pr-summary — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited pr-summary (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Constraint:
@rules/laravel/laravel.mdc, @rules/laravel/architecture.mdc, @rules/laravel/filament.mdc, and @rules/laravel/livewire.mdcAuthors line entirely; this metadata applies to the GitHub PR comment / linked-GitHub-issue mirror). Credit the real change author(s), not the agent or identity running the CR / publishing step. Extract authors from git commit history (git log --pretty='%an <%ae>' base..HEAD | sort -u) and from PR metadata (author.login and commits[].author.login returned by skills/code-review-github/scripts/load-issue.sh). When the target is GitHub, prefer @github-handle; when the target is JIRA, prefer the JIRA-account display name returned by the JIRA loader, otherwise fall back to the git Name <email>. Multiple authors are listed comma-separated in commit order. Never silently drop the Authors line — when authorship cannot be determined, write "Authors: unknown — git history did not yield a recognisable identity".config('feature.x'), env('SOMETHING_ENABLED'), GrowthBook / Unleash / LaunchDarkly check, a query-string ?debug=, a request header gate, or a hard-coded allow-list, surface the exact toggle and the value required to reach the change: on the GitHub target as an "Available behind" line; on the JIRA target folded into How to test step 1 (which enables the toggle before the tester proceeds). Omit it only when the change is reachable by every user unconditionally.templates/pr-summary-github.md: Authors, the conditional Available behind, Summary of changes, and How to test. No categories, no breaking-changes section, no testing-notes section.Authors line, no Summary of changes section, no Available behind metadata line. When the change is reachable only behind a test parameter, fold that toggle into How to test step 1 instead of a separate line. The JIRA audience gets exactly how to test the change, and nothing else unless the wrapper passes a clarifying-questions or assignment-compliance block.**bold** / __bold__ (→ *bold*), #/##/### ATX headings (→ h1./h2./h3.), ` code (→ {{code}}), fenced `` ` `` blocks (→ {code}…{code}), - / + bullets (→ `), and Markdown links `[label]` + `(url)` (→ `[label|url]`) per `@rules/jira/general.mdc`. The reader must never see a raw `* or #`.Clarifying questions block and/or the Assignment Compliance block returned by @skills/assignment-compliance-check/SKILL.md), append them verbatim after How to test and before the template's signature footer. Each embedded block must already be in the target tracker's markup (GitHub Markdown for GitHub, JIRA Wiki Markup for JIRA — the wrapper converts before passing). The resulting comment is published once per linked tracker target — that single consolidated comment is the only non-technical artifact a CR run posts on each linked issue or JIRA ticket. When no embedded blocks are passed, the template renders without that slot exactly as before.Assignment Compliance embedded block — i.e. the changes do not satisfy the assignment — render a single prominent verdict line at the very top of the comment (the {assignment_verdict} slot), in the assignment language, stating the non-compliance and the gap count N, and pointing to the Assignment Compliance detail below. This guarantees the reader sees the assignment was not met without scrolling to the appended block. Derive N from the passed block (Critical gaps found: N verdict line, or the number of gap entries). When no Assignment Compliance block is passed (the changes satisfy the assignment, or no tracker is linked), omit the slot entirely — never render a positive "satisfies the assignment" banner, consistent with the report-only-what-needs-action convention.Steps:
master or main).git log base..HEAD).skills/code-review-github/scripts/load-issue.sh <NUMBER|URL> — read body, comments[], author, commits[].author, and closingIssues[] off the resulting JSON document.skills/code-review-jira/scripts/load-issue.sh <KEY|URL> — read descriptionText, comments[], assignee, reporter, and linked PRs.gh pr view, gh issue view, or acli directly; fall back to the GitHub / JIRA MCP server only when the loader is unavailable (exit code 2/3).git log --pretty='%an <%ae>' base..HEAD | awk 'NF' | sort -u to collect commit authors.author.login and the unique commits[].author.login set — these give GitHub handles that are preferred over the raw Name <email> form when the target tracker is GitHub.assignee / reporter matching the committer), prefer the JIRA display name.@ for GitHub handles. If no identity could be resolved, fall back to "unknown — git history did not yield a recognisable identity".config('…') / env('…') toggles, GrowthBook / Unleash / LaunchDarkly flag checks, query-string parameters (?debug=, ?preview=), request headers (X-Beta-…), middleware allow-lists (Auth::user()->isInternal()), feature-flag attributes, A/B variant branches. For every guard found, record the toggle name, the value required to reach the change, and any documented switch label (admin screen, ENV var). Populate the conditional Available behind line; omit it only when no guard exists on the path to the change.@skills/resolve-issue/references/source-detection.md (branch name / PR description / linked issue trail):^[A-Z][A-Z0-9_]+-\d+$), or the JIRA loader from step 4 returns a non-empty document. Use templates/pr-summary-jira.md (JIRA Wiki Markup).templates/pr-summary-github.md (GitHub Markdown).How to test in that case.How to test (the same ordered, end-to-end test steps). Do not render Authors, Summary of changes, or an Available behind line. When test-parameter gating was detected in step 6, the first How to test step enables / supplies the toggle. Everything else the JIRA reader sees comes from the conditional embedded blocks (clarifying questions, assignment compliance) the wrapper passes — never authored here.How to test section and the template's signature footer, separated by a single blank line. Render each block exactly as received — no re-formatting, no language conversion (the caller already converted to the target tracker's markup), no re-ordering. The result is a single consolidated comment per linked tracker target.Assignment Compliance block, render the {assignment_verdict} line at the very top of the comment (before Authors on GitHub, before How to test on JIRA), in the assignment language, naming the gap count N derived from that block and pointing to the detail below — e.g. ⚠️ **Changes do not satisfy the assignment — N gap(s). See Assignment Compliance below.** (Czech → ⚠️ **Změny nesplňují zadání — N nedostatk(ů). Viz Assignment Compliance níže.**). Omit the slot entirely when no Assignment Compliance block was passed.Output format:
templates/pr-summary-github.md (full shape: Authors / Available behind / Summary of changes / How to test).templates/pr-summary-jira.md — the reduced shape: only How to test plus any conditional embedded blocks (Clarifying questions, Assignment Compliance). Do not translate the Wiki Markup back to Markdown when posting via acli / JIRA MCP server — JIRA UI does not render Markdown, and no raw Markdown control character may leak into the body.After completing the tasks
gh issue comment / gh pr comment / acli jira workitem comment add calls.skills/code-review-github/scripts/upsert-comment.sh <NUMBER|URL> -. The helper detects the current GitHub actor (gh api user --jq .login), appends the marker <!-- cr-comment:actor=<gh-login> --> for traceability, and POSTs a fresh comment on every run (the helper never PATCHes a prior comment in place). Fall back to the GitHub MCP server's addIssueComment only when the helper exits with code 2 (missing tool) or 3 (API failure) — also as a fresh post; never call updateIssueComment to edit a previous CR / pr-summary comment.skills/code-review-jira/scripts/upsert-comment.sh <KEY|URL> -. The helper POSTs a new comment on every run — it never edits a prior comment in place. Fall back to the JIRA MCP server's addCommentToJiraIssue only when the helper exits with code 2 (missing tool) or 3 (API failure) — also as a fresh post.created) plus the resulting comment URL in the CR wrapper's summary line.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.