atomic-issues-prs — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited atomic-issues-prs (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Publish a change-set as atomic GitHub objects: one issue/PR per logical change, never bundled. The layer above atomic-commit-and-push — it opens the PRs (and optionally issues) that skill never touches.
Run gh auth status. If unauthenticated, stop and ask the user to run gh auth login.
Resolve the canonical (upstream) slug explicitly before any permission check — gh repo view's default inspects the current repo, which is the fork in a fork clone.
git remote -v. Pick the contribution target: upstream if present, else origin.gh repo view <slug> --json nameWithOwner,parent,defaultBranchRef.A non-null parent means <slug> is itself a fork, so the canonical slug is parent.nameWithOwner.
gh repo view <canonical-slug> --json viewerPermission.viewerPermission ∈ {ADMIN, MAINTAIN, WRITE} ⇒ direct mode; otherwise ⇒ fork mode.
defaultBranchRef.Group working-tree changes into atomic units by mechanism/file boundary — one concern per unit. Never bundle unrelated changes.
Commit the whole set into N atomic commits first, running the repo-native type-checker and linter before each commit. This is the patch-isolation mechanism: each unit becomes one self-contained commit, so per-unit branches come from cherry-pick — never from re-staging a dirty tree, which would let later units swallow earlier diffs. Present the unit→commit list to the user.
Ask what to create per unit:
Closes #N.One answer applies to the run; honor a per-unit override if the user volunteers one.
Push by URL, never by remote name — this avoids undefined targets (a canonical slug from parent has no local remote) and remote-name collisions / local-config mutation. With gh authenticated, the git credential helper authorizes HTTPS pushes.
https://github.com/<canonical-slug>.gh api user --jq .login); fork slug = <login>/<repo>.If the fork does not exist, create it (gh repo fork <canonical-slug> --clone=false) — ask the user first, it is a write action. Push URL = https://github.com/<fork-slug>.
Default contract: units are independent — each branches off the canonical base and merges alone. Determine dependency order in Phase 1; if no unit depends on another, every PR bases on <default>. For each unit, in dependency order:
git branch <branch> <parent-ref> then git cherry-pick <unit-commit> onto it.<parent-ref> = <canonical-default-base>; PR bases on <default>.<parent-ref> = the prerequisite unit's already-pushedbranch; PR bases on that branch (a stacked PR). Cherry-pick only this unit's commit — the prerequisite is already present via the parent branch, so no prerequisite is lost.
branch in the canonical repo, not the fork). Stop and ask the user to land the prerequisite PR first, then re-run for the dependent unit — do not silently flatten it onto <default>.
git push <push-url> <branch>:refs/heads/<branch> (same form both modes — only the URL differs).gh issue create --repo <canonical-slug> --title "<summary>" --body-file <tmp> → capture #N.gh pr create --repo <canonical-slug> — direct mode: --base <parent-ref> --head <branch>;fork mode: --base <default> --head <fork-owner>:<branch>. Include Closes #N in the body when an issue was filed.
--force or --force-with-lease without explicit user authorization.main, master, release/*) — branches only.gh repo fork.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.