Security audit
Security checks across malware telemetry and agentic risk
This skill is mostly coherent GitHub workflow automation, but it grants broad GitHub and local workflow authority with several automatic or under-scoped state changes users should review first.
Install only if you want an agent to actively operate your GitHub workflow. Use a dedicated, least-privilege GitHub account or token, review the language and external-rule assumptions, and require explicit confirmation before issue creation, dependency mutations, reviewer registration, pushes, PR ready transitions, and merges.
| # | Don't | Do | |---|-------|-----| | 1 | Skip the Copilot-reviewer step after PR creation and only check the CodeRabbit walkthrough | Step 0 first → handle Copilot → then Step 1 CodeRabbit walkthrough | | 2 | Register Copilot reviewer unconditionally, without checking account-wide in-flight state | Run Step 0-2 GraphQL `viewer.pullRequests` + `reviewRequests` matrix first — if backlogged, drain the backlog first | | 3 | Delegate Copilot handling to the consolidate skill (trusting only the next.md matrix) | The next.md matrix triggers via the stop hook — easy to miss. Handle it automatically in pr.md Step 9 | | 4 | Stay silent after detecting a Copilot backlog | TaskCreate + fix_plan hold + AskUserQuestion for the user to decide | | 5 | Skip in-flight checks because "I already checked once" during silent-fail / retry | **Re-run the Step 0-2 in-flight check every time Copilot registration is attempted.** Do not trust cached results — between checks, Copilot may have been registered on another PR |
| 4 | Stay silent after detecting a Copilot backlog | TaskCreate + fix_plan hold + AskUserQuestion for the user to decide | | 5 | Skip in-flight checks because "I already checked once" during silent-fail / retry | **Re-run the Step 0-2 in-flight check every time Copilot registration is attempted.** Do not trust cached results — between checks, Copilot may have been registered on another PR | | 6 | When an AskUserQuestion option mentions "re-register Copilot then consolidate", omit the in-flight check from the description | Spell out the **"in-flight check → 0 → register → 1+ → backlog notice"** procedure inline in the option description. Promise that it will re-run at fire time | | 7 | After one passing in-flight check, auto-generate a registration option without checking again | **Re-run Step 0-2 every time AskUserQuestion options are authored.** Check again at the action step after firing (double guard) | **Self-check (right after PR creation + every Copilot registration attempt)**: 1. Step 0-1: `gh pr view <N> --json reviewRequests,reviews` to check whether Copilot is already registered for this PR — SKIP if `Copilot` (Bot) is in reviewRequests OR `copilot-pull-request-reviewer` is in reviews
| 2 | Inferring "the body is Korean, so the title must also be Korean" | Apply the visibility rule explicitly to both the title and the body | | 3 | Performing the visibility check only inside the personal-data sanitize step | Step 0: visibility check → language decision → then sanitize | **Exception**: English only when the project's CLAUDE.md / README explicitly states "write PRs in English", or the user explicitly requests English. Choosing English by inference is forbidden. Detailed rule: `~/.agents/rules/opensource.md` "PRIVATE repo = Korean default" section.
VirusTotal findings are pending for this skill version.
No suspicious patterns detected.
