gh-set-active-project — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited gh-set-active-project (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill performs a one-time interactive setup that writes .github/project-config.json to the current repository. Once the config exists, gh-verifying-context switches from a mandatory human-confirmation gate to a silent auto-verify mode: it checks the live environment against the config and only alerts the user when a mismatch is detected.
Once committed and pushed, the config is shared with all team members automatically — every developer who clones or pulls the repository gets the correct context without running this skill.
Run the following to confirm the authenticated account and repository:
gh auth status && git remote -vParse and report:
Logged in as: GitHub usernameActive Repository: <owner>/<repo> from git remoteRemote URL: origin URLPresent these values to the user before proceeding. This is the only manual confirmation step required — it happens once during setup.
gh repo view --json owner,name --jq '{"owner": .owner.login, "repo": .name}'gh project list --owner <owner> --json number,title,id,urlPresent the project list as a numbered table so the user can select the target project.
GATE: Ask the user: "Which project should be set as active for this repository?" DO NOT proceed until a project is selected.
Create or overwrite .github/project-config.json with the confirmed values:
{
"owner": "<owner>",
"repo": "<repo>",
"project_number": <number>,
"project_id": "<PVT_...>",
"set_at": "<ISO-8601 timestamp>"
}Ensure .github/ directory exists before writing:
mkdir -p .githubAsk the user: "Should I commit and push this config so all team members receive it automatically?"
If the user confirms, run:
git add .github/project-config.json
git commit -m "chore: set active GitHub project to <title> (#<number>)"
git pushNOTE: The config contains only public, non-sensitive values (owner, repo, project number). It is safe to commit to both public and private repositories.
If the repository uses branch protection rules, open a PR instead:
git checkout -b chore/set-active-project
git add .github/project-config.json
git commit -m "chore: set active GitHub project to <title> (#<number>)"
git push -u origin chore/set-active-project
gh pr create --title "chore: set active GitHub project" \
--body "Sets .github/project-config.json so all team members auto-verify silently."Report the outcome to the user:
Active project set successfully:
- Owner: <owner>
- Repository: <repo>
- Project: <title> (#<number>)
- Config written: .github/project-config.json
- Committed: yes / no (pushed to <branch>)
All team members will auto-verify silently after pulling this change.
No confirmation prompts unless a mismatch is detected.See references/commands.md for the full command reference and config schema.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.