worker-widget — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited worker-widget (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
NOTE: Startup and cleanup are handled by worker-base. This skill defines the WORK PROCEDURE.
Features that modify widget behavior (widget/spikes.js), widget config parsing, POST/sync logic, visual indicators, or require syncing the 4 widget copies. Also handles widget-related documentation updates.
agent-browser — for manual verification of widget behavior in the browser. Invoke after implementation to verify interactive behaviors (button appearance, error indicators, tooltips, POST targets)..factory/library/architecture.md — especially "Widget Endpoint Resolution" and "Widget Error Visibility" sectionswidget/spikes.js (source of truth)widget/spikes.js is the SOURCE OF TRUTH. Edit this file first.config object initialization (~line 30-35).saveSpike() (~line 260-295).createButton() and related functions.widget/spikes.js, copy it to:site/spikes.jssite/widget.jscli/assets/spikes.jsVerify with: diff widget/spikes.js site/spikes.js && diff widget/spikes.js site/widget.js && diff widget/spikes.js cli/assets/spikes.js
cd cli && cargo test --jobs 5 — all tests must passgzip -c widget/spikes.js | wc -c — must be ≤15,360 bytes (15KB)/tmp/spikes-widget-test/ that embeds the widget from a local pathpython3 -m http.server 8899 --directory /tmp/spikes-widget-test/http://localhost:8899/test.htmlinteractiveChecks entry with full sequence and outcomelsof -ti :8899 | xargs kill 2>/dev/null || trueREADME.md, site/docs.html, site/index.html as needed{
"salientSummary": "Implemented default endpoint logic: widget now POSTs to https://spikes.sh/spikes when data-project is explicitly set and data-endpoint is absent. Added red error dot indicator on button for POST failures (onerror, non-2xx, catch). Upgraded console.warn to console.error. Synced all 4 widget copies. Verified via agent-browser: default endpoint works on localhost:8899, error dot appears with bad endpoint, clears on success.",
"whatWasImplemented": "In widget/spikes.js: (1) Config parsing now checks script.hasAttribute('data-project') to set endpoint default to https://spikes.sh/spikes. (2) All 3 POST failure paths upgraded to console.error with URL+status. (3) Red dot child div on button (12px, #dc2626, top-right) with tooltip. (4) Error state resets on 2xx response. Synced to site/spikes.js, site/widget.js, cli/assets/spikes.js.",
"whatWasLeftUndone": "",
"verification": {
"commandsRun": [
{ "command": "cd cli && cargo test --jobs 5", "exitCode": 0, "observation": "160+ tests pass, 0 failures" },
{ "command": "gzip -c widget/spikes.js | wc -c", "exitCode": 0, "observation": "5912 bytes (under 15KB limit)" },
{ "command": "diff widget/spikes.js site/spikes.js && diff widget/spikes.js site/widget.js && diff widget/spikes.js cli/assets/spikes.js", "exitCode": 0, "observation": "All 4 copies identical" },
{ "command": "grep -n 'console.warn' widget/spikes.js | grep -i 'sync\\|endpoint\\|post'", "exitCode": 1, "observation": "No console.warn in POST section" }
],
"interactiveChecks": [
{ "action": "Loaded http://localhost:8899/test.html with data-project='test-app' (no data-endpoint). Clicked widget button, selected page, rated 'like', commented 'test'. Clicked Save.", "observed": "Network tab shows POST to https://spikes.sh/spikes. Response 200. No red dot on button. Toast 'Spike saved!' appeared immediately." },
{ "action": "Loaded test page with data-endpoint='https://nonexistent.invalid/spikes'. Submitted spike.", "observed": "Red dot appeared on button top-right corner after network error. Hovering button shows tooltip 'Last feedback failed to sync — see console'." },
{ "action": "Ran window.Spikes.config.endpoint = 'https://spikes.sh/spikes' in console. Submitted another spike.", "observed": "POST succeeded (200). Red dot disappeared. Tooltip reverted to default." }
]
},
"tests": {
"added": []
},
"discoveredIssues": []
}cargo test fails after widget copy sync (indicates CLI bundling issue)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.