bat-adhoc — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited bat-adhoc (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Bot acceptance testing validates that MCP tools work correctly from a real AI agent's perspective. You design test scenarios dynamically, run them via tests/uat/run_uat.py, and evaluate results.
uv run python tests/uat/run_uat.pyall_passed per agent. If true, you're done.results_file for full output, stderr, raw JSON--branch master to compareThe runner returns a concise summary to stdout (saves context when all passes):
{
"results_file": "/tmp/bat_results_abc123.json",
"agents": {
"gemini": {
"all_passed": true,
"test": {
"completed": true,
"duration_ms": 8100,
"exit_code": 0,
"num_turns": 5,
"tool_stats": { "totalCalls": 4, "totalSuccess": 4, "totalFail": 0 }
},
"aggregate": {
"total_duration_ms": 15300,
"total_turns": 12,
"total_tool_calls": 9,
"total_tool_success": 9,
"total_tool_fail": 0
}
}
}
}num_turns, tool_stats (per phase) for fine-grained comparisonoutput (plus tool_trace when tool calls were logged); a failed phase also includes stderr when it is not emptyresults_filecat <<'EOF' | uv run python tests/uat/run_uat.py --agents gemini
{
"setup_prompt": "Create a test automation called 'bat_error_test' with a time trigger at 23:59 and action to turn on light.bed_light.",
"test_prompt": "Try to get automation 'automation.nonexistent_xyz'. Report if the tool signaled an error or returned a normal response. Then get automation 'automation.bat_error_test' and report its structure.",
"teardown_prompt": "Delete automation 'bat_error_test' if it exists."
}
EOFRun the same scenario twice from the branch checkout and compare stats. --branch master installs ha-mcp from master on GitHub; omitting --branch runs the local code, which also covers unpushed commits:
# Baseline: master
uv run python tests/uat/run_uat.py --scenario-file <scenario.json> --branch master --agents gemini
# Target: local code
uv run python tests/uat/run_uat.py --scenario-file <scenario.json> --agents geminiTo compare a pushed branch that is not checked out, pass --branch <branch> for the target run too.
Compare these metrics:
Primary (decide pass/fail on these):
aggregate.total_tool_calls vs total_tool_failSecondary (report but don't decide on these alone):
aggregate.total_tool_calls, aggregate.total_turns — directional signal, not conclusive (agent exploration varies between runs)aggregate.total_duration_ms — noisy due to network, cache misses, server load. Only flag large (>2x) regressions.Robustness tip: Ask the same task in different ways (variation testing) to check if results are consistent across phrasings.
Each scenario invocation costs API credits (one per agent per phase). Design scenarios efficiently:
When /bat-adhoc is invoked with arguments:
If arguments contain a scenario description, generate the JSON scenario and run it:
/bat-adhoc test automation create with sunrise trigger then modify to sunset→ Generate appropriate scenario JSON and execute
If `--help` or no arguments, show this help text.
Otherwise, treat $ARGUMENTS as instructions for what to test and design+run the scenario accordingly.
For complete CLI reference and output format, see tests/uat/README.md.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.