apply-stack-conventions — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited apply-stack-conventions (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
| Stack area | Default convention |
|---|---|
| Rails MVC | Thin controllers; move non-trivial business logic into service objects |
| PostgreSQL | Avoid N+1s with includes; use database constraints for integrity |
| Hotwire | Prefer Turbo Frames/Streams before Stimulus; only reach for Stimulus when Turbo cannot handle the interactivity |
| Tailwind | Use utilities in views; extract repeated UI into partials/components |
| Auth | Apply Devise authentication and Pundit authorization to every action that touches access-controlled resources |
All new code must have its test written and validated before implementation. Follow this exact cycle for every layer:
bundle exec rspec spec/[path]_spec.rb — verify it FAILS (Observed RED output)CRITICAL: Execute all test commands using your shell/terminal tools. Do not fabricate, mock, or simulate terminal output. Copy-paste the actual observed output. If the environment does not support running tests, stop and tell the user — do not proceed to implementation without verified RED output.
Spec file — `spec/models/order_spec.rb`
require 'rails_helper'
RSpec.describe Order, type: :model do
describe 'validations' do
it 'is invalid without a total' do
order = build(:order, total: nil)
expect(order).not_to be_valid
expect(order.errors[:total]).to include("can't be blank")
end
end
endRun command
bundle exec rspec spec/models/order_spec.rbObserved RED output — paste actual terminal output here (expect failure)
Model implementation — `app/models/order.rb`
class Order < ApplicationRecord
validates :total, presence: true
endObserved GREEN output — paste actual terminal output here (expect pass)
Stack: Ruby on Rails, PostgreSQL, Hotwire (Turbo + Stimulus), Tailwind CSS.
Style: If the project uses a linter, treat it as the source of truth for formatting. For cross-cutting design principles (DRY, YAGNI, structured logging, rules by directory), use apply-code-conventions.
For a typical feature, compose stack patterns in this order:
includes for any association used in loopsturbo_stream and html formats<turbo-frame> tags; broadcast turbo_stream responses from the controllerEach step should remain testable in isolation before wiring to the next layer. In the final artifact, include a Layer isolation section naming the focused spec or check for model/query, service, controller/request, view/Turbo, Stimulus, and Tailwind. If a layer is not changed, mark it "not applicable"; do not silently omit any layer.
Controllers delegate to a service via .call; the service returns a result hash. See create-service-object and assets/snippets/service_object.rb for the full pattern and implementation details.
# app/controllers/orders_controller.rb
def create
result = CreateOrderService.call(order_params)
if result[:success]
redirect_to result[:record], notice: 'Order created.'
else
render :new, status: :unprocessable_entity
end
endFor eager loading patterns and N+1 fixes, see the Extended Resources section below.
| Issue | Correct approach |
|---|---|
| Controller action with 15+ lines of business logic | Extract to a service object using the .call pattern |
| Accessing a protected resource without an authorisation check | Apply a Pundit policy on every action that touches access-controlled data |
Every response must include these sections in order:
Load these files only when their specific content is needed:
| Skill | When to chain |
|---|---|
| apply-code-conventions | For design principles, structured logging, and path-specific rules |
| code-review | When reviewing existing code against these conventions |
| create-service-object | When extracting business logic into service objects |
| write-tests | For testing conventions and full red/green/refactor TDD cycle |
| review-architecture | For structural review beyond conventions |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.