skill-invocation-tracker — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-invocation-tracker (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The thesis: a skill catalog without telemetry is a graveyard waiting to happen. With telemetry, dead skills surface for promote/delete and hot skills surface for optimization budgets.
# At the start of any skill's run.sh:
bash skills/skill-invocation-tracker/run.sh start <skill-name>
# At the end:
bash skills/skill-invocation-tracker/run.sh end <skill-name> <status>
# where status is ok | error | skipThe skill writes one JSON line per call to data/skill-telemetry/invocations.jsonl.
{"event": "start", "skill": "overnight-founder", "ts": "<ISO>", "pid": 12345}
{"event": "end", "skill": "overnight-founder", "ts": "<ISO>", "pid": 12345, "status": "ok", "duration_sec": 34.1}The reader pairs start/end by pid. Unmatched starts (orphan PIDs older than 30 minutes) are flagged as crashed.
STATUS=ok event=<start|end> / STATUS=error reason=<...>
A live counter file is a contention point. Append-only JSONL is reader-friendly, append-cheap, trivially shippable as a daily snapshot.
The meta-skill scaffold (cont-17v3 F.1) gets an automatic two-line instrumentation snippet from cont-18 D.1. Future scaffolded skills inherit telemetry by default.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.