next 100/100 — SaferSkills

Is next safe to install?

SaferSkills independently audited next (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/next/SKILL.md · 1 file

skills/next/SKILL.md1.8 KB · Markdown

name: next

description: Use when you want to execute the next unfinished task from ./PLAN.md in a fresh, focused session — reads only that task's files, implements, verifies with evidence, ticks the box, reports a closure summary, then stops.

disable-model-invocation: true

Execute the next unfinished task from ./PLAN.md. One task, then stop.

Read PLAN.md, find the first unchecked [ ] task.
Read ONLY the files listed under that task's "Files" (plus what they

directly need). Do not load the whole repo.

Implement just that task — nothing borrowed from later tasks.
Verify against "Done when…" with real evidence. Actually run the relevant

test / command / check and look at the output — do not assume it passed.

If it does NOT pass: leave the box UNCHECKED, append a one-line blocker

note under the task, and stop. Never tick a box you could not verify.

Only if verification passed, update PLAN.md: tick the box and append a

one-line result note, e.g. - [x] T1 — … ✔ <what was done>.

If a durable decision/convention emerged, add it to the project's CLAUDE.md.

Durable = a rule still true many sessions from now. Do NOT put transient state, one-off values, paths, or results in CLAUDE.md (those go in the task note, HANDOFF.md, or an append-only WORKLOG.md).

Print a closure summary before stopping:

Changed files — if this is a git repo, run git diff --stat; otherwise

list them.

The exact command(s) you ran to verify, and their result.
A one-line suggested commit message. (Do NOT commit unless asked.)

STOP. Summarize in 2-3 lines and tell the user to open a fresh session and

run this skill again for the next task. Do NOT continue to the next task in this conversation.

If context grows long before finishing, write HANDOFF.md and stop.

next— agent skill

Is next safe to install?

Audit the pieces. Scan the whole. Decide.