fai-feature-flag-ai — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited fai-feature-flag-ai (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Safely ship AI capabilities with controlled exposure and fast rollback.
{
"flag": "ai_summarization_v2",
"enabled": false,
"rollout": {
"percentage": 5,
"strategy": "sticky-user",
"segments": ["internal", "beta-customers"]
},
"kill_switch": true,
"expires_on": "2026-12-31"
}| Stage | Traffic | Gate |
|---|---|---|
| Canary | 1-5% | No critical safety or latency regressions |
| Beta | 10-25% | Quality metrics stable |
| Broad | 50-100% | Cost and reliability within targets |
if (!flags.isEnabled('ai_summarization_v2', userContext)) {
return fallbackSummary(text);
}
return aiSummary(text);| Check | Expected |
|---|---|
| Kill switch works | Immediate disable in runtime |
| Sticky assignment | User sees stable variant |
| Audit log | Flag changes recorded |
| Expiry policy | Old flags cleaned up |
| Issue | Cause | Fix |
|---|---|---|
| Inconsistent user experience | Non-sticky assignment | Enable sticky strategy by user id |
| Flag debt accumulation | No expiry process | Add expires_on and monthly cleanup |
| Unsafe full rollout | Missing gates | Enforce promotion checks before percentage increase |
# Example verification sequence
npm run lint
npm test
npm run build{
"quality_gate": {
"required": true,
"min_score": 0.8,
"block_on_failure": true
}
}| Control | Requirement |
|---|---|
| Secret handling | No plaintext secrets in repo |
| Access model | Least privilege role assignments |
| Logging | Redact sensitive data before persistence |
| Auditability | Keep immutable trace of critical actions |
| Symptom | Likely Cause | Recommended Action |
|---|---|---|
| Validation gate failures | Threshold too strict or wrong baseline | Recalibrate using a fixed reference dataset |
| Unexpected regressions | Missing scenario coverage | Add targeted regression tests and rerun |
| Production-only issues | Environment mismatch | Diff environment config and identity settings |
| Slow recovery during incidents | Unclear ownership/runbook steps | Add explicit owner and sequence in runbook |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.