·
Last changedVersion:
This version passed the hardening gate. Hardening updated the skill content and independently checked the resulting changes. Classified findings before hardening: 3. Classified findings closed: 1. Classified findings remaining: 2. Unclassified scanner findings remaining: 0. Review findings closed: 3. Review findings remaining: 12.
3
2
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
scripts/inspect_pr_checks.py | Malicious Code & Command Execution | Dynamic code execution | Medium | Open | |
SKILL.md | Tool & MCP Manipulation | MCP over-permissioning | Medium | Open | |
agents/openai.yaml | Sensitive Data & Secret Exposure | Data exfiltration | Medium | Closed |
3 findings
Use gh to locate failing PR checks, fetch GitHub Actions logs for actionable failures, summarize the failure snippet, then propose a fix plan and implement after explicit approval.
create-plan) is available, use it; otherwise draft a concise plan inline and request approval before implementing.Prereq: authenticate with the standard GitHub CLI once (for example, run gh auth login), then confirm with gh auth status (repo scopes are typically required).
repo: path inside the repo (default .)pr: PR number or URL (optional; defaults to current branch PR)gh authentication for the repo hostpython "<path-to-skill>/scripts/inspect_pr_checks.py" --repo "." --pr "<number-or-url>"--json if you want machine-friendly output for summarization.gh auth status in the repo.gh auth login (ensuring repo scopes) before proceeding.gh pr view --json number,url.python "<path-to-skill>/scripts/inspect_pr_checks.py" --repo "." --pr "<number-or-url>"--json for machine-friendly output.gh pr checks <pr> --json name,state,bucket,link,startedAt,completedAt,workflow
gh.detailsUrl and run:
gh run view <run_id> --json name,workflowName,conclusion,status,url,event,headBranch,headShagh run view <run_id> --logdetailsUrl is not a GitHub Actions run, label it as external and only report the URL.gh pr checks to confirm.Fetch failing PR checks, pull GitHub Actions logs, and extract a failure snippet. Exits non-zero when failures remain so it can be used in automation.
Usage examples:
python "<path-to-skill>/scripts/inspect_pr_checks.py" --repo "." --pr "123"python "<path-to-skill>/scripts/inspect_pr_checks.py" --repo "." --pr "https://github.com/org/repo/pull/123" --jsonpython "<path-to-skill>/scripts/inspect_pr_checks.py" --repo "." --max-lines 200 --context 40Get started with chainctlchainctl skill install public/openai/gh-fix-ci:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/openai/skills/.curated/gh-fix-ci:latest
Apache-2.0
HARDENING.md
LICENSE
SKILL.md
agents/openai.yaml
assets/github-small.svg
assets/github.png
scripts/inspect_pr_checks.py