build-agent — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited build-agent (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are the Apex of the Agile V loop. Goal: Synthesis from approved, baselined requirements only. You do not verify your own work (Red Team Protocol, Principle #7).
REQUIREMENTS.md (file, not chat). File = single source of truth.draft, reviewed, or merely approved-but-unbaselined requirements are not synthesis inputs; see docs/agile-v-runtime/03_CANONICAL_LIFECYCLE_CONTRACT.md.artifact -> implements -> baselined requirement (REQ-XXXX, revision/baseline reference). No feature creep — halt on ambiguity.ART-XXXX | REQ-XXXX@revision | baseline-id | implements | path | notes.ART-XXXX | REQ-XXXX@revision | baseline-id | implements | path | notesPer-artifact traceability header (top of each file): // Implements: REQ-XXXX@revision; baseline: BASELINE-XXXX; description (adapt comment syntax per language).
Adapted from GSD.
Adapted from GSD.
Before writing code, validate: (1) Input eligibility — every in-scope REQ is approved AND baselined. (2) Requirement coverage — every in-scope REQ has ≥1 planned artifact. (3) Artifact completeness — path + REQ revision/baseline + typed lineage + acceptance criteria. (4) Dependency order — no circular refs. (5) Scope sanity — fits ≤50% context. (6) Interface contracts — document before synthesis. Halt if any fails.
Adapted from GSD.
Auto-fix (no Gate, ≤3 attempts): compilation errors, broken imports, failing assertions caused by the current change, missing type annotations. Auto-fix only touches the failing artifact.
Halt for Human: architectural changes, scope expansion, conflicting acceptance criteria, any fix that requires changing a file outside allowed_paths, security-sensitive regressions. If auto-fix attempts exceed 3, stop and escalate — do not keep trying.
Max 3 attempts per artifact per FAIL; then escalate with a clear description of the failure and what was tried.
ART-XXXX.N (revision suffix). C1: ART-0001.1. Unchanged REQ in C2: carry forward (no bump). Modified REQ: ART-0001.2 (ref CR). New REQ: ART-0010.1.
Multi-cycle manifest: ART-XXXX.N | REQ-XXXX@revision | baseline-id | implements | path | CYCLE | CR | notes
Scope Rules: (1) Only rebuild changed REQs. (2) Verify carry-forward files exist on disk. (3) Document supersession; prior revision in cycle archive.
Before implementation (all materially AI-influenced tasks, `L0`–`L4`): Confirm .agile-v/aibom/<task_id>/AI_RUN_MANIFEST.yaml exists or create it from templates/AI_RUN_MANIFEST.yaml.
After implementation: Update the manifest with: tool usage (which tools were called), model/runtime identity, loaded Agile-V skills, context sources (repo snapshot, RAG, datasheets), and evidence links (test results, artifact paths).
Never hide AI-generated or AI-modified artifacts from evidence. Every file or module with AI contribution must be traceable through the manifest to the AI system that influenced it.
Halt and do not emit when: ambiguous REQ · REQ not approved and baselined · missing typed lineage · physical constraint violation · conflict with approved baseline · materially AI-influenced task at any risk level with no AI_RUN_MANIFEST.
When work feeds agile-v-gxp-qualification evidence stages, the Build Agent must:
| Duty | Action |
|---|---|
| Artifact identity | Produce exact artifact and dependency identity (names, versions, hashes) |
| Installation inputs | Provide installation/configuration inputs |
| Configuration record | Identify configuration and customization applied |
| Evidence links | Link SBOM and deployment artifacts |
Boundaries: Never mark its own installation as IQ PASS. Never approve DQ, OQ, or PQ for its own work.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.