grovs-create-link — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited grovs-create-link (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
path auto-generates from name — don't ask for it unless the user cares about the URL slug.data is the JSON payload the app receives on open. If the user says "link to the product page," ask what data their app needs to navigate there (e.g., {"screen": "product", "id": "123"}).campaign_id assigns the link to a campaign. If the user mentions a campaign by name, look up its numeric ID with list_campaigns first.User: "Create a link for our Summer Sale, it should go to the promo screen"
create_link(
project_id: "p_m9f",
name: "Summer Sale",
data: {"screen": "promo", "sale_id": "summer-2026"},
tags: ["marketing", "summer-2026"]
)
→ URL: https://foodies.grovs.io/summer-saleUser: "Create a link for the Summer Sale campaign"
1. list_campaigns(project_id: "p_m9f", term: "Summer Sale") → finds campaign_id: 42
2. create_link(
project_id: "p_m9f",
name: "Summer Sale Banner",
campaign_id: 42,
data: {"screen": "promo"}
)
→ URL: https://foodies.grovs.io/summer-sale-banner (assigned to campaign 42)If the campaign doesn't exist yet and they're creating several related links, create it first:
create_campaign(project_id: "p_m9f", name: "Summer Sale 2026") → campaign_id: 42
create_link(..., campaign_id: 42) → first link
create_link(..., campaign_id: 42) → second linkpath slug must be unique per project. Suggest a different slug or let it auto-generate by omitting path.image_url → must be a valid URL (schema uses z.url()).Suggest anything the user skipped that would help:
Every Grovs tool returns human-readable formatted text. Don't reformat — just present and add context.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.