closing-issues — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited closing-issues (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A flowing graph that turns "close GitHub issue + capture what I learned" into a structural DAG. The synthesis text is validated upfront, the close happens against the GitHub API, and an optional post-close callback runs detached so the close ack is unblocked.
from closing_issues import close_issue
result = close_issue(
repo="owner/repo",
number=42,
synthesis=(
"Pattern X works because of Y. Constraint: don't apply to Z. "
"Future note: revisit when feature Q lands."
),
)
print(result["issue_url"]) # https://github.com/.../issues/42
print(result["comment_url"]) # ...#issuecomment-...Closing an issue produces two artifacts:
already show what was done.
than the diff in mental cache.
Good closing comments lead with why, not what. Failure modes, constraints discovered, alternatives rejected. The synthesis is the seed of an institutional memory.
prepare_synthesis ──▶ close_github_issue [terminal]
│
└──▶ post_close_callback [detached, when=callback]string. Empty or whitespace-only → FAILED with no GitHub API call. This is structural: callers can't accidentally close-with-no-text.
PATCHes the issue to state=closed, state_reason=completed. Returns the issue URL and comment URL.
any extra work — store synthesis in a memory system, ping a tracker, emit a webhook. Failure here lands in result["detached_failures"] and does NOT bubble up as a close failure. Skipped via when= if the callback isn't provided.
def store_in_my_memory(synthesis: str, issue_url: str, repo: str, number: int):
# Whatever your memory layer is — Turso, sqlite, a JSON file, etc.
db.execute("INSERT INTO learnings (issue, synthesis) VALUES (?, ?)",
(issue_url, synthesis))
return {"stored": True}
result = close_issue(
repo="owner/repo",
number=42,
synthesis="...",
post_close_callback=store_in_my_memory,
)
if result["callback_result"] is None and result["detached_failures"]:
# The callback failed but the issue is still closed.
print("Memory store failed:", result["detached_failures"])The callback receives keyword arguments: synthesis, issue_url, repo, number. Anything it returns goes into result["callback_result"].
{
"issue_url": "https://github.com/owner/repo/issues/N",
"comment_url": "https://github.com/.../issues/N#issuecomment-...",
"comment_id": 12345,
"callback_result": <whatever the callback returned, or None>,
"detached_failures": [], # populated if callback raised
}Raises RuntimeError only if the GitHub close itself fails. Callback failures are detached.
Requires GH_TOKEN (or GITHUB_TOKEN) in the environment. Classic PAT or fine-grained PAT with repo scope (specifically issues:write).
to say beyond "done," just gh issue close N directly. This skill is for the synthesis use case.
fine, but the flow setup cost per call is small but not zero).
flowing — the DAG runner this skill is built onopening-prs — the symmetric "open and merge" flow~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.