refactor-code — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited refactor-code (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when the task is to change structure without changing intended behavior.
Core principle: Small, reversible steps over large rewrites. Separate design improvement from behavior change.
| Step | Action | Verification |
|---|---|---|
| 1 | Define stable behavior | Written statement of what must not change |
| 2 | Add characterization tests | Tests pass on current code |
| 3 | Choose smallest safe slice | One boundary at a time |
| 4 | Rename, move, or extract | Tests still pass |
| 5 | Remove compatibility shims | Tests still pass, new path proven |
NO REFACTORING WITHOUT CHARACTERIZATION TESTS FIRST.
NEVER mix behavior changes with structural refactors in the same step —
if behavior changes are also needed, complete the structural refactor first,
then apply behavior changes in a separate step with its own test.
ONE boundary per refactoring step — never extract two abstractions in the same step.
If a public interface changes, document the compatibility shim and its removal condition.
NEVER fabricate test output — label only actual run output as Observed output.Identify the exact inputs and outputs of the logic being refactored. Keep public interfaces stable until callers are migrated. Prefer adapters, facades, or wrappers for transitional states.
Include in your output:
Write this before touching any production file. No refactoring step begins until this test exists and passes on the current (un-refactored) code. If the characterization spec fails, do not continue — stop and fix the test or the behavior mismatch.
# spec/requests/orders_spec.rb (or service/model spec — mirror the file being refactored)
# frozen_string_literal: true
RSpec.describe "Orders#create current behavior", type: :request do
describe "POST /orders" do
let(:valid_params) { { order: { product_id: 1, quantity: 2 } } }
it "creates order and enqueues warehouse notification" do
expect { post orders_path, params: valid_params }
.to change(Order, :count).by(1)
expect(NotifyWarehouseJob).to have_been_enqueued
end
end
endRun it: bundle exec rspec spec/requests/orders_spec.rb — it must pass on the current code.
Good first moves include: renaming unclear methods, isolating duplicated logic behind a shared object, or wrapping external integrations before moving call sites. Add narrow seams before deleting old code paths. One boundary at a time — characterization tests first, verification after each step.
Extract, move, or rename logic. Stop and simplify if the refactor introduces more indirection than clarity.
#### Minimal Inline Example (Controller orchestration extraction) Before:
def create
order = OrderCreator.new(params).call
NotifyWarehouseJob.perform_later(order.id)
redirect_to order_path(order)
endAfter:
def create
order = Orders::CreateOrder.call(params: params)
redirect_to order_path(order)
endLoad these files only when their specific content is needed:
answer.md showing plan, stable behavior, characterization tests, step-by-step verification runs, and final suite verification command outputs.Run verification after every refactoring step:
Report test run output at EACH step — not only at the end. At least two separate Observed output entries at different sequence points are required.
Evidence labelling rules: Label actual run output as Observed output only. Never use labels such as "Expected output", "Required output", "Planned output", or "Must produce 0 failures" as substitutes for actual observed run output. If you have not run the tests, you have no observed output to report.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.