reply-to-pr-threads-48995a — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited reply-to-pr-threads-48995a (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Draft replies for a processed review-thread list, confirm with the user, post the surviving drafts, dismiss the code-scanning alerts their entries name, and resolve threads whose entry carries a resolution reason.
Auto-detect owner, repo, and PR number from the current branch if not provided, then query the current resolution state:
gh api graphql -f query='
query($owner: String!, $repo: String!, $pr: Int!) {
repository(owner: $owner, name: $repo) {
pullRequest(number: $pr) {
reviewThreads(first: 100) {
nodes { id isResolved }
}
}
}
}' -f owner='{owner}' -f repo='{repo}' -F pr={pr_number}Drop threads whose isResolved is now true. Reviewers or bots such as CodeRabbit may resolve threads after the original fetch, and drafting replies for them is wasted work.
/github-voice SkillRun the /github-voice skill to load voice rules and the insider-vs-outsider detection.
Use the processed-thread list from conversation context. Each entry has: thread id, file path, line, category (fix, skip, answer, clarify, or resolve-only), and per-category payload. An entry may also carry a resolution reason: ADDRESSED, WONT_FIX, or INVALID. A skip entry that carries a resolution reason may also carry a code-scanning alert number and a dismissal reason: false positive, won't fix, or used in tests. Its reply doubles as the alert's dismissal comment, so keep it within 280 characters.
Keep every reply to one or two sentences. No bullet-point reasoning. No bolded labels.
fix: payload is a commit SHA, optionally with a divergence note.
Fixed in <commit-sha>.Only add a brief sentence after the SHA when the fix meaningfully diverges from what the reviewer suggested. Otherwise the SHA alone is enough.
skip: payload is the skip reasoning. State the reasoning directly. Do not apologize.
answer: payload is the raw answer text. Tighten to one or two sentences and apply /github-voice rules. Do not cite transcripts or mention Claude. The reply reads as the implementer's own explanation.
clarify: payload is a user-directed question. Draft it as directed.
resolve-only: payload is the commit SHA that already addressed the thread. Draft no reply.
Output all drafts as text, grouped by file:
### <file-path>
**Thread <id>** (<category>, line <line>)
Reviewer: <original comment, truncated if long>
Reply: <drafted reply>
Dismiss: alert <alert-number>, <dismissal reason>
Resolve: <resolution reason>Show the Reply line only for entries with a drafted reply, the Dismiss line only for entries that carry an alert number, and the Resolve line only for entries that carry a resolution reason.
Then use AskUserQuestion to ask whether to post. Offer:
For each approved draft, write the drafted reply to .turbo/pr/thread-<thread-id>.md with the Write tool, then post via the reply mutation:
gh api graphql -f query='
mutation($threadId: ID!, $body: String!) {
addPullRequestReviewThreadReply(input: {pullRequestReviewThreadId: $threadId, body: $body}) {
comment { id }
}
}' -f threadId='<thread-id>' -F [email protected]/pr/thread-<thread-id>.mdSubstitute <thread-id> with the thread's id for each post.
After posting the reply of an entry that carries an alert number, dismiss its alert with the reply as the dismissal comment:
gh api -X PATCH repos/{owner}/{repo}/code-scanning/alerts/<alert-number> -f state=dismissed -f dismissed_reason="<dismissal reason>" -F [email protected]/pr/thread-<thread-id>.mdCount the alert as dismissed only when the response's state is dismissed. Leave the thread of an alert that was not dismissed unresolved.
After posting the reply of an entry that carries a resolution reason, and for each resolve-only entry, resolve its thread:
gh api graphql -f query='
mutation($threadId: ID!, $reason: PullRequestReviewThreadResolutionReason) {
resolveReviewThread(input: {threadId: $threadId, resolutionReason: $reason}) {
thread { isResolved }
}
}' -f threadId='<thread-id>' -f reason='<reason>'Count a thread as resolved only when the response shows isResolved: true.
Report the outcome as a table, one row per thread, keeping every cell to a single line:
| Thread | Category | Outcome |
|---|
Where Outcome is one of:
Keep the report to the table. When the table would be empty, report one line stating that no replies were posted or threads resolved, and why, instead.
Then use the TaskList tool and proceed to any remaining task.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.