create-pr-437485 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited create-pr-437485 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Draft a concise and descriptive title and a body for a PR. Explain the purpose of the changes, the problem they solve, and the general approach taken. When the changes involve clear runtime flows or state transitions, include Mermaid diagrams. When they add a user-facing surface or change how one looks, and this session already captured it, include screenshots.
If git is in a feature branch, examine all commit messages and the full diff to understand the overall changes. Analyze the diff for framing, diagram, and screenshot opportunities.
Source every claim about prior behavior from the base branch itself, by reading its code with git show origin/<base>:<path>. A long session leaves the working tree carrying intermediate states that were never the state this PR is measured against, and describing one of those as the prior behavior misleads the reviewer.
Before writing that two pull requests must land together, check whether the consumer uses what changed: git grep <symbol> in its checkout, or the other repository's working copy when the dependency crosses repositories. When it does, name the actual cause. When it does not, drop the landing-order claim and keep any reference to the related pull request as plain context. State the claim as unverified when the consumer is not reachable.
When the PR closes an issue, read the issue before drafting.
/github-voice SkillRun the /github-voice skill to load writing style rules.
Pick a framing, then draft a title and description in it, embedding any diagrams and screenshots in the body. Output the drafted title and description as chat text so the user can review it, followed by the path of each capture that will upload, if any. After that, name each added surface or changed look that none of those captures shows in its final state, if any, with the reason it goes unshown.
Generate a random tag so the body file is unique across sessions:
head -c 4 /dev/urandom | xxd -pWrite the drafted body to .turbo/pr/<tag>-body.md (using the printed tag) with the Write tool.
Use AskUserQuestion to choose among three outcomes, and act on the one selected:
AskUserQuestion again to offer posting the PR or cancelling, then act on that answer. Posting reads the file, so their edits carry through.gh pr create --title "<TITLE>" --body-file .turbo/pr/<tag>-body.mdWhen the body references captures, add one --attach <path> per capture, using the absolute path the body references. Take the list from the body file as it stands when posting, re-reading it after the user edits it.
When the command reports a failed upload, act on what it printed, then report which captures the PR went up without:
--attach.gh pr view <PR_URL> --json body --jq .body, remove each table column whose image is still a local path, write the result to the body file, and apply it with gh pr edit <PR_URL> --body-file .turbo/pr/<tag>-body.md.When an uploaded capture was taken at a scale factor above 1, size it to its logical width. Take the scale factor as the capture's pixels per logical pixel of the surface it shows: the device scale factor it was captured at, unless it was captured at logical scale or resized since. When that is unknown, use its recorded pixel density divided by 72 dpi, provided that density is a whole multiple of 72. Leave a capture whose scale factor cannot be established as uploaded. Fetch the posted body with gh pr view <PR_URL> --json body --jq .body, replace each such capture's markdown image, which now points at its uploaded asset, with <img width="<pixel width ÷ scale factor, rounded>" alt="<caption>" src="<asset URL>">, write the result to the body file, and apply it with gh pr edit <PR_URL> --body-file .turbo/pr/<tag>-body.md.
When the user asks, before the PR is posted, to change content this session committed for it, fold the change into the commit that carries that content instead of adding a commit, and push with --force-with-lease when that commit was already pushed. Update the drafted title and the body file where the change alters what they describe, then return to this gate.
Do not set --assignee unless the user explicitly asks to assign someone. Reserve --draft for an explicit request for a draft pull request on GitHub.
Then use the TaskList tool and proceed to any remaining task.
Every body says what the change does and why. How it is organized past that follows from what the change is: pick the framing that carries the most user-visible meaning, and combine two when the change genuinely has both shapes.
The default. Use when the PR makes one coherent change with one purpose.
Use when the PR carries several distinct changes and the reviewer needs the inventory. One item per change, ordered by what matters most.
Use when the change delivers capability someone can name. Write each as As a <persona>, I want <capability> so that <outcome>.
Use when the reviewer's question is what changed rather than what exists: several distinct fixes, or behavior that reads as a feature description unless the delta is spelled out. Give each item a Before line and an After line. Head each item with its user story in bold and list the Before and After lines beneath it. Reserve a plain heading, such as the name of the code the item touches, for an item that changes nothing a user or operator would notice.
Write Before lines in the past tense, with two exceptions. A sentence describing code the PR leaves alone stays present tense. A claim about what was merely possible stays modal ("could post"), never simple past, which asserts it happened.
Closes #N. Carry only what the issue does not already say: the interface being added, behavior a reviewer cannot infer from the diff, and above all any deviation from what the issue asked for. The issue carries the bug, its root cause, and the motivation; reference it rather than restating it.GitHub renders Mermaid natively in PR descriptions via `mermaid code blocks. Include diagrams only when they add clarity a text description can't — skip for trivial changes or obvious flows.
Include when the changes introduce or modify a clear runtime flow: API endpoints, event handlers, pipelines, multi-service interactions, webhook flows.
sequenceDiagram Client->>API: POST /payments API->>PaymentService: processPayment() PaymentService->>StripeClient: charge() StripeClient-->>PaymentService: confirmation PaymentService->>DB: save()
Include when the changes add or modify entity states, status enums, workflow transitions, or lifecycle hooks.
stateDiagram-v2 [] --> Draft Draft --> Pending: submit() Pending --> Approved: approve() Pending --> Rejected: reject() Approved --> []
## Flow or ## State Machine headingInclude screenshots when the PR adds a user-facing surface or changes how one looks, and this session already holds captures of that surface in its final state. Reuse those captures after viewing each one, keeping the fewest that show the change. A change in when an existing surface appears leaves its look unchanged, so add no capture of it. Take no new captures: with none on hand, omit the section.
Reference every kept capture in one row of a markdown table, with its caption in the header cell above it:
| <caption> | <caption> |
| --- | --- |
|  |  |gh points only markdown references at the uploaded asset, so a raw <img> tag keeps its local path.gh appends an attached file the body never references as its own paragraph.## Screenshots heading, ahead of any diagram..turbo/ content (filenames, acceptance criteria, step numbers, headings) in the title or body. .turbo/ is gitignored, so these references would be opaque to anyone reading without local copies.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.