sdd-workflow — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sdd-workflow (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this owner for change work. SDD is the spine; TDD is embedded inside the accepted spec.
Do not start implementation until the user-visible gates are aligned.
grill-me for pressure questions, prototype for disposable proof, and product-capability for implementation constraints when useful. Do not require a standalone brainstorming skill.effective-interact for material work, with changes, evidence, validation, risks, and next actions.During implementation, update the active task's Spec updates only for decision-level changes that alter assumptions, acceptance criteria, allowed paths, validation commands, user-visible behavior, or risk. Do not turn it into a progress log; progress belongs in the harness progress file when a repo harness is active.
When .harness-hub/state/ exists, persist the plan before implementation instead of relying on chat memory:
current-task.md: goal, assumptions, non-goals, allowed paths, forbidden paths, discovery/brainstorming, target spec, P0/P1/P2 test matrix, validation commands, open questions, alignment status, and checkpoint policy.decisions.md: accepted direction, rationale, rejected alternatives, and any decision-level changes.progress.md: current phase, completed work, validation records, runtime signals, blockers, PR status, and checkpoint commit state.session-handoff.md: restart status, changed files, validation evidence, residual risk, and next action before ending the session.Ask only blocking open questions before implementation. A blocking question is one whose answer changes user-visible behavior, safety, data ownership, compatibility, cost, release/rollback behavior, external side effects, allowed paths, or acceptance criteria.
Use helpers only under this owner:
product-capability for implementation-ready constraints.doc-coauthoring for PRDs, RFCs, proposals, specs, or decision records that need collaborative drafting before implementation.tdd-workflow for test-first implementation detail.claude-api for Anthropic API or SDK changes; verify current provider docs before writing code.mcp-builder for MCP server, tool schema, resource, prompt, or evaluation work.skill-creator for standard skill creation or adaptation inside a change.theme-factory when an accepted artifact needs visual theming; use frontend-design for production UI.slack-gif-creator only for explicit Slack GIF deliverables.e2e-testing when user-visible flows require durable browser checks.verification-loop before delivery.effective-interact for alignment and handoff artifacts.Use subagents only for independent source gathering, docs lookup, review, verification, or disjoint write scopes. Follow workflow-router/references/orchestration-policy.md: the main agent owns final synthesis and user-facing conclusions, and hooks stay advisory until separately approved.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.