prototype — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited prototype (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A prototype is throwaway code that answers a question. The question decides the shape.
Forked from Matt Pocock's `/prototype` on 2026-05-11; kit-owned for iteration. The LOGIC and UI branches are unchanged from upstream. The FEASIBILITY branch is a kit addition so/researchand/executecan name a discharge route forUncertainassumptions that are cheaply verifiable by code.
Identify which question is being answered — from the user's prompt, the surrounding code, or by asking if the user is around:
The three branches produce very different artifacts — getting this wrong wastes the whole prototype. The clearest signal:
If the question is genuinely ambiguous and the user isn't reachable, default to whichever branch better matches the surrounding code (a backend module → LOGIC; a page or component → UI; an Uncertain assumption in a research artifact → FEASIBILITY) and state the assumption at the top of the prototype.
pnpm <name>, python <path>, bun <path>, pnpm run test <file>, etc. The user must be able to start it without thinking.The answer is the only thing worth keeping from a prototype. Capture it somewhere durable (commit message, ADR, issue, the research artifact's assumption tag, or a NOTES.md next to the prototype) along with the question it was answering. If the user is around, that capture is a quick conversation; if not, leave the placeholder so they (or you, on the next pass) can fill in the verdict before deleting the prototype.
For FEASIBILITY spikes specifically, the verdict folds back into the calling skill's artifact: /research downgrades the assumption tag (e.g. Uncertain → Verified or Refuted), and /execute proceeds, pivots, or files a /correct-course depending on the answer.
The verdict is always what persists; the spike itself is disposable scaffolding by default, and most spike output genuinely is — delete it. But a FEASIBILITY spike sometimes captures output that is itself the cheapest source of a downstream asset: recorded HTTP responses, sample payloads, challenge-page HTML, golden files. When such output is a foreseeable downstream consumer's input — a later slice will commit it as a test fixture — preserve that artifact deliberately, distinct from and in addition to the verdict. Either:
fixtures/), with a one-line note on where it came from and when, so the consuming slice's "captures available" assumption is true rather than caught-false at execution time; orThis is a narrow exception, not a license to hoard. Preserve only when a named downstream consumer makes the output an asset; verdict-only discipline stays the default for ordinary spikes (Rule 6), where preserving output speculatively just bloats the repo with stale captures. The signal you preserve here is what /prd-to-issues and /execute rely on when a slice's assumption depends on a spike artifact rather than its verdict.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.