doubt, check the Linear issue for possible extra precautions
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.