·
Last changedVersion:
This version passed the hardening gate. Hardening applied 1 targeted change and preserved all other text. Classified findings before hardening: 2. Classified findings closed: 0. Classified findings remaining: 2. Unclassified scanner findings remaining: 0. Review findings closed: 2. Review findings remaining: 17.
1
1
1
1
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Excessive Agency & Rogue Autonomy | — | Medium | Open | |
SKILL.md | Sensitive Data & Secret Exposure | Data exfiltration | Low | Open |
2 findings
Embed before/after screenshots in pull request descriptions so reviewers can see the visual change without checking out the branch.
Use this skill when a PR changes something visible:
Place screenshots directly in the PR description body. Avoid wrapping them in <details> collapse — reviewers are more likely to look at images they can see without clicking.
Keep the text brief. A sentence or two per image describing what the reader should notice. Let the image carry most of the communication.
For PRs with several visual changes, use separate before/after pairs with headings:
Upload images as PR attachments via the REST API:
Reference in the PR description:
Azure DevOps gotchas:
{org}.visualstudio.com NOT dev.azure.com/{org} — AzDO's markdown renderer uses .visualstudio.com. The dev.azure.com format loads noticeably slowerPOST not PUT (PUT returns 405)7.1-preview.1screenshot-v2.png)HttpClient not Invoke-RestMethod — IRM can corrupt binary data<details> tags are easy to skipimage-annotations skill to add callouts when the difference isn't immediately obviousGet started with chainctlchainctl skill install public/github/pr-screenshots:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/github/skills/pr-screenshots:latest
MIT
HARDENING.md
LICENSE
SKILL.md