time-registration — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited time-registration (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Summarize recent git activity into a short, comma-separated one-liner suitable for time registration or standup notes. Includes commits from sibling worktrees of the current repo, remote-tracking branches (work pushed from other machines), and recently merged PRs — not just the current working tree.
The user may provide a time period as a free-text argument:
Parse the intent and translate it to a git log --since/--until date range.
Before running the log, echo the accepted hints so the user sees their options:
Time period: today (default). Other options: yesterday, this-week, last-week, last-3-days, since-<day>.If the user passed an argument, skip the hint line and just confirm the parsed range (e.g. Time period: last week (2026-04-13 → 2026-04-20)).
Convert the user's input to concrete dates. Examples:
--since="today 00:00" (default when no argument given)--since="yesterday 00:00" --until="today 00:00"--since="3 days ago"--since="last monday"--since="2 mondays ago" --until="last monday"Work may have been pushed from other machines or already merged upstream — fetch before scanning so remote-tracking refs are current. Run once per unique repo across worktrees (worktrees share an object store, so one fetch covers all of them):
git fetch --all --quiet --pruneIf fetch fails (offline, auth error), warn the user and continue with whatever local refs already exist — do not fail the skill.
Commits in other worktrees, on unchecked-out branches, or on remote-tracking refs don't show up in the current tree's git log by default. List every worktree and run a log scoped with --all so each iteration surfaces the full ref graph reachable from that worktree's repo store (local branches, remote-tracking branches, refs/stash):
git worktree list --porcelain | awk '/^worktree /{print $2}'author="$(git config user.name)"
email="$(git config user.email)"
for wt in $(git worktree list --porcelain | awk '/^worktree /{print $2}'); do
echo "=== $wt ==="
# Multiple --author flags OR together, catching commits where user.name
# varies across machines but the email is consistent:
git -C "$wt" log --all \
--author="$author" --author="$email" \
--since="<start>" --until="<end>" \
--oneline --no-merges
doneDedupe by commit SHA across worktree iterations — --all returns overlapping sets across worktrees that share refs. A simple awk '!seen[$1]++' over the concatenated output works, or build a SHA → first-seen worktree map for attribution context.
If every worktree returns empty, fall through to step 4 — merged PRs may still surface activity (e.g., squash-merged work where the original branch was pruned).
Squash-merge workflows replace branch commits with a single new SHA on the default branch, sometimes authored by the merger rather than the user. The user's own work disappears from git log --author=<self> once the source branch is deleted. To recover it, query GitHub directly.
Skip this step silently if gh isn't installed (command -v gh) or the repo isn't on GitHub (gh repo view --json url 2>/dev/null fails).
Otherwise, list PRs authored by the user merged within the same window — the merged: search qualifiers already imply state=merged, so no --state flag is needed:
gh pr list --author "@me" \
--search "merged:>=<start-date> merged:<=<end-date>" \
--json number,title,mergedAt,headRefName,url \
--limit 50Translate the date range into ISO YYYY-MM-DD for the search qualifiers (e.g., merged:>=2026-04-29 merged:<=2026-05-06).
If a PR's commits already showed up in step 3 (match by headRefName or commit SHA via gh pr view <num> --json commits), prefer the PR title for summarization — PR titles tend to read better than individual commit messages. If a PR's commits are NOT in step 3's output (squash-merged + branch pruned), add the PR title as a standalone summary item.
Read through the commit messages across all worktrees plus the merged PR titles and distill them into a single comma-separated summary line. The summary should:
Example output:
Implemented user authentication, fixed pagination bug on dashboard, upgraded React from 18 to 19, refactored API error handlingAfter printing the summary line, use AskUserQuestion to offer copying it to the macOS clipboard. Default to "Yes" — most callers want to paste into a timesheet.
Copy summary to clipboard?Yes, copy it / No, leave itIf the user picks "Yes", pipe the exact summary line to pbcopy:
printf %s "<summary line>" | pbcopyConfirm with a single line (e.g. Copied.). Skip this step if the summary was empty (no commits found).
Only if the user explicitly asks to check multiple repos, ask which directories to check using AskUserQuestion. Then repeat the worktree-aware log in each directory and produce one summary per repo.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.