update-pr-3ca68c — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited update-pr-3ca68c (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Read the current PR title and body, analyze what changed in the session, and draft an updated title and description that preserves the original writing style.
Fetch the current PR details:
gh pr view [PR_NUMBER] --json number,title,body,baseRefName,commitsOmit PR_NUMBER to auto-detect from current branch.
Before drafting, study the current title and body to identify:
feat:, fix:), capitalizationRun git fetch origin <base> so the remote ref is current before any diff below. A local branch of the same name can sit behind the remote, which puts the merge base before an already-merged pull request and pulls merged work into the description.
Read the fetched body against the current diff and list what the body leaves undescribed:
git diff origin/<base>...HEADCheck every Mermaid diagram in the body the same way, node by node and transition by transition. A diagram that omits a state still renders, so only the code reveals its staleness.
If the body and its diagrams already describe the diff, no embedded screenshot shows a look the PR has since reverted, and the session holds no final-state capture of an added or visually changed user-facing surface that the body lacks or shows in an older state, the description is up to date. Say so, then use the TaskList tool and proceed to any remaining task.
If what the body leaves undescribed is only trivial (formatting, typos, config-only), the body embeds no such screenshot, and the session holds no such capture, say so, then use the TaskList tool and proceed to any remaining task. Proceed when the body omits, misstates, or still describes behavior the diff no longer contains.
Derive the PR description from the full diff, not from individual commits. The description should reflect the net change — what the code looks like now vs. the base — not the development journey. Intermediate bug fixes, reverted approaches, and implementation pivots that happened during development are not relevant to the reader.
git diff origin/<base>...HEAD) — this is the primary source of truth/github-voice SkillRun the /github-voice skill to load writing style rules.
Write an updated title and body that:
Output the drafted title and description as text, alongside the original for comparison, followed by the path of each capture that will upload, if any. After that, name each added surface or changed look that neither those captures nor an embedded screenshot shows in its final state, if any, with the reason it goes unshown. Then use AskUserQuestion for confirmation.
After confirmation, write the drafted title to .turbo/pr/<PR_NUMBER>-title.txt and the drafted body to .turbo/pr/<PR_NUMBER>-body.md with the Write tool, then update the PR. The title goes through a file because it carries text fetched from the PR, where backticks and $ would run inside a quoted argument.
When the body references no capture by local path, update both in one command:
gh api --method PATCH "/repos/<owner>/<repo>/pulls/<PR_NUMBER>" \
-f title="$(cat .turbo/pr/<PR_NUMBER>-title.txt)" \
-F [email protected]/pr/<PR_NUMBER>-body.mdWhen it references captures by local path, send the title alone, then apply the body with one --attach <path> per capture, using the absolute path the body references:
gh api --method PATCH "/repos/<owner>/<repo>/pulls/<PR_NUMBER>" \
-f title="$(cat .turbo/pr/<PR_NUMBER>-title.txt)"
gh pr edit <PR_NUMBER> --body-file .turbo/pr/<PR_NUMBER>-body.md --attach <path>When gh pr edit reports a failed upload, act on what it printed, then report which captures the PR went without:
gh pr edit <PR_NUMBER> --body-file .turbo/pr/<PR_NUMBER>-body.md without --attach.gh pr view <PR_NUMBER> --json body --jq .body, remove each table column whose image is still a local path, write the result to the body file, and apply it with the same command.When a capture this run uploaded was taken at a scale factor above 1, size it to its logical width. Take the scale factor as the capture's pixels per logical pixel of the surface it shows: the device scale factor it was captured at, unless it was captured at logical scale or resized since. When that is unknown, use its recorded pixel density divided by 72 dpi, provided that density is a whole multiple of 72. Leave a capture whose scale factor cannot be established as uploaded. Fetch the posted body with gh pr view <PR_NUMBER> --json body --jq .body, replace each such capture's markdown image, which now points at its uploaded asset, with <img width="<pixel width ÷ scale factor, rounded>" alt="<caption>" src="<asset URL>">, write the result to the body file, and apply it with gh pr edit <PR_NUMBER> --body-file .turbo/pr/<PR_NUMBER>-body.md.
Then use the TaskList tool and proceed to any remaining task.
GitHub renders Mermaid natively in PR descriptions via `mermaid code blocks. Include diagrams only when they add clarity a text description can't.
Include when the changes introduce or modify a clear runtime flow: API endpoints, event handlers, pipelines, multi-service interactions, webhook flows.
sequenceDiagram Client->>API: POST /payments API->>PaymentService: processPayment() PaymentService->>StripeClient: charge() StripeClient-->>PaymentService: confirmation PaymentService->>DB: save()
Include when the changes add or modify entity states, status enums, workflow transitions, or lifecycle hooks.
stateDiagram-v2 [] --> Draft Draft --> Pending: submit() Pending --> Approved: approve() Pending --> Rejected: reject() Approved --> []
## Flow or ## State Machine headingInclude screenshots when the PR adds a user-facing surface or changes how one looks, and this session already holds captures of that surface in its final state. Reuse those captures after viewing each one, keeping the fewest that show the change. A change in when an existing surface appears leaves its look unchanged, so add no capture of it. Take no new captures: with none on hand, leave the body's screenshots as they are.
Reference every kept capture in one row of a markdown table, with its caption in the header cell above it:
| <caption> | <caption> |
| --- | --- |
|  |  |When the body already embeds screenshots, keep their layout: a replacement capture takes the old image's place, and an added capture goes beside the existing ones.
gh points only markdown references at the uploaded asset, so a raw <img> tag keeps its local path.gh appends an attached file the body never references as its own paragraph.## Screenshots heading, ahead of any diagram..turbo/ content (filenames, acceptance criteria, step numbers, headings) in the title or body. .turbo/ is gitignored, so these references would be opaque to anyone reading without local copies.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.