gh-verifying-context — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited gh-verifying-context (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill ensures the agent is operating in the correct GitHub account and repository before performing any actions. It uses a repo-level config file (.github/project-config.json) as the baseline — if the live environment matches the config, the skill proceeds silently without requiring human confirmation. Only mismatches or missing configs surface to the user.
| State | Behavior |
|---|---|
| Config exists + live env matches | Proceed silently — no output, no gate |
| Config exists + mismatch detected | STOP — alert user with details of the mismatch |
| No config found | Prompt once — ask user to run gh-set-active-project to create the config |
Step 1 – Read the config:
cat .github/project-config.jsonParse owner, repo, and project_number from the file.
Step 2 – Check live environment:
gh auth status && gh repo view --json owner,nameStep 3 – Compare:
authenticated_user.org matches config.owner AND repo.name matches config.repo →proceed silently with the config values available for downstream skills.
When the live environment does not match the config:
⚠️ Context mismatch detected — stopping.
Expected (from .github/project-config.json):
- Owner: <config.owner>
- Repository: <config.repo>
Actual (live environment):
- Logged in as: <current_username>
- Repository: <current_owner>/<current_repo>
Resolution options:
1. Run `gh-set-active-project` to update the config for this repository.
2. Switch to the correct GitHub account: gh auth switch
3. Navigate to the correct repository directory.When .github/project-config.json does not exist:
ℹ️ No project config found at .github/project-config.json.
To set up context verification for this repository, run:
gh-set-active-project
This is a one-time setup. After setup, all sessions auto-verify silently.Do not proceed with GitHub operations until the config is created.
When auto-verify succeeds, the skill produces no output — downstream skills simply receive the config values and proceed. This is by design: the absence of a prompt means all is correct.
After a successful silent pass, the following values are available for use in other skills:
| Field | Source | Used By |
|---|---|---|
owner | config | gh-issue-management, gh-project-management |
repo | config | gh-issue-management, gh-project-management |
project_number | config | gh-project-management |
project_id | config | gh-project-management (item-edit) |
See references/commands.md for the full command reference, output parsing format, and config schema.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.