build-release-mindset — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited build-release-mindset (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Build and release code has a different discipline than feature code: it must be reproducible, abortable, and reversible. A build that depends on whatever the last run left behind is unreliable by definition. Before you change a build step, ask what happens if it crashes halfway, and whether you could undo the release after it ships.
Editing a build script, a release or packaging step, a publish flow, or CI config.
Start from a guaranteed clean state — remove stale artifacts, intermediates, and any patched config before you begin. Smoke-test the smallest case first and abort fast if it fails; don't run the full matrix on a setup you haven't proven. Version artifacts into timestamped outputs instead of overwriting, so rollback is trivial. Validate outputs, not just inputs: check sizes, counts, and versions, because a silently-empty or zero-test artifact is the worst failure mode and the easiest to miss. Protect any global state you patch-and-restore with a lock so a half-finished run doesn't leave the machine broken. Know the rollback before you ship.
A release script builds eight engine versions over an hour, then you discover version one was broken from the start — the whole hour is wasted. A canary fixes it: build the smallest version first, and abort the run if it fails, so a broken setup costs two minutes instead of sixty. The same instinct catches a "0 tests passed" that would otherwise ship green because nobody asserted the count was above zero — a loud failure is always better than a silent bad artifact.
| Thought | Reality |
|---|---|
| "The machine's probably clean" | Probably is not a guarantee; start clean. |
| "It built, so it's good" | Built is not the same as validated. Check the output. |
| "I'll just overwrite the last build" | Then you can't roll back when this one's bad. |
| "All eight will be fine" | Smoke-test one before you spend an hour on eight. |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.