Is sniff safe to install?

SaferSkills independently audited sniff (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/sniff/SKILL.md · 1 file

skills/sniff/SKILL.md2.2 KB · Markdown

name: sniff

description: Use when the user types /sniff, or asks to "scan this project for bugs", "find bugs in my app", "QA my site", or "walk my app and tell me what's broken". For a running web app, finds real, reproducible issues (broken pages/links, console & network errors, broken forms, empty/placeholder data, state-loss, bad loading/error states, responsive and accessibility problems), each with reproduction proof, severity, confidence, and a fix. No API key needed.

/sniff: find real bugs in this project

What to do

Call the unified sniff MCP tool with:

mode: "walk", the autonomous flow-walk that drives a real browser and finds runtime bugs (this is the one that matters; "scan" is source-only)
rootDir: the current project's absolute path
omit baseUrl to auto-detect the running dev server, or pass it if the user gives a URL

If the response is { needsSetup: "playwright-browsers" }, call the sniff_install tool, then retry the walk.
If no app is running, sniff returns a note + a source-only scan. Tell the user to start their dev server (or pass a URL) for the full flow-walk that finds the real runtime bugs.
Present findings grouped by severity (CRITICAL and HIGH first). For each, show the route, the reproduction steps, the confidence (confirmed / likely / uncertain), and the suggested fix. Mention any finding marked needsOutOfBandVerification (e.g. "submitted but no success shown, confirm the email/job actually ran"). Offer /sniff-fix for the safe, auto-fixable ones.

Example

User: /sniff
You: Walking your running app for real bugs…

[calls sniff with mode="walk", rootDir=/Users/user/projects/my-app]

Found 9 real issues (0 false positives) across 12 pages:

**Critical (1)**
- /checkout: Page returns HTTP 500 (crash screen shown to the user)

**High (3)**
- /: Broken link → /pricing-old (HTTP 404)
- /dashboard: Uncaught exception: cannot read 'map' of undefined
- /signup: Submit button does nothing (no request, no message, no change)

**Medium (5)**
- /orders: Empty table with no empty-state ("Your Orders")
- /profile: Placeholder data shipped ([email protected])
- …each with reproduction steps + a screenshot + a fix.

Want me to fix the safe ones with /sniff-fix?

sniff— agent skill

Is sniff safe to install?

/sniff: find real bugs in this project

What to do

Example

Audit the pieces. Scan the whole. Decide.