commit-push — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited commit-push (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Run qq scripts as${CLAUDE_PLUGIN_ROOT}/bin/<name>: they are not on PATH, so a bareqq-project-state.pyexits 127.
Respond in the user's preferred language (detect from their recent messages, or fall back to the language setting in CLAUDE.md).
Arguments: $ARGUMENTS
qq-project-state.py is available, run it first: ${CLAUDE_PLUGIN_ROOT}/bin/qq-project-state.py --prettyrecommended_next == "/qq:commit-push" → normal ship path, continue/qq:doc-sync hands over), skip this checkgit status -u and git diff --stat to view the uncommitted changesgit add -- <files> then git commit -- <files> (never git add -A / commit -a; the pathspec on the commit keeps out changes another session staged). While a merge is in progress (MERGE_HEAD exists) git refuses a partial commit: git add -- <resolved files>, then a plain git commit --no-editgit push${CLAUDE_PLUGIN_ROOT}/bin/qq-worktree.py status --pretty first. Continue only when isManagedWorktree and sourceWorktreeClean are true and localChanges is false; otherwise stay in the worktree and tell the user why (an EnterWorktree worktree that /qq:execute or /qq:go never seeded is not qq-managed).${CLAUDE_PLUGIN_ROOT}/bin/qq-execute-checkpoint.py pipeline-clear --project . --status completedEnterWorktree, then call ExitWorktree with action: "keep", and pass --project <worktree path> below: closeout deletes the worktree directory..qq/state/worktree.json, pushes it, then removes the worktree and its branch: ${CLAUDE_PLUGIN_ROOT}/bin/qq-worktree.py closeout --auto-yes --delete-branch --prettyEnterWorktree path: <worktree path> before making further edits. Fall back to separate merge-back / cleanup only when debugging.${CLAUDE_PLUGIN_ROOT}/bin/qq-execute-checkpoint.py pipeline-clear --project . --status completed.env, API keys, credentials, or other sensitive files.obsidian/~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.