new-feature — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited new-feature (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
95% of the time, the user asks you to implement a feature ("build X", "add X feature", "implement X", "create X", "let's start working on X"): anything beyond a trivial one-file edit.
The other 5% of the time you start with a debug session / code analysis / literature review. Those almost always lead into this same workflow. Run it right after the debug/analysis/research is done.
Pick fast (implement -> PR -> merge -> validate, no planning/tests/review) when either is true:
Otherwise use full (plan -> implement -> test -> review -> PR -> merge -> validate), the default for anything with real scope or unclear boundaries. State which track was picked and why, in one line, before continuing. On the fast track, skip every step below marked "(skip if fast)".
Run /create-worktree. This also sets the terminal tab title and (inside iTerm2) the native session name via /session-name.
Run /plan skill.
/debug skill to fix themRun /build-tests skill for test planning and building.
Run /post skill for quality checks, code review, test review, and lint/format.
Run /pr-create skill to create a pull request. This also launches the CI watcher in the background automatically.
Find this environment's gh-monitor script (in Claude Code: ~/.claude/scripts/gh_monitor.sh) and launch it via the Bash tool with command: bash <that script> push '<branch>' and run_in_background: true, with no explicit timeout override (this watcher ends only on a real CI result, not a time box). It supersedes the watcher Step 7 already launched for the same branch (same lock key, so the relaunch is expected and harmless). Do not block this turn waiting on it. Continue other queued work, and act on the result when the background-task notification arrives.
Work the PR in this order:
git merge-base --is-ancestor origin/main HEAD, then rebase.CI passed for <branch> or No CI checks configured for <branch>: merge at once with gh pr merge <PR> --squash --match-head-commit <sha CI passed on>. Then confirm the merge commit is on origin/main. Do not ask first. Do not pass --delete-branch from a worktree: gh then tries to check out main, which the primary checkout holds, and exits nonzero although the merge succeeded (the repo auto-deletes merged branches).CI FAILED for <branch>: do not merge. Spawn a /debug subagent, fix, push, and relaunch the watcher. After 3 failed cycles, report the failure with the failing check and its observed error.Run this step after a successful merge in Step 8, fully automatically.
verify skill in STAGING mode. If none exists, run /create-verification-skill first, then run it.~/.claude/verify/<owner>__<repo>.json. Wait on it with the gh_monitor.sh wait <PR> --repo <r> command the merge hook gave you (background Bash).{"targets":[],"reason":"<why>"} in ~/.claude/verify/<owner>__<repo>.json. Report that as n/a with the reason.Report a summary of what the feature is, how it was implemented, and what happened at all post-implementation steps (including whether it merged and whether validation passed). Use the /adhd-structure skill.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.