gh — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited gh (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
gh pr edit --add-reviewer can fail with cryptic empty-string errors. Use the API directly instead:
gh api repos/{owner}/{repo}/pulls/{pr-number}/requested_reviewers \
-f "reviewers[]=username"gh run view --log can be unreliable for large logs. Download job logs directly via the API and save to a file for searching:
gh api repos/{owner}/{repo}/actions/jobs/{job-id}/logs > /tmp/job.logTo get job IDs for a run:
gh run view {run-id} --repo {owner}/{repo} --json jobs --jq '.jobs[] | {name, id, status, conclusion}'gh api repos/.../artifacts/{id}/zip > foo.zip can truncate large artifacts (≥1GB+) without erroring — the resulting file fails to unzip with "End-of-central-directory signature not found." Use gh run download instead, which streams the artifact correctly and unzips the outer wrapper for you:
gh run download {run-id} --repo {owner}/{repo} --name {artifact-name} --dir /tmp/outThe artifact's contents land directly in --dir (no outer .zip to unwrap). You still need to extract any inner .tar.gz/.zip payloads yourself.
gh-stackThe github/gh-stack extension (gh extension install github/gh-stack) manages a local stack of branches and the corresponding stack of PRs. A few non-obvious details:
If you already have a branch with work and an open PR, gh stack init without arguments errors out. Pass the branch name with -a/--adopt and the trunk with -b:
gh stack init -a --base dev nathan/dev/feature-oneThis registers the existing branch as the bottom of a new stack rooted at dev without creating any new commits or branches.
gh stack add nathan/dev/feature-twoCreates a new branch based on the current stack top and checks it out. You can then commit, and later gh stack submit --auto will push all branches in the stack and open PRs with the correct base chain (e.g. feature-two → feature-one → dev).
gh stack viewPrints an ASCII diagram of the stack with current branch, PR number, commit sha, and trunk. Much more useful than git log --graph for stack navigation.
gh stack down — check out the next branch toward trunk (parent in the stack).gh stack up — check out the next branch away from trunk (child in the stack).gh stack bottom / gh stack top — jump to the ends.gh stack submit --auto pushes every branch in the stack, creates or updates PRs on GitHub, and sets each PR's base to the branch below it. Safe to re-run after amending commits on any branch in the stack — it force-pushes the affected branches and leaves the untouched ones alone.
To re-sync without opening PRs:
gh stack pushgh stack submit does not stage or commit anything — stage and commit with git first, then submit.gh stack rebase (not git rebase) to propagate the new base through every layer.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.