ship — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ship (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Validate and ship: $ARGUMENTS
Run these checks in order. Stop at the first failure.
why-no-hook: skill workflow guidance; each step requires understanding the surrounding context (repo, task shape, prior state).
verify, a <git-dir>/verify-passed stamp equal to HEAD on a clean tree counts. Otherwise run /verify-done and stop on first failure (review-time: see section note)console.log, debugger, .only(), TODO or FIXME markers) (review-time: see section note)git fetch origin main && git rebase origin/main (review-time: see section note)git status is clean (review-time: see section note)feat:, fix:, refactor:, etc.) (review-time: see section note)(review-time: see section note)(review-time: see section note).env, credentials, keys) (review-time: see section note)~/.agents/references/security-checklist.md; spawn the Cybersecurity Expert teammate for risky changes)(review-time: see section note)npm audit with zero critical/high (review-time: see section note)(review-time: see section note)(review-time: see section note)(review-time: see section note)(review-time: see section note)(review-time: see section note)(review-time: see section note)(review-time: see section note)(review-time: see section note)(review-time: see section note)(review-time: see section note)fix: commits = PATCH bump (review-time: see section note)feat: commits = MINOR bump (review-time: see section note)BREAKING CHANGE: = MAJOR bump (review-time: see section note)(review-time: see section note)If all checks pass:
/mr, which fills the repo template, links the issues, and creates it without a confirmation step (review-time: see section note)(review-time: see section note)(review-time: see section note)If any check fails:
(review-time: see section note)(review-time: see section note)For a staged rollout, decide per stage from thresholds, never from feel:
| Metric | Advance | Hold and investigate | Roll back |
|---|---|---|---|
| Error rate | Within 10% of baseline | 10-100% above baseline | More than 2x baseline |
| p95 latency | Within 20% of baseline | 20-50% above baseline | More than 50% above |
| Client JS errors | No new error types | New errors under 0.1% of sessions | New errors over 0.1% of sessions |
| Business metrics | Neutral or positive | Decline under 5% (may be noise) | Decline over 5% |
Write the rollback plan before the deploy, never during the incident:
Trigger conditions: error rate > 2x baseline, p95 > <X>ms, or reports of <specific issue>.
Steps: disable the feature flag, or deploy the previous version. Verify via
health check and error monitoring. Notify the team.
Database: name the migration rollback command; state whether data written by
the new feature is preserved or cleaned up.
Time to rollback: flag under 1 minute, redeploy under 5, database under 15.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.