octocode-prompt-optimizer — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited octocode-prompt-optimizer (Agent Skill) and scored it 91/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
ignore/disregard/forget … previous instructions sentence.Every scanned point with the score it earned and what moved between them.
Score fell 9 points between these scans.
The primary manifest — the file an agent reads to learn what this artifact does.
Optimize instruction behavior, not prose aesthetics.
Flow: READ → UNDERSTAND → RATE → FIX → VALIDATE → OUTPUT.
references/gates.md — read every section and map intent before judging or drafting.references/rate.md; FIX: load references/fix.md; VALIDATE: load references/validate.md; OUTPUT: load references/output.md — load only the active gate so later-step advice cannot bias the current decision.references/patterns.md — apply the higher authority and log the resolution in one line.references/conciseness-toolkit.md; when fixing priority/hierarchy load references/attention.md; when choosing a technique for an observed failure load references/prompt-techniques.md — match technique to failure mechanism.references/tool-contracts.md; for agent handoffs load references/agent-communication.md; for typed packet boundaries load references/zod-agent-contracts.md — make inputs, outputs, authority, and failure states explicit.references/context-budget.md; when repeated calls share stable prefixes load references/prompt-caching.md — control relevance, pagination, latency, and cost.references/evaluation-data.md — build realistic held-out scenarios, verifiers, metrics, and a failure ledger.references/untrusted-content.md — preserve the boundary between data and authority.octocode-graph-eval; otherwise load references/improve-loop.md — require measurable acceptance instead of intuition.octocode-skills for skill-folder architecture/review; octocode-research to verify cited contracts; octocode-graph-eval for held-out behavior.octocode-subagent for delegation topology.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.