pr-diff-verification — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited pr-diff-verification (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Before:
git push of a feature branch (especially after subagent return)gh pr creategh pr merge (final sanity)--force-with-lease) of a rebased branchSkip when: pushing a single trivial commit you authored line-by-line in the current session and didn't amend.
For the HEAD commit (or all commits on the branch since base), extract concrete claims:
create mode 100644 Y/ in statdelete mode 100644 Z in statrename A => B in statgit show --stat HEAD # for single commit
git diff --stat origin/main..HEAD # for branch cumulative
git log --oneline origin/main..HEAD # for commit countFor each concrete claim, grep the stat output. If the claim mentions a path that doesn't appear in the stat, that's a discrepancy — investigate before push.
If found:
git amend or rebase squash the wrong content?Discrepancy resolution options:
git reflog | grep <SHA>)"Commit log claims work, diff doesn't show it" (general pattern): this class of mistake recurs when (a) git amend after partial revert loses hunks but keeps the original message, (b) force-push from a stale branch overwrites newer commits, (c) subagent returns a structured "I committed X" report but the commits never made it to the branch ref due to worktree wipe before push. Each failure mode is caught by the same single check: git show --stat HEAD vs. the commit body.
Real-world example — wrong ref pushed: a subagent reported "1 commit a547d70 with all the changes"; Leader pushed worktree-agent-XXX:feat/feature-phase1 and discovered post-push that the wrong ref was pushed (the worktree-agent ref was at main SHA; the actual feature commits were on a different local branch). Required force-push recovery from reflog.
git push origin worktree-agent-X:feat/Y pushes worktree-agent-X's HEAD to remote feat/Y. If worktree-agent-X doesn't have the commits (because they were committed to a different local branch by the subagent), remote feat/Y gets reset to whatever worktree-agent-X is at — usually main SHA.docs/methodology.md §派發契約 §10 requires commit-early discipline. This skill is the POST-commit verification step — confirms the commits that survived actually contain what the message claims.
Cheap signals:
Foo.swift:42"; stat doesn't list Foo.swift → loud buggit log --oneline should show 1 commit (post-squash) OR the chain you intendedDon't deep-read diffs as part of this skill — that's Code Reviewer's job. Just confirm the SHAPE matches the claims.
Subagent returns: "3 commits, 11 files, +265/-272 LOC, all 7 wiring tests pass"
Leader runs:
git log --oneline origin/main..HEAD # should show 3 commits
git diff --stat origin/main..HEAD # should show ~11 files, ±540 line tags
If git log shows 1 commit (subagent squashed without saying) → OK if intentional
If git log shows 0 commits (commits lost to worktree wipe) → STOP, recover, re-push
If git diff --stat shows different file count → investigate~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.