Is tdd-bugfix safe to install?

SaferSkills independently audited tdd-bugfix (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

priv/skills/tdd-bugfix/SKILL.md · 1 file

priv/skills/tdd-bugfix/SKILL.md2.3 KB · Markdown

name: tdd-bugfix

description: "Reproduce → root-cause → failing test → minimal fix → verify. Trigger: 'fix this bug', 'reproduce and fix', 'TDD fix'. Requires a local test path."

when_to_use: "Activate when fixing a bug WITH a cheap local test path. Do NOT use for design tasks, features, or bugs requiring manual browser reproduction."

argument-hint: "[bug description or failing test path]"

disable-model-invocation: true

license: Apache-2.0

compatibility:

- opencode-native

- claude-standalone

- cursor-native

- codex

metadata:

author: controlkeel

version: "1.1"

category: development

ck_mcp_tools: [ck_validate, ck_finding, ck_git_diff, ck_git_commit, ck_memory_record]

related_skills: [deep-code-quality-review]

TDD Bugfix

Test-first bug fix. Failing test proves the bug, fix makes it pass, runtime evidence confirms.

Do NOT use when

No local test path exists (manual browser testing, production-only bugs)
Building features (use architect-first then plan-slice)
Refactoring (use deep-code-quality-review)

Workflow

Reproduce: Trace the code path to the defect. Write a minimal test that fails. Run it to confirm failure.
Root-cause: Follow root-cause checklist. Record root cause via ck_memory_record (type: finding).
Failing test: Write a test that demonstrates the bug. Must be: minimal, deterministic, clearly named. Confirm it fails.
Validate test: Run ck_validate on the test code. Fix findings.
Minimal fix: Smallest change to make the test pass. No refactoring, no improvements. Record improvement ideas via ck_memory_record for later.
Verify: Failing test passes. Full suite passes (mix test). Zero new failures.
Validate fix: Run ck_validate on the diff. Record findings.
Commit: ck_git_commit with message referencing the bug and test.

Rules

Test first, fix second — no exceptions
Minimal fix only — refactoring is a separate commit
No Process.sleep/1 in tests — use monitors or :sys.get_state/1
Root-cause, not symptom — fix the cause or record deeper issue as ck_finding

Output

Failing test proving the bug
Minimal fix making test pass
Full suite passing
Root cause recorded in memory

tdd-bugfix— agent skill

Is tdd-bugfix safe to install?

TDD Bugfix

Do NOT use when

Workflow

Rules

Output

Audit the pieces. Scan the whole. Decide.