Morning Form — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Morning Form (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Morning Form is a premium mobile-first state-optimization web app covering assessment, profile generation, protocol recommendation, daily guidance, check-ins, insights, and wearable integrations.
cd /Users/reubenselby/Desktop/morning-form
npm install
npx prisma db push
npm run db:seed
npm run devApp URL:
http://localhost:3000Demo user seeded locally:
[email protected]main: built MVPfeat/real-health-oauth: review branch for real provider connection wiringOpen PR:
https://github.com/contactxyz-admin/morning-form/pull/1Morning Form currently supports:
Detailed provider setup lives in:
npx tsx scripts/metrics/activation-funnel.ts --signup-since 2026-03-22 --signup-until 2026-04-21. Prints CSV + human-readable summary. See docs/plans/2026-04-21-002-feat-activation-funnel-instrumentation-plan.md.The retest loop (off by default, behind RETEST_LOOP_ENABLED) runs the "return leg": a lab panel completes a Draw, the next retest is scheduled, a daily Vercel cron (/api/cron/retest-nudge, gated by CRON_SECRET) sends a capped nudge sequence, and retention-to-retest is measured (nudge-attributed = loop-caused). The metrics CLI above appends a retest-retention section when the flag is on. Backfill existing users (run dark, before the flip): npx tsx scripts/retest/backfill-baseline-draws.ts (dry run) then --apply. Tunables live in src/lib/retest/constants.ts. See docs/runbooks/retest-loop-go-live.md and docs/plans/2026-06-17-001-feat-return-leg-retest-loop-plan.md.
Hybrid retrieval is enabled when an embedding provider is configured. It embeds only SourceChunk.text, stores one VectorEmbedding per chunk, and keeps search_graph_nodes on the same public contract while ranking with vector + lexical + graph RRF. Set HYBRID_RETRIEVAL_ENABLED=false to roll back to legacy lexical/graph behavior.
Production rollout:
npx prisma generate
npx prisma db push
npx tsx scripts/backfill-embeddings.ts --dry-run --estimate
npx tsx scripts/backfill-embeddings.ts --batch 80See docs/runbooks/hybrid-retrieval-production.md and docs/runbooks/backfill-embeddings.md.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.