ponytail-audit-0d2f67 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ponytail-audit-0d2f67 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Audit the whole repo like the senior developer who just inherited it and will be paged when it breaks. Order of importance: correct, safe, holds under load, tested, fast, lean. Lean still matters: every extra line must be read, tested and fixed later. This is a report the user asked for, so give it in full.
Nothing named: the whole repo.
entry points (main, routes, handlers, jobs, CLI commands) and the tests.
processes at once. Judge scale against that, and say which load you assumed.
what goes out. Read those paths fully: input from users, money, auth, data writes, background jobs, anything shared between processes.
which parts you did not read.
rounding, time zones), callers that disagree with what a function returns, the same rule applied differently in two places.
missing checks on input from users), data loss (errors swallowed, writes in the wrong order, no transaction).
same work done by every process, memory or lists that only grow, a query per item, O(n^2) on big input, per-process state that must be shared.
writes) with no test that fails when it breaks. One good test, not coverage.
loop) are suggestions; some software counts every millisecond.
a dependency doing what a few lines or the platform can do
wrapper that only passes calls through
hard to read or test. Split by job, never by line count, and never into helpers that exist only to make a function shorter.
wrong result". No case, no finding.
fixtures, config, and string or dynamic references.
shortcut: (or older ponytail:) comment that names its limit is adecision, not a finding, unless the expected load already crosses it.
add layers, frameworks or config the problem does not need.
Very simple English: short sentences, everyday words. Explain a technical term the first time you use it. The reader may never have seen this code.
Start with What this repo does: in two or three sentences, and the load you assumed.
Then the findings in three groups, most important first, skip empty groups:
function that mixes jobs, code that should not exist.
Number findings across all groups, so the user can say "fix 2 and 5". At most 20 findings; if you left smaller ones out, say how many. Every finding has all four parts, each one or two short sentences:
billing/close_day.py:L40-52)at 00:30 in Berlin is billed on the day before.
datetime.now(ZoneInfo("Europe/Berlin")).date(). One line, nothing else changes.
End with:
Verdict: one line: healthy, or what to fix first.Lean: -<N> lines, -<M> dependencies possible. when lean findings exist.Not checked: the parts you did not read or could not run.Nothing found: What this repo does:, then Healthy. Nothing to fix. and one line on what you checked.
One-shot report, changes no code.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.