pr-summary — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited pr-summary (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
eval "$("${VIBESTACK_HOME:-$HOME/.vibestack}/bin/vibe-slug" 2>/dev/null)" 2>/dev/null || SLUG="unknown"
_LEARN_FILE="${VIBESTACK_HOME:-$HOME/.vibestack}/projects/${SLUG:-unknown}/learnings.jsonl"
if [ -f "$_LEARN_FILE" ]; then
_LEARN_COUNT=$(wc -l < "$_LEARN_FILE" 2>/dev/null | tr -d ' ')
echo "LEARNINGS: $_LEARN_COUNT entries loaded"
if [ "$_LEARN_COUNT" -gt 5 ] 2>/dev/null; then
"${VIBESTACK_HOME:-$HOME/.vibestack}/bin/vibe-learnings-search" --limit 5 2>/dev/null || true
fi
else
echo "LEARNINGS: none yet"
fi{{include lib/snippets/session-host.md}}
{{include lib/snippets/working-protocols.md}}
{{include lib/snippets/state-protocols.md}}
Determine the PR number from argument or current branch:
# If argument provided, use it directly
PR_NUMBER={argument}
# Otherwise, infer from current branch
gh pr view --json number -q '.number'# Get current PR details
gh pr view {PR_NUMBER} --json title,body,baseRefName,headRefName,commits,files
# Get base branch
BASE_BRANCH=$(gh pr view {PR_NUMBER} --json baseRefName -q '.baseRefName')
# View all commits in PR
gh pr view {PR_NUMBER} --json commits -q '.commits[] | "\(.oid[:7]) \(.messageHeadline)"'
# View all changed files with stats
gh pr diff {PR_NUMBER} --stat
# View full diff
gh pr diff {PR_NUMBER}CRITICAL: Check the existing PR body first.
# Get current PR body
EXISTING_BODY=$(gh pr view {PR_NUMBER} --json body -q '.body')Check for user-added content to preserve:
If the existing body contains user-added content, preserve it in a ## Notes section at the bottom.
CRITICAL: Do not rely on diff statistics alone — understand the meaning of the changes.
For large PRs (>20 files or >1000 lines changed):
For each changed file:
Categorize changes:
| Category | Description |
|---|---|
| New Feature | New functionality added |
| Bug Fix | Existing behavior corrected |
| Refactor | Code restructured without behavior change |
| Performance | Optimization improvements |
| Documentation | Docs, comments, README updates |
| Test | Test additions or modifications |
| Configuration | Config, CI/CD, build changes |
| Dependency | Package additions, updates, removals |
| Breaking Change | Changes that break existing API/behavior |
Deliberation questions:
Before writing, articulate:
PR body format:
## Summary
- Brief description of what and WHY
## Changes
- Change 1: why this was needed
- Change 2: why this was needed
## Breaking Changes
- (if any) Description of breaking change and migration path
## Test Plan
- [ ] How to verify changes work
- [ ] Edge cases to testThe body quotes commit messages, diff content and the existing PR text, so it never appears in shell source — not in a quoted argument, and not in a heredoc either: a line equal to the terminator ends the heredoc and everything after it runs as shell. Create a private file for it:
PR_BODY_FILE=$(mktemp "${TMPDIR:-/tmp}/vibe-pr-summary-XXXXXXXX")
echo "PR_BODY_FILE: $PR_BODY_FILE"Read the empty file, then Write the body into the printed `PR_BODY_FILE` with the Write tool, in the Step 5 format with every section filled from the analysis (omit Breaking Changes when there are none). Then publish that file, substituting the printed path and the PR number:
PR_BODY_FILE='<PR_BODY_FILE>'
[ -s "$PR_BODY_FILE" ] || { echo "ABORT: $PR_BODY_FILE is empty — write the body with the Write tool first" >&2; exit 1; }
gh pr edit {PR_NUMBER} --body-file "$PR_BODY_FILE" && rm -f "$PR_BODY_FILE"# Confirm PR was updated
gh pr view {PR_NUMBER} --json title,body -q '.body'## PR Summary Updated
**PR**: #{PR_NUMBER}
**Title**: {title}
**Base**: {base_branch} ← {head_branch}
### Analysis
- Total commits: {N}
- Files changed: {N}
- Lines added: +{N}
- Lines removed: -{N}
### Categories
- feat: {N} changes
- fix: {N} changes
- refactor: {N} changes
- ...
PR description updated successfully.If the PR title is vague (e.g., "update", "fix", "WIP"), suggest a better title:
gh pr edit {PR_NUMBER} --title "<type>(<scope>): <subject>"Note: PR title optionally uses scope. Commit messages use <type>: <subject> format without scope.Only suggest title changes when:
If you discovered a non-obvious pattern, pitfall, or insight during this session, log it:
"${VIBESTACK_HOME:-$HOME/.vibestack}/bin/vibe-learnings-log" '{"skill":"pr-summary","type":"TYPE","key":"SHORT_KEY","insight":"DESCRIPTION","confidence":N,"source":"SOURCE","files":["path/to/relevant/file"]}'Types: pattern, pitfall, preference, architecture, operational.
Only log genuine discoveries.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.