pr-create — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited pr-create (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Creates a professional pull request when a feature is complete and ready for review.
"$ARGUMENTS"
git log origin/main..HEAD --oneline
git diff origin/main...HEAD --statplan-*.md and any other dev/workflow related files and commit. If not sure, keep the file.git log origin/main..HEAD -- <file> to verify the file was added in this branch.Create professional PR content:
Title Format: a conventional-commit title type(scope): subject, built from plan-*.md and the commits. Never use Feature:/Fix: style prefixes.
type: feat, fix, chore, refactor, test, ci, docs, perf, build, style or revert, whichever fits the change.scope: must be one the repo allows. Read the repo's title lint at run time: the scopes: list of an action-semantic-pull-request step in .github/workflows/*.yml, else a commitlint config (scope-enum). Pick the scope matching the files changed. If a scope you would like is not in the list (e.g. analytics, scripts), use the closest allowed one, such as repo.type(repo): subject.subject: short, imperative, starts with a lowercase letter.feat(app-backend): add order export endpoint.Body Structure (under about 40 lines):
## Why
- The problem or ticket, and why it matters now
## What changed
- The behavior change, in user or operator terms
## Scope
- What this PR covers, and what it leaves out on purpose
## Tradeoffs
- Options considered, and why this one won
## Blast radius
- What can break, who sees it, and how to roll back
## Verification
- What was run: command or click path
- Observed output or evidence link
- Staging plan: target, deployed-SHA check, probes, UI proofgh pr create --title "[type(scope): subject]" --body "$(cat <<'EOF'
[Generated PR body]
EOF
)"A PostToolUse hook (gh_monitor_trigger, or this environment's equivalent) launches a push-mode CI watcher for the branch the instant gh pr create succeeds, and tells you the exact command to run it with. Do not guess that command yourself or invoke a /ci-watcher-style skill directly — use exactly what the hook's own instruction gives you.
Fallback: if no watcher launch instruction arrives shortly after the PR is created, find this environment's gh-monitor script (in Claude Code: ~/.claude/scripts/gh_monitor.sh) and launch bash <that script> push <branch> manually — via the Bash tool with run_in_background: true, never as a blocking foreground call.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.