ship-779d83 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ship-779d83 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Commit, push, and optionally create or update a PR for the current staged changes.
At the start, use update_plan to track each phase:
$commit-rules skillDetect the repository state:
gh repo view --json defaultBranchRef --jq '.defaultBranchRef.name'gh pr view)Sample the prevailing workflow from recent default-branch history (git log --first-parent origin/<default-branch> -n 30 --pretty=%s): judge whether changes mostly land through pull requests (merge-PR commits or (#N)-suffixed squash commits) or are committed directly to the default branch.
Output a one-line summary of the detected state as text. Then use request_user_input to choose how to proceed, offering these options:
Recommend the option that fits this repo by listing it first and labeling it (Recommended): when the current branch already has a PR, recommend updating it; otherwise follow the prevailing workflow — recommend the PR path for a PR-based history, or commit and push for a direct-commit history.
If the user declines (chooses the free-form "Other" option or asks to abort), leave the changes staged and do not commit.
If the chosen option creates a PR and the current branch is the default branch:
request_user_input to confirm or adjustgit checkout -b <branch-name>Run git status to check for unstaged changes. If any exist, stage them. This catches files modified by auto-formatters that were not re-staged.
$commit-rules SkillRun the $commit-rules skill to load commit message rules and technical constraints.
Commit the already-staged changes (do not stage additional files) with a message following the loaded rules.
If the commit fails due to a pre-commit hook (formatter, linter), fix the issues — or run the project's format/lint script to auto-fix — then re-stage all modified files before retrying. Pre-commit hooks may modify files in the working tree without updating the staging area.
If the chosen option includes pushing, push to the current branch's remote:
git push$create-pr skill$update-pr skillThen update or check the active plan and proceed to any remaining task.
$commit-rules skill before every commit; do not commit without loading it first..env, credentials, API keys). Warn if detected..turbo/ content (filenames, requirement IDs, shell references, headings) in branch names. .turbo/ is gitignored, so these references would be opaque to anyone reading without local copies.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.