thumbgate-rules — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited thumbgate-rules (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Show the guardrails currently in force for this project: the auto-promoted prevention rules, the reliability rules, and the lessons they came from — so the user sees not just what is blocked but why.
This skill wraps existing ThumbGate capability and adds no new logic — it reads the live rule and lesson stores.
prevention_rules MCP tool (CLI fallback: npx thumbgate rules).get_reliability_rules to show which tool-call shapes are gated.search_lessons, so the user sees the origin, notjust the block.
their first one.
Field-by-field tool output and how rules map to lessons are in references/rule-stores.md.
Input: "what is ThumbGate protecting me from in this repo?"
Action: call prevention_rules + get_reliability_rules, enrich each with search_lessons, then:
| Rule / Gate | Blocks | From lesson | State |
|---|---|---|---|
| no-force-push-main | git push --force to main | overwrote a teammate's commit (2026-05) | active |
| verify-before-deploy | deploy without npm test | shipped a broken build | active |
npx thumbgate rulesreturns nothing because the lesson store is fresh.
npx thumbgate rules, then run thethumbgate-doctor skill to check wiring.
skill for fire counts and the thumbgate-doctor skill for hook installation.
prevention_rules (or the npx thumbgate rules fallback), not from memory.search_lessons so the user sees why.get_reliability_rules).~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.