debt-ops-add-4c940b — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited debt-ops-add-4c940b (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Call the bundled register.py via your shell tool. It lives in this skill's scripts/ directory — reference it with the relative path below (your agent resolves it against the skill root). The helper writes the entry under the repo's detected registry dir (default docs/debt/), assigns a short batch letter (A, B, C…), and prints exactly one line: +1 entry: <slug> (<letter>). That stdout IS the user-facing announcement — add no commentary before or after.
python3 scripts/register.py \
--slug <slug> \
--principal <effort, e.g. 2d, 1w, unknown> \
--interest <ongoing cost, e.g. "+30min/incident", unknown> \
--hotspot <path or module, e.g. pricing/engine.ts, unknown> \
--business-capability <e.g. checkout, billing, unknown> \
--payoff-trigger <concrete trigger, or "unknown"> \
--quadrant <reckless-inadvertent|reckless-deliberate|prudent-inadvertent|prudent-deliberate> \
--category <migration|documentation|testing|code_quality|dead_code|code_rot|expertise|release|infrastructure|planning> \
--ai-authored <true|false> <<'EOF'
<body: 2-5 sentences — what the debt is, why it exists, observed symptoms>
EOFThe helper:
id itself (no date call needed).~/.cache/debt-ops/cache/<repo-hash>/current-turn.txt(override the base with DEBT_OPS_CACHE) so the user can drop by letter.
1–4 word kebab-case label of what the debt is. Examples: cancelled-promotion-callback, legacy-auth-shim, unfinished-rate-limiter. Keep it short — the body carries the context.
reckless-inadvertent (didn't know better),reckless-deliberate (knew, did it anyway), prudent-inadvertent (learned afterward), prudent-deliberate (deliberate, with a payoff plan).
the field — unknown ages into stale review and that's the point.
drop A, drop A,C, drop all — on tools with a debt-ops hook adapter this ishandled automatically. Without an adapter (skills-only tool), delete the matching entry yourself: read ~/.cache/debt-ops/cache/<repo-hash>/current-turn.txt for the letter → filename mapping, then rm <registry-dir>/<filename>.
drop it or drop <slug> — delete it yourself:rm <registry-dir>/<id>-<slug>.md (default registry dir docs/debt/). Treat dropping as cheap — over-registering is the intended posture.
permission prompt; just do it."
going through register.py.
visible to the user.
payoff_trigger with a guess to seem certain.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.