Update to OpsTruth Verification

{
  "description": "Use this before implementation, pull-request handoff, migration, deployment or publication when a user needs static safety evidence about visible API, environment, secret or deployment changes in a public GitHub repository. Do not accept credentials or perform writes.",
  "included_files": [
    {
      "relative_path": "agents/openai.yaml",
      "size_in_bytes": 425
    }
  ],
  "name": "review-change-safety",
  "skill_md_contents": "---\nname: review-change-safety\ndescription: Use this before implementation, pull-request handoff, migration, deployment or publication when a user needs static safety evidence about visible API, environment, secret or deployment changes in a public GitHub repository. Do not accept credentials or perform writes.\n---\n\n# Review Change Safety\n\n1. Establish repository identity with `opstruth_inspect_repository`.\n2. Select only relevant checks from secrets, environment, API contracts, migrations, GitHub handoff and deployment.\n3. If the requested outcome is broad, call `opstruth_plan_workflow` to obtain a least-authority sequence.\n4. Describe evidence and consequences without labelling pattern matches as confirmed vulnerabilities.\n5. Refuse to expose secret values or accept credentials in arguments.\n6. Use current public GitHub CI evidence when available and identify the exact commit it covers.\n7. Use `opstruth_prepare_sandbox_verification` to define the fixed commands and isolation requirements when fresh execution is necessary.\n8. Stop before write actions or code execution. Explain which separately connected authenticated and approval-gated lane would be required.\n\nReturn the safest next action that would close the most important proof gap.\n"
}