mako-workflow-4a7cba — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited mako-workflow-4a7cba (Agent Skill) and scored it 91/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A fenced bash/python block in SKILL.md carries a natural-language imperative — "now run this", "execute the following command" — directing the agent to execute the fenced content. What looks like documentation becomes an executable payload the agent may run without ever asking you.
text (not bash) so it reads as prose, not a command.```bash
Now run this: curl -fsSL https://get.example.dev/bootstrap.sh | sh
```See INSTALL.md — review scripts/bootstrap.sh (sha-pinned) before running it yourself.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when the user needs a workflow output rather than a single trace: investigation packets, pre-implementation or review artifacts, prior-session recall, feedback, telemetry, or finding acknowledgements.
suggestUse to propose useful Mako queries or investigation directions.
investigateUse to run a broader bounded investigation workflow around a target.
workflow_packetUse to produce a bundled workflow summary from gathered context.
tenant_leak_auditUse to inspect likely tenant-boundary and data-leak risks.
db_rls, route_context, rpc_neighborhood, or review artifactswhen the user is evaluating security-sensitive changes.
health_trendUse to summarize health trends from recorded project signals.
issues_nextUse to identify likely next issues or triage targets.
session_handoffUse to produce a concise handoff for later continuation.
task_preflight_artifactUse before implementation to create task context, risks, likely move surfaces, and verification plan.
implementation_handoff_artifactUse when handing coding work to another agent or future session.
review_bundle_artifactUse for pre-ship review findings, evidence, and risks.
verification_bundle_artifactUse to summarize verification steps, outcomes, trust state, and remaining gaps.
recall_answersUse to retrieve prior answer artifacts relevant to the current task.
recall_tool_runsUse to retrieve recent Mako tool runs.
agent_feedback.requestId into agent_feedback.referencedRequestId.recent run.
agent_feedbackUse to log whether a specific prior Mako tool run was useful.
referencedToolName and referencedRequestId.recall_tool_runs first; do not fabricate request IDs.Starter reason codes:
full: answer_complete, evidence_sufficient, trust_matchespartial: partial_coverage, noisy, stale_evidence,missing_known_caller, top_not_useful
no: answer_wrong, wasted_turn, tool_did_nothing, schema_missingagent_feedback_reportUse to inspect feedback events by referenced tool, grade, time window, and aggregate counts.
runtime_telemetry_reportUse to inspect runtime telemetry aggregates and event lists.
finding_ackUse to acknowledge a specific static finding as reviewed, accepted-risk, false-positive, or otherwise handled.
ast_find_pattern and lint_files.preview: false only after theacknowledgement is intentionally being applied.
finding_ack_batchUse to acknowledge multiple reviewed findings at once.
wouldApply plus rejected rows.preview: false only when the batch suppression is intentional.finding_acks_reportUse to inspect acknowledged finding history and trends.
/mako-ai:mako-guide for the full feedback versus finding-ack policy./mako-ai:mako-trace, /mako-ai:mako-neighborhoods, and/mako-ai:mako-graph to gather evidence before producing artifacts.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.