dearuser:feedback — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited dearuser:feedback (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Send the user's message to the Dear User founder inbox.
message. Do NOT rewrite, shorten, or summarise.mcp__dearuser__feedback with { "message": "<the user's text>" }. jq -Rn --arg msg "$(cat <<'END_OF_DU_MSG'
<the user's text — verbatim, any content, no escaping>
END_OF_DU_MSG
)" '{message:$msg}' | npx -y -p @poisedhq/dearuser-mcp dearuser-run feedback -The <<'END_OF_DU_MSG' (quoted heredoc marker) prevents bash from interpreting any character in the message — apostrophes, $, backticks, backslashes all pass through literally. jq then produces safe JSON and pipes it to dearuser-run - which reads from stdin. If the command prints to stderr or exits non-zero, show that output to the user — the message was NOT sent.
Only include these when the user explicitly provided them:
rating (1–5) — only when the user typed a numbercontext — collab / security / health / wrapped / general. Default to the tool they just ran, or general.opt_in_followup + email — only when the user explicitly asked for a replyrating. Leave it out unless the user said a number.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.