make-issue-comment — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited make-issue-comment (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Post (or update) a structured investigation comment on a GitHub PR. The comment captures what was debugged, what the root cause is, the proposed fix, verification, and a live progress checklist — so the user or the next engineer can reopen it later and rebuild context fast.
This is not /make-issue (which opens a new GitHub issue). This skill only creates/updates comments on existing PRs.
The skill has two invocation paths, and they deserve different first steps:
/make-issue-comment, or wrote something unambiguous like "post this on the PR", "file these findings as a PR comment", "update the comment", "mark the comment resolved". Skip to step 1.AskUserQuestion:Question: Looks like we've landed on a root cause and a fix plan for <one-line topic>. Want me to post a structured investigation comment on the PR so it's captured for later? Options: - Yes, post a comment — continue to step 1. - Not now — acknowledge briefly and stop. Do not re-propose in the same conversation unless the user says something new that clearly revives the idea.Use theory of mind when deciding whether to propose at all. Good signals: the user just confirmed a fix works, you just wrote up a root cause analysis, the branch has an open PR, the conversation has been going for a while and producing durable findings. Bad signals: the investigation is still live, the user is mid-question, you're inside a small bugfix that's already being committed, or the user just dismissed a similar proposal. When in doubt, err toward not proposing — interrupting with a pitch is more annoying than failing to pitch.
$ARGUMENTSOnce you've decided to proceed, decide what to do. Use the argument first, then fall back to conversation signals:
new, or a short topic (e.g. "swipe edit dead zone") → Create a new comment.update / update <notes> / progress → Update an existing comment (tick boxes, refresh sections, add follow-ups).resolve / mark resolved / done → Resolve an existing comment (tick every remaining box, append [ ✅ **resolved** ] to the H2).If the conversation already contains clear "I fixed it" signals and the intent is still ambiguous, ask which action they want with AskUserQuestion before doing anything else.
Try in order, stopping at the first that succeeds:
gh pr view --json number,url,headRefName,title,baseRefNamegh pr list --state open --json number,title,headRefName,url --limit 20 and use AskUserQuestion to let the user pick. Include the branch name in each option label so mis-clicks are unlikely.Record owner/repo (from gh repo view --json owner,name) and the PR number — every subsequent gh call needs them.
The authoritative source is the current conversation. Extract:
If a piece is thin, fill it in before drafting:
git log --oneline -20Read tool (never eyeball)package.json / yarn.lock / equivalent for the actual installed versionConcrete evidence is the whole point of this comment. Vague summaries waste everyone's time.
Follow this structure exactly. Reference samples to calibrate tone:
## <short descriptive title>
### Issue
<1–2 paragraphs. Quote the error/warning verbatim with a blockquote if there is one. Describe the observed vs expected behavior.>
### Investigation
<What was actually run: grep commands, log excerpts, tables of tap-x vs event, files inspected. Prefer concrete evidence over prose.>
### Root cause
<The smoking gun. Bold the offending package@version or the specific file:line. One paragraph explaining why it breaks.>
### Fix
<Exact change needed. Commands, diffs, or a numbered list of edits with file paths. If no source changes are required (e.g. lockfile bump only), say so explicitly.>
### Verification
<The regression test that fails before and passes after, or the manual reproduction steps with expected output. Include test file paths.>
### Progress
- [ ] <concrete step 1>
- [ ] <concrete step 2>
...Optional ### Follow-ups (out of scope here) section — use it when you surfaced related issues that should not block this fix. Keep follow-ups as a short bulleted list.
Formatting conventions from the reference samples:
### Fix (minimal), ### Verification (Android emulator)) when it clarifies scope.bash`, `js`, `json``).**package@version**, **not**). 2390573 `.Skip a section only if it is structurally impossible to fill (e.g. root cause still unknown). When skipping, keep the heading and write TBD under it — later updates will slot in cleanly.
Use AskUserQuestion to show the draft:
Do not post without approval.
Write the body to a temp file first so heredoc quoting and backticks don't get mangled:
BODY_FILE=$(mktemp -t pr-comment.XXXXXX.md)
cat > "$BODY_FILE" <<'EOF'
## <title>
### Issue
...
EOF
gh pr comment <pr-number> --repo <owner>/<repo> --body-file "$BODY_FILE"
rm "$BODY_FILE"Print the returned comment URL back to the user.
update / resolve)Get the current user's login and list their comments on the PR, filtered to ones that match our format signature (body starts with ## and contains ### Progress):
VIEWER=$(gh api user --jq .login)
gh api "repos/<owner>/<repo>/issues/<pr-number>/comments" \
--paginate \
--jq ".[] | select(.user.login == \"$VIEWER\") | select(.body | startswith(\"## \")) | select(.body | contains(\"### Progress\")) | {id, html_url, body}"If multiple matches come back, use AskUserQuestion with each candidate's H2 title as the label. If the user named a comment URL or ID in the arguments, match that directly instead.
Read the existing body, then:
- [ ] boxes the user has actually completed to - [x]. Add new progress lines for work done since the comment was created. Refresh ### Verification or ### Fix if anything material changed. Preserve all other content verbatim.update, plus:- [ ] that the user confirms is done (ask with AskUserQuestion if any are ambiguous — do not silently check boxes)## <title> to ## <title> [ ✅ **resolved** ]BODY_FILE=$(mktemp -t pr-comment.XXXXXX.md)
cat > "$BODY_FILE" <<'EOF'
<new body>
EOF
gh api -X PATCH "repos/<owner>/<repo>/issues/comments/<comment-id>" \
--field body=@"$BODY_FILE"
rm "$BODY_FILE"Print the comment URL again so the user can click through and eyeball the diff.
gh auth status shows you're logged in as a bot or a different account than the user expects, stop and flag it — posting under the wrong identity is hard to undo.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.