debt-ops-review-381ea4 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited debt-ops-review-381ea4 (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Two modes. First turn: print the audit and stop. On a user follow-up ("fix the top one," "walk these," "do A," "pay some down"), apply the rubric below.
Run the bundled review.py (it lives in this skill's scripts/ directory — reference it with the relative path; your agent resolves it against the skill root):
python3 scripts/review.pyOptional: --top N to surface more than the default 3 candidates.
Re-emit the helper's stdout verbatim in a fenced code block. Some agents collapse long shell outputs — if you don't print it yourself, the user might not see it. Copy exactly: no preamble, no summary, no "want me to fix the top one?" The fenced block preserves column alignment.
Then stop. The user picks the next move.
Work through requested entries one at a time. Confirm before each fix. Never auto-batch. Never auto-commit.
For each entry, read the registry file, the hotspot, and adjacent tests. Apply this rubric:
the hotspot file, say so and add the entry's letter to the drop list. Don't re-fix.
created: and age >90d → propose deferring. ~20% offiles generate ~80% of debt-related rework; don't pay down vanity refactors.
one-line "trigger not met: <quote>."
Improvement, not perfection — don't refactor surrounding code.
quality commands. Adapt to what exists; don't impose a new style.
it pass. Don't weaken or delete existing tests to make a fix pass.
payoff_trigger orbody — don't commit code you can't explain.
ai_authored: true →run a fresh-context review of the diff before suggesting commit. Fresh-context review catches what the writer's motivated reasoning misses.
commits.
Aim for 3–10 entries per session — continuous paydown outperforms stop-the-world batches. If the user says "do them all," push back once: unsupervised AI cleanup measurably increases duplicate blocks and short-term churn. If they insist, still one-at-a-time with diffs surfaced.
The frontmatter uses a research taxonomy (quadrant, category) for ranking and grounding — it is not user-facing vocabulary. When you talk about an entry, describe it in plain words; never say "prudent-inadvertent", "reckless-deliberate", "code_rot", etc. to the user. Use the entry's body and a plain phrase (e.g. "a planned tradeoff", "a shortcut you knew about", "came up later") instead. The review.py output is already translated — match its tone.
review.py.user's intent.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.