ship-192173 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ship-192173 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Commit, push, and optionally create or update a PR for the current staged changes.
At the start, use TaskCreate to create a task for each phase:
/commit-rules skillDetect the repository state:
gh repo view --json defaultBranchRef --jq '.defaultBranchRef.name'gh pr view)Sample the prevailing workflow from recent default-branch history (git log --first-parent origin/<default-branch> -n 30 --pretty=%s): judge whether changes mostly land through pull requests (merge-PR commits or (#N)-suffixed squash commits) or are committed directly to the default branch.
Output a one-line summary of the detected state as text. Then use AskUserQuestion to choose how to proceed, offering these options:
Recommend the option that fits this repo by listing it first and labeling it (Recommended): when the current branch already has a PR, recommend updating it; otherwise follow the prevailing workflow — recommend the PR path for a PR-based history, or commit and push for a direct-commit history.
If the user declines (chooses the free-form "Other" option or asks to abort), leave the changes staged and do not commit.
If the chosen option creates a PR and the current branch is the default branch:
AskUserQuestion to confirm or adjustgit checkout -b <branch-name>Run git status to check for unstaged changes. Stage by path the files that belong to the current changeset; this catches files modified by auto-formatters that were not re-staged. When one also carries unrelated changes, write git diff <file> to a patch file, back the unrelated changes out of it (delete their + lines and turn their - lines into context lines), and stage it with git apply --cached --recount <patch>.
/commit-rules SkillRun the /commit-rules skill to load commit message rules and technical constraints.
Commit the already-staged changes (do not stage additional files) with a message following the loaded rules. Keep the branch Step 2 left in place and commit on it, including when that is the default branch.
If the commit fails due to a pre-commit hook (formatter, linter), fix the issues — or run the project's format/lint script to auto-fix — then re-stage by path the files the hook modified before retrying. Pre-commit hooks may modify files in the working tree without updating the staging area.
If the chosen option updates the PR, run the /update-pr skill.
If the chosen option includes pushing, push to the current branch's remote:
git pushIf the chosen option creates a PR, run the /create-pr skill.
When /create-pr hands the body file over for editing instead of posting, report that path and that no PR was opened yet, and leave Step 9 pending until the PR is posted or cancelled.
When Step 8 opened a PR, including one posted after the user edited its body, and this branch added Unreleased changelog entries that carry no PR reference while the changelog's earlier entries carry one, run the /changelog-rules skill and add to each of those entries the references it calls for with the new PR. Stage the changelog by path and commit it with a message following the commit rules Step 4 loaded, handling a pre-commit hook as Step 5 does, then push to the current branch's remote.
Then use the TaskList tool and proceed to any remaining task.
/commit-rules skill before every commit; do not commit without loading it first..env, credentials, API keys). Warn if detected..turbo/ content (filenames, acceptance criteria, step numbers, headings) in branch names. .turbo/ is gitignored, so these references would be opaque to anyone reading without local copies.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.