wait-for-pr-checks — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited wait-for-pr-checks (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Wraps bin/wait-for-pr-checks.sh. Poll-based; uses gh pr checks <num> under the hood. The script is the same one release.sh will uses to gate the tag step (when --wait-for-checks is passed), so the contract is shared.
The script auto-resolves from the current branch via gh pr view, so the most common invocation is:
bin/wait-for-pr-checks.sh --target <cwd>Pass --pr <number> when watching a PR you don't have checked out.
Defaults:
--timeout 1800 (30 minutes)--interval 30 (poll every 30 seconds)Bump timeout for slow CI matrices ("integration tests take 90 min" → --timeout 7200). Drop interval for snappy local CI ("we Just hit go" → --interval 10). Don't go below 10 seconds — gh API rate limits start to bite.
The script emits a PRChecksResult JSON. Branch on .outcome:
| Outcome | Meaning | What the user should do |
|---|---|---|
pass | every check completed with a passing conclusion | proceed with the gated action (merge, tag, deploy) |
no-checks | PR has no checks attached | proceed; treat as pass |
fail | at least one check failed (loop bailed early) | open the linked workflow; don't proceed |
timeout | deadline reached, some still in_progress | retry with a longer timeout, or investigate slow runners |
skipped | gh missing/unauthenticated, or PR couldn't be resolved | tell the user; can't proceed |
Exit code mirrors the outcome: 0 for pass / no-checks / skipped, 3 for fail / timeout — caller scripts can gate on $?.
This skill only waits. To wait-then-merge in one step, use /nyann:ship — it opens a PR and merges it in one flow (either via GitHub auto-merge or by polling CI client-side). Reserve this skill for cases where the user wants the wait surfaced explicitly (release runs, manual gating).
/nyann:ship(opens a PR and merges it, waiting for CI as needed).
gh pr checksdirectly; no polling needed.
gh run view <run-id> --log-failed;this skill only reports outcomes, not log contents.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.