pr — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited pr (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Assumes verify and pr-preflight already passed — this skill lands work, it doesn't judge it. If preflight hasn't run, run it first; on hard blockers, stop (preflight's on-main finding is the one REMEDIABLE case — step 1 fixes it by branching). Print a one-line summary at each section boundary (branch created / committed <sha> / PR <url> opened / comments addressed).
On main → git checkout -b <type>/<kebab-scope> from preflight's detected scope. Already on a work/worktree branch → keep it. Stacked plans (caller says "base = plan N's branch"): branch from that base and remember it for the PR. Never release-please-*.
git diff --name-only HEAD + untracked — never git add -A (that's how .env, binaries, and node_modules/ sneak into history). Ensure regenerated code is staged with its source.git log --oneline -15. Conventional Commits, type from the standard allowlist, scope reused from this repo's history (omit when ambiguous). Subject imperative, ≤72 chars. Body: a short why, plus explicit mention of any user-visible change.git commit -m "$(cat <<'EOF'
<type(scope)>: <subject>
<why, 1-3 lines>
Co-Authored-By: Claude <[email protected]>
EOF
)"--amend). Commit blocked = it never happened — gitleaks → remove + rotate, never bypass; typos → fix; conventional-pre-commit → rewrite subject; recommit. A hook still blocking after 3 fix attempts → stop, report FAILED with diagnosis (never --no-verify).git push -u origin "$(git branch --show-current)" # never --force; --force-with-lease only after an intentional rebase
gh pr create --title "<commit subject>" --base <main-or-stack-base> --body "$(cat <<'EOF'
<filled from the repo's .github/PULL_REQUEST_TEMPLATE.md>
EOF
)"Fill the actual template: tick ONLY checklist items this session truly verified (an unticked box is honest; a falsely ticked one poisons review). Link the driving plan/Initiative when one exists (vault name + brainstorm path). The saferskills template asks AI authors for a nerdy joke — include one. Return the PR URL.
If reviews arrive while you're still active: address actionable ones (smallest change, fresh commit, reply Addressed in <sha>; max 3 fix attempts per comment, then reply honestly that it needs a human), answer questions from the code, leave ambiguity to the human. Sustained shepherding is /babysit-pr's job — suggest it and stop.
Never: merge, enable auto-merge, --force, --no-verify, commit secrets, or tick unverified boxes.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.