worker-fullstack — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited worker-fullstack (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
NOTE: Startup and cleanup are handled by worker-base. This skill defines the WORK PROCEDURE.
Features that touch documentation, site content, npm packages, or span both repos. This includes:
./widget/spikes.js (the source of truth)widget/spikes.jssite/spikes.js (CDN copy) if it existsgzip -c widget/spikes.js | wc -c — must stay under 15KBcd cli && cargo run -- serve --port 3847, open browser, verify behavior.github/workflows/ (both repos)./docs/spikes <cmd> --helpwidget/spikes.jscli/Cargo.toml to remove cratesmod.rs and main.rscd cli && cargo build — must succeed with no errors or warningscd cli && cargo test — all existing tests must still passvitest.config.ts in ../spikes-hosted/worker/tsconfig.json in ../spikes-hosted/worker/../spikes-hosted/worker/test/package.jsoncd ../spikes-hosted/worker && npx vitest run passes{
"salientSummary": "Set up Vitest + Miniflare test infrastructure for spikes-hosted worker. Created vitest.config.ts, tsconfig.json, test helpers for D1 migration and R2 seeding. Added 3 smoke tests (health endpoint, spike creation, share creation) that pass. Installed vitest ~3.2.0, @cloudflare/vitest-pool-workers, typescript, and wrangler as dev dependencies.",
"whatWasImplemented": "Test infrastructure in ../spikes-hosted/worker/: vitest.config.ts with defineWorkersConfig, tsconfig.json with strict mode and workers types, test/setup.ts for D1 migrations, test/helpers.ts for common test utilities. Three smoke tests demonstrating the pattern. package.json updated with test script and dev dependencies.",
"whatWasLeftUndone": "",
"verification": {
"commandsRun": [
{ "command": "cd ../spikes-hosted/worker && npx vitest run", "exitCode": 0, "observation": "3 tests pass: GET /health returns 200, POST /spikes creates spike, POST /shares creates share" },
{ "command": "cd ../spikes-hosted/worker && npx tsc --noEmit", "exitCode": 0, "observation": "No type errors" },
{ "command": "gzip -c widget/spikes.js | wc -c", "exitCode": 0, "observation": "5832 bytes (under 15KB limit)" }
],
"interactiveChecks": [
{ "action": "Opened http://localhost:3847/ in agent-browser, clicked widget button", "observed": "Widget opens spike mode, crosshair cursor appears, elements highlight on hover" }
]
},
"tests": {
"added": [
{
"file": "../spikes-hosted/worker/test/smoke.test.ts",
"cases": [
{ "name": "GET /health returns 200", "verifies": "basic worker functionality" },
{ "name": "POST /spikes creates spike", "verifies": "spike creation with D1" },
{ "name": "POST /shares creates share", "verifies": "share creation with R2" }
]
}
]
},
"discoveredIssues": []
}~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.