adept-contributing-35f159 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited adept-contributing-35f159 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are working on the adept CLI itself (Go 1.25, module github.com/itaywol/adeptability). Read AGENTS.md for architecture and invariants; this skill is the operational checklist.
go build ./...
go build -o /tmp/adept ./cmd/adept && /tmp/adept --helpgofmt -l . # must print nothing → fix with: gofmt -w .
go vet ./...
golangci-lint run # config: .golangci.yml
go test -race ./...
go test -run E2E ./cmd/adept # end-to-end against a freshly built binaryIf any gate fails, fix it before pushing — CI runs the identical set on ubuntu/macos/windows.
| You're changing… | Go there |
|---|---|
| public types / interfaces / sentinel errors | pkg/adept/ (types only — no behavior) |
| canonical field shape | pkg/adept/ struct tags and pkg/adeptschema/*.schema.json together |
| a command | internal/cli/commands_*.go; wire deps in internal/cli/deps.go |
| a harness renderer | internal/render/<id>/ + golden fixtures in its testdata/ |
| sync / drift logic | internal/harness/orchestrator.go |
| 3-way merge | internal/merge/ |
| safety scanner | internal/scan/ |
feat: → minor · fix:/perf: → patch · feat!:/BREAKING CHANGE: → major · refactor:/docs:/chore:/test:/ci: → no release. The squash-merge title becomes the changelog entry, so write it well.
fmt.Errorf("doing X: %w", err). Match with errors.Is againstthe sentinels in pkg/adept/errors.go — never on error strings. Add new sentinels there.
init() side effects: dependencies flow through *Deps.fixtures in the same PR when output changes, and say why in the message.
CHANGELOG.md, .release-please-manifest.json, or version strings —release-please owns them.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.