[Ces107]

Pull Request Checklist

• I have read and followed the CONTRIBUTING.md guidelines.
• I have read and followed the Guidance for submissions involving paid services.
• My contribution adds a new instruction, prompt, agent, skill, workflow, or canvas extension file in the correct directory.
• The file follows the required naming convention.
• The content is clearly structured and follows the example format.
• I have tested my instructions, prompt, agent, skill, workflow, or canvas extension with GitHub Copilot.
• I have run npm start and verified that README.md is up to date.
• I am targeting the main branch for this pull request.

---

Description

Adds skills/launch-check: a passive pre-launch check of a live URL that runs a bundled standard-library Python script and reports exposed secret keys in the page JavaScript, open Supabase/Firebase tables (only with an explicit owner flag), missing security headers, phone layout, search basics and speed, with a prioritized fix list.

---

Type of Contribution

• New instruction file.
• New prompt file.
• New agent file.
• New plugin.
• New skill file.
• New agentic workflow.
• New canvas extension.
• Update to existing instruction, prompt, agent, plugin, skill, workflow, or canvas extension.
• Other (please specify):

---

Additional Notes

• I'm the author; the skill is MIT and maintained at https://github.com/Ces107/agent-forge/tree/main/skills/launch-check. No paid service, signup or external API is involved.
• Bundled scripts: scripts/launch_check.py, polish_audit.py, geo_audit.py (Python standard library; Playwright optional for the phone-layout check). Network access is limited to the URL the user passes and that site's public files; it never probes hidden paths and sends nothing elsewhere.
• Tested with Claude Code and from the command line; not yet tested inside GitHub Copilot, so that box is unchecked.
• This PR was prepared with AI assistance.

---

By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

🔒 PR Risk Scan Results

Scanned 5 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	1
ℹ️ Info	3

Severity	Rule	File	Line	Match
ℹ️	skill-script-touched	skills/launch-check/scripts/geo_audit.py	1	skills/launch-check/scripts/geo_audit.py
ℹ️	skill-script-touched	skills/launch-check/scripts/launch_check.py	1	skills/launch-check/scripts/launch_check.py
🟠	unpinned-version-indicator	skills/launch-check/scripts/launch_check.py	224	"Accept-Encoding": "identity", "Accept": "*/*"})
ℹ️	skill-script-touched	skills/launch-check/scripts/polish_audit.py	1	skills/launch-check/scripts/polish_audit.py

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

[github-actions]

🟡 Contributor Reputation Check: MEDIUM risk

Check	Risk
Profile	MEDIUM
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

[github-actions]

🚦 Submission status: 🛠️ Requires submitter fixes

Risk tier: merge-risk:high — Privileged execution, automation, or review-policy change
Required to merge: passing submission-gate checks plus 1 approval from reviewers with write access, including a maintainer with admin or maintain permission.

Why this tier

• skills/launch-check/scripts/geo_audit.py is a high-risk path (automation, scripts, MCP config, hooks, or review policy)
• skills/launch-check/scripts/launch_check.py is a high-risk path (automation, scripts, MCP config, hooks, or review policy)
• skills/launch-check/scripts/polish_audit.py is a high-risk path (automation, scripts, MCP config, hooks, or review policy)
• skills/launch-check/scripts/geo_audit.py has no diff available to scan for privileged capabilities

Automated checks

Check	Status	Details
Line endings	✅ Passed	Passed · logs
Spelling	✅ Passed	Passed · logs
Generated README consistency	✅ Passed	Passed · logs
Skill validation	✅ Passed	Passed · logs
Skill lint (vally)	✅ Passed	Passed · logs
Risk scan	✅ Passed	Passed · logs
Contributor reputation	✅ Passed	Passed · logs
Duplicate resource scan	✅ Passed	Passed · logs
PR quality signal	⏭️ Skipped	Skipped by its workflow · logs

Action needed

• Address the changes requested by aaronpowell, then push an update.

Review

• Approvals: 0/1
• Assigned reviewer: not assigned yet — comment /request-review to ask for one
• Review target date: not set
• Still needed: 1 more approval(s); an approval from a maintainer with admin or maintain permission; resolution of changes requested by aaronpowell
• The core-maintainers pool is not staffed yet; an approver with admin or maintain permission is required instead.

Commands

Command	Who	What it does
/rerun-checks	PR author, maintainers	Re-runs failed or incomplete checks and re-evaluates this gate
/request-review	PR author, maintainers	Asks the review rotation to assign a reviewer (adds needs-reviewer)

_{Updated for 05ff084 · gate run · This comment is maintained automatically — see submission gate docs.}

[github-actions]

🔍 Vally Lint Results

✅ All checks passed

Scope	Checked
Skills	1
Agents	0
Total	1

Severity	Count
❌ Errors	0
⚠️ Warnings	0
ℹ️ Advisories	0

Summary

Level	Finding
ℹ️	✅ launch-check (2/2 checks passed)
ℹ️	✓ [spec-compliance] All 1 skill(s) are spec-compliant.
ℹ️	✓ spec-compliance: All spec checks passed.
ℹ️	✓ [valid-refs] All file references across 1 skill(s) are valid.
ℹ️	✓ valid-refs: All file references resolve to existing files within the skill directory.
ℹ️	1 skill(s) linted, 1 passed

Full linter output

### Linting skills/launch-check
✅ launch-check (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[aaronpowell]

Thanks — the secret-shape scanning, JWT role decoding and Supabase RLS check are useful tooling. Before this could merge:

1. how-it-works.md cites examples/demo/serve_demo.py and tests/launch-check (31 tests), which aren't in the PR. Include them or remove the claims.
2. Consider shipping only launch_check.py and dropping the vendored SEO/phone-design halves (~3,400 lines).
3. --owner-check reads live rows from any Supabase/Firebase project; limit it to local/preview URLs or an explicit project ref.
4. Please run it once from GitHub Copilot.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[aaronpowell]

Thanks for the work, but I don’t think this belongs in Awesome Copilot. The upstream README labels launch-check free and promotes the author’s paid Agensi site-polish and GEO/SEO audits with tracked sales links; the submitted skill says those audits are vendored here. That makes this a free-skill-to-paid-product funnel, and the package emphasizes general site design/SEO rather than Copilot development. The cited demo/tests are also absent, and --owner-check still reads live database rows. I recommend closing this submission.