apply-code-conventions — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited apply-code-conventions (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Style source of truth: Style and formatting defer to the project's configured linter(s). This skill adds non-style behavior and architecture guidance only. For Hotwire + Tailwind specifics, see apply-stack-conventions.
| Topic | Rule |
|---|---|
| Principles | DRY, YAGNI, PORO where it helps, CoC, KISS |
| Comments / tags | Explain why; tagged notes need actionable context |
| Logging | First arg: static string; second arg: hash with event: key; no interpolation; backtrace on errors |
| Deep stacks | Chain apply-stack-conventions → domain skills (services, jobs, RSpec) |
TESTS GATE IMPLEMENTATION:
When this skill guides new behavior, the tests gate still applies:
PRD → TASKS → TEST (write, run, fail) → IMPLEMENTATION → …
No implementation code before a failing test. See write-tests.When reviewing or refactoring Rails code, follow this sequence. Each step maps to a required checkpoint in your output.
.rubocop.yml or .standard.yml), run the appropriate tool, note absence if none found. Output: linter detected (or absent); style defers to it.Rails.logger calls use static strings + structured hashes with an event: key, plus backtrace for errors. Output: apply structured logging rules from Sub-Rules below.TODO:, FIXME:) have actionable context (owner, ticket). Output: apply comment discipline rules from Sub-Rules below.Language: English unless explicitly requested otherwise.
Comment why, not what. Tags — TODO: / FIXME: / HACK: / NOTE: / OPTIMIZE: — must carry actionable context (owner, ticket, next step). Naked tags fail review.
# BAD — naked tag, no context
# TODO: fix this
# GOOD — TODO with next step + dependency
# TODO(jsmith, JIRA-1234): replace TIER_RATES with DB-backed lookup once billing API v2 is stable.*MANDATORY SHAPE — every `Rails.logger.` call uses exactly two positional arguments.**
Rails.logger.<level>(static_string_message, { event: "dot.namespaced", ...domain_fields })
# GOOD — error path with backtrace
rescue StandardError => e
Rails.logger.error("order.processing_failed", {
event: "order.processing_failed",
error: e.message,
backtrace: e.backtrace.first(5).join("\n")
})
raise
endevent:.| Area | Path pattern | Guidance |
|---|---|---|
| ActiveRecord performance | app/models/**/*.rb | Eager load in loops; prefer pluck / exists? / find_each. |
| Controllers | app/controllers/**/*_controller.rb | Strong params; thin actions → services; IDOR / PII → security-check. |
| RSpec | spec/**/*_spec.rb | FactoryBot; let > let! unless eager setup required. |
| Service objects | app/services/**/*.rb | Single responsibility; .call / injected deps. |
| Background jobs | app/jobs/**/*.rb / app/workers/**/*.rb | Idempotency, retries, queue choice, and side-effect boundaries → implement-background-job. |
let_it_be (test-prof)Only recommend let_it_be if test-prof is already in Gemfile.lock. Otherwise default to let; reach for let! only when lazy evaluation would break the example. Don't introduce test-prof unless asked.
Load these files only when their specific content is needed:
Document which assets were loaded and why in your output so the process is verifiable.
| Skill | When to chain |
|---|---|
| apply-stack-conventions | Stack-specific: PostgreSQL, Hotwire, Tailwind |
| model-domain | When domain concepts and invariants need clearer Rails-first modeling choices |
| create-service-object | Implementing or refining service objects |
| implement-background-job | Workers, queues, retries, idempotency |
| write-tests | Spec style, tests gate (red/green/refactor), request vs controller specs |
| security-check | Controllers, params, IDOR, PII |
| code-review | Full PR pass before merge |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.