Is create-bug-workflow safe to install?

SaferSkills independently audited create-bug-workflow (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/create-bug-workflow/SKILL.md · 1 file

skills/create-bug-workflow/SKILL.md1.4 KB · Markdown

name: create-bug-workflow

description: |

Open bug reports on Jira or GitHub after collecting target link, format template, and bug details — confirm before creating.

Use when the user chooses Create bug from Helix, invokes /create-bug, or wants issues filed from test findings.

Do NOT use for Playwright test runs (testing-ticket-workflow), retest-after-fix (retest-bug-workflow), posting manual TC tables (tc-fe-prep / tc-api-prep), or updating test result sheets without filing bugs.

proactive_triggers:

- /create-bug

- create bug

- file bug

- open bug

- log defect

Create Bug (discovery stub)

Thin entry for agent skill discovery. Full procedure: WORKFLOW.md.

When invoked:

Announce once: Using **create-bug-workflow** to file the bug report.
Read and follow WORKFLOW.md end-to-end — every step, gate, and reference.

Claude Code shortcut: /create-bug → commands/create-bug.md.

Refusal-first (precondition gate)

All preconditions and refusal rules are in WORKFLOW.md. MUST NOT create issues until the user approves each draft.

QA closing (mandatory before "done")

All close-out gates are in WORKFLOW.md and verify-closing-checklist.md (Create bug section). MUST verify each created issue URL before reporting done.

create-bug-workflow— agent skill

Is create-bug-workflow safe to install?

Create Bug (discovery stub)

Refusal-first (precondition gate)

QA closing (mandatory before "done")

Audit the pieces. Scan the whole. Decide.