qc — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited qc (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Portable, project-agnostic quick-commit skill. Drop this file at ~/.claude/skills/qc/SKILL.md to make /qc available in every project on the machine.
A project may override this with its own .claude/skills/qc/SKILL.md (project-local takes precedence). Use that for project-specific commit conventions (e.g. required task IDs).
main (or master, whichever the repo's default branch is — detect with git symbolic-ref refs/remotes/origin/HEAD), commit, push origin's default branch directly. Solo-speed flow — skips the PR review path. Only use when the user is the only reviewer and the change is ready.If /qc main is invoked while on a feature branch with uncommitted changes, carry the changes across with git stash --include-untracked → git checkout <default> → git stash pop → resolve any conflicts → continue. If conflicts can't be resolved cleanly, stop and surface to the user; do not throw away work.
gh installed and authenticated/qc relies on gh having configured git's credential helper so git push over HTTPS doesn't prompt. Before staging anything, verify:
command -v gh >/dev/null && gh auth status >/dev/null 2>&1If that exits non-zero, bootstrap before continuing.
gh if missingDetect platform first; pick the matching command:
type -p curl >/dev/null || sudo apt install -y curl
curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
| sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg
sudo chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
| sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null
sudo apt update && sudo apt install -y ghbrew install ghsudo dnf install -y ghsudo pacman -S --noconfirm github-clisudo apk add github-cliwinget install --id GitHub.clisudo will prompt the user — that is expected; do not try to bypass.
gh auth login --hostname github.com --git-protocol https --webThis prints a one-time code, opens the user's browser to https://github.com/login/device, and configures git's credential helper on success.
If the host is headless and can't open a browser:
gh auth login --hostname github.com --git-protocol httpsFollow the prompts (paste-the-code flow works without a local browser). For SSH protocol instead, swap --git-protocol https → --git-protocol ssh and let gh upload an SSH key for the user.
gh auth status # expect "Logged in to github.com account <user>"
git push --dry-run # confirms credential helper is active for this repoRe-run the gh auth status check after install/auth before continuing to staging. If any step still fails, stop and surface the failure to the user — do not commit work that can't be pushed.
Run in parallel; read the actual changes before drafting any message:
git status
git diff --stat
git diff --cached
git log -5 --onelineLook for:
.env, *.key, node_modules/, large binaries, __pycache__/).git log (Conventional Commits? Project-specific tags like [JIRA-123] or [W1.A.0]? Plain prose?). Match the existing style.Before drafting the message, check for project-specific rules in this order (stop at the first hit):
type(scope): summary if Conventional, JIRA-123: ... if ticket-prefixed, plain imperative one-liner otherwise).If a project mandates a task ID (e.g. [W1.A.0], JIRA-123, #42), resolve it from:
git log -20 --pretty=%s | grep -oE '<id-pattern>' | head -1 to reuse the active task.BUILD_PLAN.md, ROADMAP.md, .linear/, etc.) cross-referenced with the touched paths.Prefer named-path staging over git add -A:
git add path/to/file.py path/to/other.mdThis avoids sweeping in .env, credentials, __pycache__/, build artifacts, or large binaries the user didn't mean to commit.
git add -A / git add . is acceptable only if:
git status shows no unexpected files (no .env*, no *secret*, no large unfamiliar additions).One sentence, imperative voice ("add", "fix", "remove" — not "added", "adding"), focused on why the change is being made, not what files changed (the diff already shows that).
Defaults if no project convention is detected:
<type>(<scope>): <summary>type ∈ {feat, fix, test, chore, docs, refactor, perf, style, ci, build, revert}.scope is optional but recommended — the module/area touched.Verb mapping when picking type:
featfixtestchoredocsrefactorperfForbidden in commit messages:
Co-Authored-By: Claude …, 🤖 Generated with [Claude Code], or any AI-attribution line. Authorship is git committer + signature only.Update files. or Misc changes. — say what changed and why.State the drafted message to the user in one line before committing, so they can correct it if needed.
git commit -m "<type>(<scope>): <summary>"Hard rules — never violate:
--no-verify (skipping pre-commit / commit-msg hooks).--no-gpg-sign (skipping GPG signing if the repo requires it).git commit --amend to fold in a fix — that rewrites history. Always make a new commit.--allow-empty unless explicitly requested.If a pre-commit hook fails: read the failure output, fix the underlying issue (lint, format, type-check, etc.), re-stage the fix, and create a new commit (the hook failure means the prior commit didn't happen — --amend would fold into the previous successful commit, which is wrong). If the hook fails repeatedly on the same issue, stop and root-cause; do not loop.
If the user asks you to bypass hooks, refuse and explain why. Hooks exist because the project's maintainers wanted them; bypassing is a project-policy decision, not a one-off override. Ask the user to either fix the issue or, if they're sure, run the bypass themselves with git commit --no-verify — don't do it on their behalf.
git push -u origin HEADIf the branch already tracks an upstream, plain git push is fine.
For /qc main:
git push origin <default-branch>Force-push is not part of `/qc`. If git push rejects with non-fast-forward, stop and surface to the user. Do not --force or --force-with-lease autonomously — that overwrites someone else's work and is destructive.
If the staged changes are obviously two unrelated concerns (e.g. a feat + an unrelated docs fix), split into two commits with two messages rather than mushing them together. State the split plan before staging the first one.
A reasonable rule of thumb: if you'd write two different type(scope) headers for the same diff, it's two commits.
/qc does not dogh pr create --fill) — that's a separate /ship or gh pr create step.gh pr merge) — same.pre-commit install first or surface to the user.~/.gitconfig or set committer identity. If user.name / user.email aren't set, surface to the user — guessing the identity is wrong..env, large binaries, secrets) → list them, ask.git push rejected (non-fast-forward, branch protection, etc.) → show the error verbatim; do not --force.gh auth status fails after attempted bootstrap → stop, show the error, ask the user to run gh auth login manually.This file is the entire skill. To share it with a teammate:
SKILL.md.~/.claude/skills/qc/SKILL.md (create the dir if needed)./qc is available globally on their machine.Or commit a copy at <your-project>/.claude/skills/qc/SKILL.md so anyone working in that project gets it project-locally without installing globally.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.