add-export — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited add-export (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
Aggregate score unchanged between these scans.
The primary manifest — the file an agent reads to learn what this artifact does.
Subpath exports are defined in package.json under the exports field. Each subpath maps to a source entry point that gets compiled to dist/. The exports catalog in CLAUDE.md/AGENTS.md must stay in sync with package.json.
The build uses tsconfig.build.json (not tsconfig.json) with rootDir: ./src and include: ["src/**/*"]. This means every source file at src/foo/bar.ts compiles to dist/foo/bar.js — the dist/ path in each export entry must match wherever tsc produces the compiled output for the named source file. Choose your source file location to produce the dist/ path you want in the export entry.
src/ (e.g., src/utils/new-util.ts)package.json exports, mirroring the source path: // source: src/utils/new-util.ts → dist: dist/utils/new-util.js
"./newutil": {
"types": "./dist/utils/new-util.d.ts",
"import": "./dist/utils/new-util.js"
}CLAUDE.md and AGENTS.md — add a row to the table. These files must stay byte-identical; the simplest approach is cp CLAUDE.md AGENTS.md after editingbun run scripts/public-api-contract-update.ts rewrites PUBLIC_RUNTIME_EXPORTS in scripts/public-api-contract.ts from the live barrels; never edit it by handbun run devcheck and bun run test:package — the package lane builds, packs, installs, and imports every subpath in the manifest, so a wrong dist/ path or a missing export fails there| Convention | Rule |
|---|---|
| Subpath | all-lowercase, no underscores (e.g., utils, storage/types, testing/fuzz) |
| Source file | kebab-case (e.g., error-handler.ts) |
| Export name | camelCase for values, PascalCase for types |
package.json exports with types and import conditionsCLAUDE.md and AGENTS.md (must be byte-identical)peerDependencies and peerDependenciesMeta in package.jsonbun run scripts/public-api-contract-update.tsbun run devcheck passesbun run test:package passes~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.