oma-mobile — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited oma-mobile (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Build, modify, and verify cross-platform mobile application features with clean architecture, platform-appropriate UI, state management, performance, and E2E coverage.
resources/execution-protocol.md, examples, snippets, checklist, and screen template| Action | SSL primitive | Evidence |
|---|---|---|
| Inspect mobile architecture | READ | Domain/data/presentation files |
| Select state and platform strategy | SELECT | Riverpod/Bloc and platform constraints |
| Implement mobile code | WRITE | Widgets, screens, providers, clients |
| Validate lifecycle and permissions | VALIDATE | Dispose, permissions, offline behavior |
| Call verification tools | CALL_TOOL | Tests, builds, Maestro |
| Report result | NOTIFY | Final summary |
Use the configured code-intelligence provider to locate files and inspect symbols or content. For Serena, use find_file, search_for_pattern, get_symbols_overview, and find_symbol. Native search is limited to the provider exclusions and non-code paths permitted by the project's search policy.
Then run the project's mobile verification commands, typically unit/widget tests and Maestro E2E for critical flows.
| Scope | Resource target |
|---|---|
CODEBASE | Mobile source, tests, platform config |
LOCAL_FS | Templates, snippets, resources |
PROCESS | Build, test, emulator, simulator, E2E commands |
NETWORK | Backend APIs when the feature integrates remotely |
Apply framework, library, architecture, and data-model defaults only when the target project has no established choice. Scoped edits do not authorize a stack migration or unrelated infrastructure.
dispose() methodClient middleware.@MainActor @Observable view models (Observation framework, iOS 17+) — non-isolated VMs mutating observed state from a Task are a Swift 6 strict-concurrency errorHTTPBody), serve stale-while-revalidate on reads, invalidate keys on writes; view models depend on a protocol seam, not the concrete service (see variants/swift-ios/snippets.md §10)App/Core/Features/Shared project layout.task {} (auto-cancels on disappear) — never in deinit, which is nonisolated and cannot touch @MainActor state under Swift 6 (isolated deinit requires Swift 6.2+).toolbar(.hidden, for: .navigationBar)) lose it, so register push routes via a swipeBackDestination wrapper, not per-screen (see variants/swift-ios/snippets.md §9)variants/flutter/snippets.md §3, §10)staleTime/gcTime — invalidate affected query keys on every mutation, persist account-scoped cache to MMKV only when offline persistence is required; screens consume query/mutation hooks, never call axios directly (see variants/react-native/snippets.md)resources/execution-protocol.mdvariants/swift-ios/snippets.mdvariants/flutter/snippets.mdvariants/react-native/snippets.mdresources/checklist.mdresources/error-playbook.mdresources/tech-stack.mdvariants/swift-ios/tech-stack.mdvariants/flutter/tech-stack.mdvariants/react-native/tech-stack.mdresources/screen-template.dartresources/screen-template.swiftresources/screen-template.tsxvariants/swift-ios/api-template.swiftvariants/flutter/api-template.dartvariants/react-native/api-template.tsvariants/README.md../_shared/core/context-loading.md../_shared/core/clarification-protocol.md../_shared/core/context-budget.md../_shared/core/lessons-learned.md (matching prior failure or requested retrospective)../oma-observability/SKILL.md §Integrations — offline queuing, crash analytics, battery-aware sampling~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.