assignment-compliance-check — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited assignment-compliance-check (Agent Skill) and scored it 91/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
ignore/disregard/forget … previous instructions sentence.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
@rules/php/core-standards.mdc@rules/git/general.mdc@rules/jira/general.mdc@rules/reports/general.mdc — the Assignment Compliance markdown block this skill returns to the caller must be written in the language of the linked assignment (Czech issue / JIRA description → Czech block; English → English). Linked-task / PR URLs, author handles, and severity labels follow the rule's Scope clarifications.gh issue comment, no acli, no JIRA / GitHub MCP write call. The skill returns either the assembled markdown block (on every run that has a linked tracker, including the affirmative report on a clean run) or a skip status (only when no linked tracker is detected) to the calling CR wrapper. The wrapper embeds the block into the single consolidated linked-tracker comment authored by @skills/pr-summary/SKILL.md (one comment per linked issue / JIRA ticket per CR run — see issue #498) only when a block is returned; on the skip status the wrapper embeds nothing and surfaces the status only on the PR comment summary line.@skills/code-review/SKILL.md, @skills/code-review-github/SKILL.md, or @skills/code-review-jira/SKILL.md. The PR comment carries technical findings; the linked-tracker comment carries assignment compliance as part of the consolidated pr-summary output.Authors line — resolved exactly as @skills/pr-summary/SKILL.md resolves them (git history %an <%ae> + PR author.login + commits[].author.login, JIRA display name when the target is JIRA). Never list the agent / CR identity. When authorship cannot be determined, write unknown — git history did not yield a recognisable identity.@skills/pr-summary/SKILL.md does (scan the diff for config('…') / env('…') checks, GrowthBook / Unleash / LaunchDarkly calls, query / header gates, allow-list middleware), name the toggle, and state the value required to reach the change. Omit the line entirely only when the change is reachable unconditionally.@skills/code-review/SKILL.md, @skills/code-review-github/SKILL.md, and @skills/code-review-jira/SKILL.md.skills/code-review-github/scripts/load-issue.sh <NUMBER|URL> against the linked issue. Read the full body, every entry in comments[] (including replies), and every referenced attachment URL.skills/code-review-jira/scripts/load-issue.sh <KEY|URL>. Read descriptionText, comments[], and any attachment metadata.skills/code-review-bugsnag/scripts/load-issue.sh <URL|TRIPLE> (requires BUGSNAG_TOKEN) to read the error class, message, context, and latestEvent.stacktrace as the assignment. The error is also mirrored to GitHub via linkedIssues[]; load that linked GitHub issue as well to pick up any human-authored acceptance criteria and apply the GitHub branch on top.gh, acli, api.bugsnag.com, or REST endpoints directly — always use the deterministic loaders.@skills/resolve-issue/SKILL.md). Keep only the current requirements as the source of truth.For the assignment + current comments, enumerate:
Skip generic developer hygiene wishes ("clean code", "tests please"). The check is strictly about business behavior described by the reporter.
skills/code-review-github/scripts/load-issue.sh <PR-NUMBER> for the PR and read files[], body, and commits[].For every requirement from step 2, decide one of:
Do not report stylistic / architectural / test-coverage concerns even if you notice them — those belong in @skills/code-review/SKILL.md and @skills/security-review/SKILL.md.
Quiet mode (loop iterations from `@skills/process-code-review/SKILL.md`): the loop iterations call this skill with "do not publish; return findings as in-memory markdown for this loop iteration only" — which is now the only mode this skill ever operates in. The skill never publishes anywhere itself; every caller (loop iteration or final consolidating publish) receives the same in-memory return. The loop convergence math still counts Critical gaps from the returned block.
@rules/code-review/general.mdc Two-part CR output — Technical & Functional review): a full checklist of every extracted acceptance criterion with its status, plus an explicit Goal met: Yes/No verdict. Render the affirmative report (Goal met: Yes) when every criterion is Met — never skip or omit the block on a clean run. Use GitHub-flavoured Markdown by default; convert to JIRA Wiki Markup per @rules/jira/general.mdc when the calling CR wrapper signals a JIRA tracker target (h2. / h3. headings, *bold*, _italic_, {{inline}}, {code:php}…{code}, * / # bullets, [label|url], {quote}).@skills/code-review-github/SKILL.md / @skills/code-review-jira/SKILL.md) embeds the returned block into the single consolidated linked-tracker comment authored by @skills/pr-summary/SKILL.md (see issue #498 — one comment per linked issue per CR run) only when a block is returned.closingIssues[] empty for GitHub PRs, or no JIRA ticket detected for JIRA-originated), return the status no linked issue — assignment compliance skipped instead of a block so the CR wrapper can include the status in its PR comment summary line without embedding an empty section.code-review, code-review-github, code-review-jira) must not embed the Assignment Compliance content into the GitHub PR comment — it belongs in the consolidated linked-tracker comment, never on the PR comment, which carries technical findings only.Render this block on every run that has a linked tracker — including the fully affirmative report. Never skip or omit the block when every acceptance criterion is Met; the affirmative render is the explicit, narrow exception to the project's "report only what needs action" convention (@rules/code-review/general.mdc Two-part CR output — Technical & Functional review), scoped to this Functional-review verdict alone.Assignment Compliance comment posted to the issue tracker (Markdown shown; convert to Wiki Markup for JIRA per @rules/jira/general.mdc):
## Assignment Compliance
- **Linked task:** <issue / JIRA / Bugsnag URL>
- **Pull request:** <PR URL>
- **Authors:** <@github-handle or JIRA display name of the real change author(s), comma-separated in commit order — resolved exactly as `@skills/pr-summary/SKILL.md` resolves them; never the agent / CR identity>
- **Available behind:** <optional — present only when the change is reachable only behind a test parameter (feature flag, ENV switch, query string, admin toggle, allow-listed account); name the toggle and the value required to reach it. Omit the line entirely when the change is reachable unconditionally.>
- **Goal met:** Yes | No
### Acceptance criteria
1. <short title in everyday language> — **Met**
2. <short title in everyday language> — **Not met**
- **What the task asked for:** <one sentence quoting or paraphrasing the requirement, with the source comment URL or "issue description">
- **What the pull request does instead:** <one sentence describing the actual behavior implied by the diff>
- **Example a tester would see:** <concrete input → expected output vs actual output, ideally taken from the example the reporter provided; when *Available behind* is set, the example must start by enabling the gating toggle>
(Repeat for every acceptance criterion. **Met** entries carry only the one-line status; **Not met** / **Partial** / **Divergent** entries carry the three detail fields above.)The block carries no file paths, line numbers, or code snippets — the linked-tracker audience is non-technical reviewers and product owners. Technical details belong on the PR. Every acceptance criterion is listed, including Met ones — this is the full functional checklist, not a gap-only report; only reviewer questions stay out of scope for this skill.
Goal met: Yes/No verdict, rendered on every run that has a linked tracker, including the affirmative report when every criterion is Met;no linked issue — assignment compliance skipped (when no linked tracker exists).gh issue comment, no acli, no GitHub / JIRA MCP write call. Publishing is exclusively the responsibility of the CR wrapper through @skills/pr-summary/SKILL.md as the single consolidated linked-tracker comment, and the wrapper embeds nothing only when the skip status was returned.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.