github-issue-workflow — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited github-issue-workflow (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
All development work follows this strict issue-first workflow. Never start coding without an issue.
Before any code changes, ensure a GitHub issue exists.
Creating a new issue:
gh issue create --title "Brief description" --body "Detailed description of the problem or feature"Finding existing issues:
gh issue list
gh issue view <number>Issue requirements:
Note the issue number (e.g., #42) for branch naming.
Create a branch that links to the issue. Branch naming convention: <issue-number>-<short-description>
# Ensure main is up to date
git checkout main
git pull origin main
# Create and switch to feature branch
git checkout -b 42-fix-login-timeoutPush the branch to establish remote tracking:
git push -u origin 42-fix-login-timeoutMake changes on the feature branch. Commit frequently with meaningful messages referencing the issue:
git add <files>
git commit -m "Add timeout configuration option (#42)"Commit message guidelines:
This is critical. Do not proceed until the implementation is 100% validated.
Validation checklist:
npm test, pytest, go test, etc.If validation fails:
Add comments to the GitHub issue documenting what was tried and what failed:
gh issue comment <number> --body "Attempted X approach. Failed because Y. Trying Z next."Then iterate: fix → commit → validate again.
Continue this loop until validation passes 100%. Do not move to PR phase with partial solutions.
Only after validation passes, create a PR:
gh pr create --title "Fix login timeout (#42)" --body "Closes #42
## Changes
- Added configurable timeout
- Updated tests
## Testing
- All existing tests pass
- Added new timeout test"PR requirements:
Closes #42 (or Fixes #42) for auto-closingAfter PR approval (or for personal repos, after self-review):
Merge the PR:
gh pr merge <pr-number> --squash --delete-branchThe --delete-branch flag removes the remote feature branch.
Clean up local branch:
git checkout main
git pull origin main
git branch -d 42-fix-login-timeoutVerify issue is closed:
gh issue view 42If the issue didn't auto-close, close it manually:
gh issue close 42 --comment "Resolved in PR #<pr-number>"| Phase | Key Command |
|---|---|
| Create issue | gh issue create --title "..." --body "..." |
| Create branch | git checkout -b <issue#>-<desc> |
| Push branch | git push -u origin <branch> |
| Commit | git commit -m "Message (#issue)" |
| Comment on issue | gh issue comment <#> --body "..." |
| Create PR | gh pr create --title "... (#issue)" --body "Closes #issue" |
| Merge & cleanup | gh pr merge <#> --squash --delete-branch |
| Delete local branch | git branch -d <branch> |
| Close issue | gh issue close <#> |
Issue already exists: Skip Phase 1, proceed to Phase 2 with existing issue number.
Multiple issues for one change: Create a parent issue and reference all related issues in PR body.
Validation takes multiple sessions: Always document progress in issue comments before stopping work.
Need to abandon an approach: Comment on issue explaining why, then start fresh implementation on same branch or create new branch if significant pivot.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.