build — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited build (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Implement the approved plan incrementally: $ARGUMENTS
Follow these disciplines:
why-no-hook: skill workflow guidance; each step requires understanding the surrounding context (repo, task shape, prior state).
.claude/state/plans/ or the current conversation) (review-time: see section note)/plan first. With no spec either, run /spec (review-time: see section note)(review-time: see section note).claude/state/runs/<branch-slug>/tasks.md and tick each task as it finishes. Read that file, not memory, to resume after compaction (review-time: see section note)branch: frontmatter to the current branch (review-time: see section note)rules/agent-routing.md) - their guardrails apply to every increment (review-time: see section note)rules/parallel-agents.md); single-lane plans stay in this session (review-time: lane-vs-single judgment from the plan shape)For each task in the plan:
(review-time: see section note)(review-time: see section note)(review-time: see section note)(review-time: see section note)(review-time: see section note)(review-time: see section note)npm run verify:fast when package.json declares it. Otherwise run /verify-done. Do not rely on post-edit hooks alone (review-time: see section note)(review-time: see section note)(review-time: see section note)When a plan slice lists Tests first, run it as a loop with separate roles. The agent that writes code never writes or grades its own tests.
QA Expert subagent writes the slice's tests at the spec's seams and runs them. Each must fail for the expected reason. It commits them as test(...) and appends their paths to .claude/state/runs/<branch-slug>/tests.lock (review-time: see section note)rules/agent-routing.md, or this session for a single lane, makes the tests pass. hooks/pre-edit-test-lock.sh blocks edits to locked tests. A test it believes is wrong goes back to the QA Expert with the reason. Checkpoint as above (review-time: see section note)PR Reviewer, Cybersecurity Expert, and Spec Verifier for the slice's criteria. Add GDPR Expert, UX Expert, or PostgreSQL Expert when the diff touches their domain (review-time: see section note)(review-time: see section note)QA Expert fixes test findings. Checkpoint (review-time: see section note)(review-time: see section note)(review-time: see section note)(review-time: see section note)Budget: three review rounds per slice. Escalate under Blocked on me when the cap is hit, the same failure repeats twice, or a finding invalidates the plan. Log each round in tasks.md (review-time: see section note)
Spec Verifier when a spec matches the branch. Fix each FAIL and re-run it until every automated criterion passes at HEAD (review-time: see section note)(review-time: see section note)If the feature is large and will take multiple sessions:
(review-time: see section note)(review-time: see section note)(review-time: see section note)After all tasks are done:
/verify-done one final time. With a declared verify, that is the one full run for the branch (review-time: see section note)(review-time: see section note)(review-time: see section note)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.