code-work — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited code-work (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Code lives in files. The graph captures the cognitive process that produced it — the decisions, the rejected alternatives, the surprises, the experiments.
creative-work puts artifacts inside the graph as doc trees. Code-work is different: the code stays in the filesystem where it belongs. What enters the graph is the understanding that shaped the code.
doc_create with 200 lines of Pythondecision node explaining why you chose reflecting boundaries over clamping, linked to the surprise node where you realized clamping creates boundary artifactsEvery time you choose one approach over another, that's a decision node. Not "I used Python" — that's obvious. The non-obvious choices: why this algorithm, why this data structure, why this boundary behavior.
{ tool: "graph_add_concept", params: {
title: "Reflecting boundaries over clamping",
trigger: "decision",
understanding: "Clamping concentrates probability density at boundary walls. Reflecting preserves the stochastic distribution while enforcing bounds.",
why: "User's equation of motion uses bounded noise — boundary handling affects dynamics"
}}When code behaves unexpectedly — a rendering overlaps, a test fails in a way you didn't predict, a performance characteristic surprises you — that's a surprise node. Failed expectations are more valuable than confirmed ones.
When two valid approaches conflict and you can't resolve which is better. "PCA projection sounds rigorous but produces meaningless coordinates" vs "LLM-as-mapper is honest but reintroduces the problem." Hold the tension — don't collapse it prematurely.
When you compile, run, render, or test — the result is empirical data. Create an experiment node with: what you ran, the actual output, and what it means. The compile-check-fix loop generates understanding; capture it.
Code work often follows a tight cycle: edit → run → observe → fix. Not every iteration deserves a node. Capture the inflection points:
decision nodesurprise or experiment nodedecision that supersedes the old oneexperiment confirming the approachSkip the mechanical middle. Six rounds of adjusting TikZ coordinates don't need six nodes — but the moment you realize the z-axis projection direction is the root cause, that's worth capturing.
Code decisions don't happen in a vacuum. Link them:
learned_from — "I understood boundary artifacts by studying the O-U process constraints"supersedes — "Reflecting boundaries replaces my earlier belief that clamping was sufficient"answers — "This experiment answers the question of whether PCA projection is viable"contradicts — "The rendered output contradicts my expectation that labels would be separated"Pair code milestones with reasoning traces in the same batch:
graph_batch({
commit_message: "Chose reflecting boundaries for EAT phase space — clamping creates artifacts",
operations: [
// The decision
{ tool: "graph_add_concept", params: {
title: "Reflecting boundaries over clamping",
trigger: "decision",
understanding: "...",
why: "Clamping distorts probability density at manifold walls"
}},
// What it supersedes
{ tool: "graph_connect", params: {
from: "$0.id", to: "n_prior_approach",
type: "supersedes", why: "Clamping was the naive first attempt"
}},
// The experiment that confirmed it
{ tool: "graph_add_concept", params: {
title: "Boundary behavior test",
trigger: "experiment",
understanding: "Compiled and rendered — reflecting boundaries produce clean distributions without wall accumulation",
why: "Empirical confirmation of the theoretical concern"
}},
{ tool: "graph_connect", params: {
from: "$2.id", to: "$0.id",
type: "answers", why: "Experiment validates the decision"
}}
]
})When evaluating someone else's code or an AI-generated suggestion (a PR, a Gemini revision, a Stack Overflow answer):
foundation nodes for new techniques learnedsurprise node for the gap between appearance and substancetension between "sounds right" and "is right"The reasoning about why you accept or reject a suggestion is more valuable than the suggestion itself.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.