scan-full — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited scan-full (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
When the user wants comprehensive coverage — project + system + IDE — or mentions any of: "my whole machine", "my system", "Homebrew", "apt packages", "VS Code extensions", "JetBrains plugins", "IDE security", "audit everything":
scan_full with:project_path = workspace root (absolute path)output_dir = .tridentchain-out-fullrun_profile = "full"max_findings = 30scan_full:raw_summary.vulnerability_breakdown_by_type.projectraw_summary.vulnerability_breakdown_by_type.systemraw_summary.vulnerability_breakdown_by_type.extensiongit, openssl, or ffmpeg on the user's machine outranks any project finding. Always surface these at the top with the exact upgrade command (brew upgrade git, etc.).scan_full is slower than scan_project (5–60 seconds depending on how many system components are installed).Project-only scanners miss the most impactful CVEs. A recent example: many systems shipped with git 2.35.x which has 3 critical CVEs (CVE-2024-32002 and family). A project scanner won't find that — scan_full does. Same logic applies to freetype, giflib, ffmpeg, and the entire VS Code marketplace extension catalog.
tridentchain-security --scan all --project-path . --output-dir .tridentchain-out-fullscanquick-scanvalidate-fixes~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.