contribute-turbo-45701e — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited contribute-turbo-45701e (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Submit staged turbo skill improvements from ~/.turbo/repo/ back to the upstream repo. The workflow adapts based on repoMode in ~/.turbo/config.json.
Read ~/.turbo/config.json and check repoMode:
"fork" or "source" — proceed"clone" — tell the user that contributions require a fork. Offer to help convert their clone to a fork (add their fork as origin, rename current origin to upstream). Stop.Verify the repo exists and has the expected remotes:
git -C ~/.turbo/repo remote -vPort session corrections from ~/.agents/skills/<name>/ (where edits land first) into ~/.turbo/repo/codex/skills/<name>/ (the basis for the contribution), leaving any persistent local customizations in the installed copy untouched.
Detect drifted skills:
for skill in ~/.agents/skills/*/; do
name=$(basename "$skill")
repo_dir=~/.turbo/repo/codex/skills/"$name"
[ -d "$repo_dir" ] || continue
diff -rq "$skill" "$repo_dir" >/dev/null 2>&1 && continue
echo "$name"
doneFor each drifted skill, first check whether the repo copy already has unstaged changes for it (git -C ~/.turbo/repo status --porcelain codex/skills/<name>/). If it does, use request_user_input to ask the user how to proceed before mirroring — those changes will conflate with mirrored corrections in Step 3 if not resolved.
Then read both versions of every changed file and classify each hunk:
apply_patch. For files deleted from the installed copy, remove the repo copy with rm.request_user_input to confirm classification before applying.Before staging, check whether the Codex paths drifted in Step 2 have parallel files in the Claude edition that should be updated alongside them:
codex/skills/<name>/ ↔ claude/skills/<name>/codex/SKILL-CONVENTIONS.md ↔ claude/SKILL-CONVENTIONS.mdcodex/ADDITIONS.md ↔ claude/ADDITIONS.mdcodex/SETUP.md ↔ claude/SETUP.mdcodex/UPDATE.md ↔ claude/UPDATE.mdcodex/MIGRATION.md ↔ claude/MIGRATION.mdFor each Codex path with pending changes, check whether the Claude sibling exists in ~/.turbo/repo/claude/ and whether the local repo already has matching changes for it (git -C ~/.turbo/repo status --porcelain claude/<path>). If a Claude sibling exists but has no matching changes, use request_user_input:
The change tocodex/<path>touches the Codex edition, butclaude/<path>exists and has no matching change. Does the Claude sibling need the same update?
Options:
~/.turbo/repo/claude/<path> (vocabulary differs; only behavioral parity is required) and re-runs this skill.If any sibling-update answer is "Yes", stop the workflow. Nothing has been staged yet, so there is no state to clean up before re-running.
Check what changes exist in the local repo:
git -C ~/.turbo/repo diff --name-only
git -C ~/.turbo/repo diff --cached --name-onlyIf there are unstaged changes to skill files, stage the specific skill directories that changed (both editions, when sibling updates landed in Step 3):
git -C ~/.turbo/repo add codex/skills/<name>/
git -C ~/.turbo/repo add claude/skills/<name>/ # if a sibling was updatedIf there are no changes at all, tell the user there is nothing to contribute and stop.
Present the changes in a summary table:
| # | Skill | Change Summary |
|---|-------|----------------|
| 1 | $evaluate-findings | Added handling for security-default findings |
| 2 | $self-improve | Clarified routing for trusted reviewer feedback |Use request_user_input to confirm which changes to include. If the user deselects some, unstage those files.
Read ~/.turbo/repo/codex/SKILL-CONVENTIONS.md for the turbo project's skill conventions. These conventions supplement $create-skill's general best practices with turbo-specific patterns.
For each confirmed skill, if $create-skill has not been invoked for it in this session, run $create-skill to review and refine the skill. Any improvements from the review become part of the contribution.
For each change, construct a "why" explanation. The goal: the turbo maintainer should understand what happened and why the existing instructions were insufficient, without learning anything about the contributor's project.
Use this template:
During [general workflow description], the skill's instructions [what was missing or wrong]. This caused [what happened]. The change [what it does] so that [benefit].
Example:
During a code review session, the evaluate-findings skill encountered a finding withsecurity-defaultseverity. The existing instructions only handledcritical,high,medium, andlowseverities, causing the finding to be silently dropped. The change addssecurity-defaultto the severity handling table so these findings are properly triaged.
Before finalizing, verify each "why" description contains none of the following:
Output the drafted context as text. Then use request_user_input for approval. The user must approve the contribution message before proceeding.
Run $commit-rules to load commit message rules and technical constraints.
When multiple skills were changed, batch related changes into a single branch and commit. Create separate branches only when changes are independent and unrelated.
Create a feature branch:
git -C ~/.turbo/repo checkout -b improve/<skill-name>-<short-desc>Commit with a message matching the turbo repo style (check git -C ~/.turbo/repo log -n 10 --oneline). Incorporate the "why" context in the commit message.
Stay on main. Commit directly with the same message style.
Run $github-voice to load writing style rules.
Push and create a PR:
git -C ~/.turbo/repo push -u origin improve/<skill-name>-<short-desc>Create the PR against the upstream repo:
gh pr create --repo tobihagemann/turbo --head <user>:improve/<skill-name>-<short-desc> --title "..." --body "..."PR body format:
## Summary
- [1-3 bullet points]
## Context
[The crafted "why" explanation from Step 6]Return to main after creating the PR:
git -C ~/.turbo/repo checkout mainReport the PR URL.
Pull and rebase before pushing to incorporate any upstream changes:
git -C ~/.turbo/repo pull --rebase origin mainIf the rebase pulled in new commits, run $update-turbo to apply upstream changes (skill updates, migrations, config changes) to the local installation before pushing.
Then push:
git -C ~/.turbo/repo push origin mainReport the pushed commit hash.
In source mode, update ~/.turbo/config.json so the next $update-turbo does not re-surface the just-pushed changes:
~/.turbo/config.jsoncodex.lastUpdateHead (creating the codex object or key if missing) to the current HEAD: git -C ~/.turbo/repo rev-parse HEADReport that the contribution is complete.
Skip this step in fork mode (the upstream has not changed until the PR is merged).
Then update or check the active plan and proceed to any remaining task.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.