oma-frontend — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited oma-frontend (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Build, modify, and verify React/Next.js or Angular TypeScript user interfaces that follow project architecture, design-system constraints, accessibility expectations, and existing frontend conventions.
shadcn/ui — or Angular + signals + RxJS in Angular projects (resources/angular-rules.md)packages/design-tokens, packages/i18n, and shared utilitiesresources/execution-protocol.md, resources/checklist.md, snippets, and Tailwind rules| Action | SSL primitive | Evidence |
|---|---|---|
| Inspect existing frontend patterns | READ | Components, routes, hooks, styles |
| Select component and state approach | SELECT | Server/client and shadcn workflow |
| Implement UI code | WRITE | TSX, CSS, hooks, wrappers |
| Validate form/data contracts | VALIDATE | Zod/forms/API schemas |
| Call shadcn or verification tools | CALL_TOOL | Registry, lint, typecheck, tests |
| Compare responsive states | COMPARE | Desktop/mobile behavior |
| Report result | NOTIFY | Final summary |
ahooks or @mantine/hooks, es-toolkit, nuqs, TanStack Query, Jotai/Zustand, TanStack React Form, zodrxjs/testing (TestScheduler marble tests) in Angular projectsUse the configured code-intelligence provider to locate files and inspect symbols or content. For Serena, use find_file, search_for_pattern, get_symbols_overview, and find_symbol. Native search is limited to the provider exclusions and non-code paths permitted by the project's search policy.
Then run the project's frontend verification commands, typically lint, typecheck, tests, and browser/responsive checks when the UI changes.
| Scope | Resource target |
|---|---|
CODEBASE | Frontend routes, components, styles, hooks, tests |
LOCAL_FS | Design tokens, i18n files, resource references |
PROCESS | Build, lint, typecheck, test, browser commands |
NETWORK | Backend APIs or registry tools when required |
components/ui/* directly.Apply framework, library, architecture, and data-model defaults only when the target project has no established choice. Scoped edits do not authorize a stack migration or unrelated infrastructure.
shadcn/ui primitives and wrappers for UI work; treat components/ui/* as read-only.../../rules/frontend.md §Naming Conventions — domain + role readable from the basename alone (order-summary-card.tsx, use-order-polling.ts, cart.atoms.ts). Grab-bag names (utils.ts, helpers.ts, misc.ts) and version suffixes (*-v2, *-final) are banned.proxy.ts, preserve that convention. Check the installed framework version and routing before recommending a file rename. Diagnose wiring from code and tests.OnPush + signals-first, inject() DI, lazy routes, new control flow. Any non-trivial RxJS pipeline MUST ship with a marble test (`TestScheduler` from `rxjs/testing`) — a stream without a marble test fails review. React/Next.js-specific rules (shadcn workflow, proxy.ts, Libraries table below) do not apply in Angular projects.React/Next.js projects only — Angular projects use the Angular-native equivalents in resources/angular-rules.md (signals, typed Reactive Forms, HttpClient/httpResource, RxJS with mandatory marble tests).
| Category | Library |
|---|---|
| Framework | New-project default: next@16+ (App Router) + react@19+; preserve existing project versions |
| Date | luxon |
| Styling | TailwindCSS v4 + shadcn/ui (Base UI engine; see resources/tech-stack.md) |
| Hooks | ahooks (default) or @mantine/hooks (standalone, SSR-safe; no Mantine UI required); pre-made hooks preferred; pick one per project, don't mix |
| Utils | es-toolkit (first choice) |
| Types | type-fest (TS type utilities not in the standard lib: SetRequired, Merge, JsonValue, Promisable, etc.; built-in Partial/Pick/Omit stay first choice) |
| State (URL) | nuqs |
| State (Server) | TanStack Query; default is orval-generated hooks from the OpenAPI spec (client: react-query); hand-write hooks only for spec-less endpoints (see resources/tech-stack.md §Server State) |
| State (Client) | Jotai or Zustand (intent-based, no default; minimize use — see resources/tech-stack.md) |
| Forms | @tanstack/react-form (v1+; pass zod schemas directly via Standard Schema; do not add the v0-only @tanstack/zod-form-adapter to v1 projects) + zod (v4) |
| Auth | better-auth; client code imports only the client SDK, never server libraries or database adapters |
| Animation | New-project default: motion with imports from motion/react; preserve an existing animation library for scoped edits |
components.json → style: "base-*"). Radix (radix-*) is areasoned fallback for existing Radix codebases only; no big-bang migration. Details in resources/tech-stack.md §shadcn/ui Primitive Engine.
shadcn_search_items_in_registriesshadcn_get_item_examples_from_registriesshadcn_get_add_command_for_itemsgenerateMetadata, sitemap)useQuery hooksresources/tech-stack.md §Mutations)Card, Sheet, Typography, Table) over div or generic classes.Drawer (mobile) vs Dialog (desktop) via useResponsive.<!-- oma-docs:ignore-start -->
components/ui/* as read-only. Create wrappers (e.g., components/common/ProductButton.tsx) or use cva composition. Never edit components/ui/button.tsx directly.<!-- oma-docs:ignore-end -->
packages/design-tokens (OKLCH); never hardcode colorspackages/i18n; never hardcode UI textes-toolkit first; if implementing custom logic, use the project or task coverage target and risk-relevant testsProject stack conventions live in dedicated files. Read these before coding; they are not optional appendix material.
| File | Owns |
|---|---|
resources/tech-stack.md | Framework versions, Next.js 16 proxy.ts + React Compiler conventions, Server Actions vs TanStack Query mutation policy, optional provider examples |
resources/tailwind-rules.md | Design tokens, focus states, Tailwind v4 @theme syntax |
resources/snippets.md | React 19 hook patterns, TanStack Query/Form, a11y card |
resources/angular-rules.md | Angular standalone/OnPush/signals conventions, RxJS marble-test policy (MANDATORY for streams) |
To extend: add resources/<name>.md and append a row above.
../_shared/core/code-intelligence.md (code search/navigation)../../rules/frontend.mdresources/execution-protocol.mdresources/checklist.mdresources/error-playbook.md../_shared/core/context-loading.md../_shared/core/clarification-protocol.md../_shared/core/context-budget.md../_shared/core/lessons-learned.md (matching prior failure or requested retrospective)../oma-observability/SKILL.md §Integrations — Core Web Vitals, SSR→client trace propagation, INP profiling~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.