github-backlog — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited github-backlog (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are managing the feature and bug backlog on GitHub as part of the Structured Agentic Development Workflow.
Output style: Check memory for workflow-config:caveman-level. If set, adapt your output brevity to that level while preserving technical accuracy.This skill talks to GitHub through whatever GitHub MCP server the user has configured. The server name is install-specific, so its tools may be named mcp__<server>__create_issue, mcp__<server>__list_issues, etc. (the official GitHub MCP server is a common choice). Calls to these tools are governed by your normal permission settings — this skill does not pin a server name. Before running any backlog task:
workflow-config:use-github-issues must be true. If it is false or unset, GitHub integration is disabled — stop and tell the user to enable it with /workflow-config (the local bugs.md / features.md flow applies instead).Resolve owner/repo every run, in this order:
workflow-config:github-repo is set in memory, use it verbatim. git remote get-url originStrip any trailing .git and extract owner/repo from either form:
[email protected]:owner/repo.git → owner/repohttps://github.com/owner/repo.git → owner/repo[email protected]:...) are not GitHub — stop and report.origin remote and no override, stop and ask the user to set workflow-config:github-repo via /workflow-config or add a GitHub origin.Do not persist the derived value — deriving fresh keeps it correct if the remote changes. workflow-config:github-repo exists only as an explicit override (for example, tracking issues in a different repo than origin).
Optionally retrieve workflow-config:github-project-id if a GitHub Project (V2) board is in use.
Parse the verb and details from $ARGUMENTS. Resolve the repo first (above), then:
create-bug <details>bug plus a priority:* label when priority is known.workflow-config:github-project-id is set, add the new issue to that project (see GitHub Projects section) with status Todo.create-feature <details>Same as create-bug, but use the Feature Template and labels feature (or enhancement) plus any priority:*.
list [filter]bug, priority:high, or status:todo).update <issue-number> <changes>status:*, add a comment, or close.Use these structures so issues carry high-fidelity context into the planning and build phases.
## Description
[Clear, concise description of the bug]
## Steps to Reproduce
1. Go to '...'
2. Click on '....'
3. See error '...'
## Expected Behavior
[What should have happened]
## Environment Details
- OS / Platform: [e.g., Linux, macOS, Windows]
- Context/Modules affected: [e.g., WebSocket sync, database migrations]
## Technical Analysis (Optional)
- Error trace: [paste logs or stack traces if available]## User Story / Value
As a [user type], I want to [action] so that [benefit].
## Core Requirements
- [Requirement 1]
- [Requirement 2]
## Implementation Notes & Scope
- Proposed technical approach: [brief overview]
- Out of scope: [what this issue will NOT address]Use the following labels to categorize issues and drive triage:
bug (for issues) or feature / enhancement (for features).priority:critical, priority:high, priority:medium, priority:low.status:todo — Ready to be picked up.status:in-progress — Currently active in a development phase.status:in-review — Under third-person review.status:done — Verified and completed.If workflow-config:github-project-id is configured:
/write-plan or /build-phase./3p-review./verification-before-completion passes.To ensure traceability:
docs/plans/new/offline-sync.md), include the GitHub Issue number at the top of the file: # Plan: Offline Sync (#123) Plan approved. Active plan file: docs/plans/offline-sync.mddocs/plans/done/, close the GitHub issue with a comment referencing the final commits or verification output.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.