Skill

supersede-pr

skill:remix-run/remix#supersede-pr

Safely replace one GitHub pull request with another. Use when a user says a PR supersedes/replaces an older PR, asks to auto-close a superseded PR, or needs guaranteed closure behavior after merge. This skill explicitly closes the superseded PR with gh CLI and verifies final PR states instead of relying on closing keywords.

SkillsMP

Verdict

No issues found

No suspicious or malicious behavior was found.

Analyzed Oct 27, 2026, 21:24 UTC at 6e4484f

findings

—

highest severity

threat classes

6,367

files scanned

47/47

checks satisfied

package advisories

Why this verdict

benign: 47 checks satisfied, no findings for skill:.agents/skills/supersede-pr

Security findings 0

No security findings

No suspicious or malicious behavior was found; 1 candidate finding was refuted on review.

Refuted findings 1

Candidates the review stage examined and rejected, kept for transparency.

Code execution

criticalRefutedlow confidence

The skill instructs the agent to execute the bundled script scripts/close_superseded_pr.ts with old/new PR numbers, and the script's contents are not shown in this pass, so the executed behavior cannot be verified from the instruction text (executing a PR close is the declared core capability, but the payload is unvetted here).

.agents/skills/supersede-pr/SKILL.md:30

scripts/close_superseded_pr.ts <old_pr> <new_pr>

Why it was refuted

The requested script was served and its full contents show it does exactly what SKILL.md declares: validate numeric PR numbers, query PR state via gh, post the 'Superseded by #<new_pr>.' comment, and close the old PR via 'gh pr close', with no extra network calls, credential access, file writes, or hooks — the only mutating sink is the declared close command. The finding's 'unvetted payload' premise is resolved and the declared-core-capability carve-out fails the harm gate.

Coverage gaps 5

Parts of the artifact the static analysis could not fully examine.

context:unanalyzable_binary binary content is only byte-scanned

demos/bookstore/public/favicon.ico

context:unanalyzable_binary binary content is only byte-scanned

demos/sse/public/favicon.ico

context:unanalyzable_binary binary content is only byte-scanned

docs/api/public/favicon.ico

context:archive_unreadable ReadError: unexpected end of data

packages/tar-parser/test/fixtures/incomplete.tar

context:manifest_unparseable yaml: YAML node count exceeds 20000

pnpm-lock.yaml