oma-debug — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited oma-debug (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Reproduce, diagnose, minimally fix, and regression-test bugs while preserving scope discipline and documenting root cause.
.agents/results/bugs/ when appropriateresources/execution-protocol.md, examples, checklist, common patterns, and debugging checklist| Action | SSL primitive | Evidence |
|---|---|---|
| Reproduce failure | CALL_TOOL | Test/runtime/log command |
| Search affected code | READ | Code, tests, symbols, references |
| Compare similar patterns | COMPARE | Pattern search |
| Infer root cause | INFER | Diagnostic reasoning |
| Write minimal fix | WRITE | Code patch |
| Write regression test | WRITE | Test patch |
| Verify behavior | VALIDATE | Tests/checks |
| Report result | NOTIFY | Root-cause summary |
Use the configured code-intelligence provider to locate files and inspect symbols or content. For Serena, use find_file, search_for_pattern, get_symbols_overview, and find_symbol. Native search is limited to the provider exclusions and non-code paths permitted by the project's search policy.
Then run the smallest reproduction command first, establish the causal mechanism, and follow resources/execution-protocol.md for the diagnosis record when an OMA workflow is active. Add the regression test and re-run the failing check plus related tests.
| Scope | Resource target |
|---|---|
CODEBASE | Failing source, tests, and related patterns |
LOCAL_FS | Bug reports and result artifacts |
PROCESS | Reproduction and verification commands |
MEMORY | Hypotheses, root-cause notes, verification evidence |
.agents/results/bugs/..agents/results/bugs/Use the configured provider to locate the failing function, find callers, and search similar error patterns. Native search and scoped reads are supported fallbacks; see the shared capability contract.
../_shared/core/code-intelligence.md (code search/navigation)resources/execution-protocol.mdresources/checklist.mdresources/error-playbook.mdresources/bug-report-template.mdresources/common-patterns.mdresources/debugging-checklist.md../_shared/core/context-loading.md../_shared/core/context-budget.md../_shared/core/lessons-learned.md (matching prior failure or requested retrospective)../oma-observability/SKILL.md §Integrations — traces/logs by trace_id, 6-dim forensics~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.