fdic-skill-builder-7a1907 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited fdic-skill-builder-7a1907 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Follow every phase in order. Do not skip phases. Do not write skill content before completing Phase 1.
Before writing a single line of skill content, verify every tool the skill will call.
Call each tool in the planned chain with a known-good institution (e.g., CERT 57 — JPMorgan Chase Bank). Record the full response. Save it for the reference file (Phase 3c).
Server fix required gate (hard dependencies): If any hard-dependency tool returns a field validation error or an unexpected error response, stop. Fix the server bug before proceeding. Skill content written against a broken hard dependency is useless.
Rule: A skill cannot describe a hard-dependency tool that the server cannot execute. Fix the server first, write the skill second.
For soft and context tools that are broken: you may continue drafting the skill, but all structuredContent paths for that tool must be marked [source-derived] in the reference file until a live response confirms them. Note the broken tool explicitly in the skill's dependency table and add a TODO to re-verify.
Field validation errors follow this pattern: "Invalid field 'FIELDNAME' for endpoint ENDPOINT". When you see one:
src/fdicEndpointMetadata.ts and search for the endpoint section.src/tools/shared/*.ts or the tool file directly).npm run typecheck && npm test to confirm no regressions.For every FDIC field string referenced in tool source files (CERT,NAME,ASSET,...), grep the catalog and confirm each field exists for its endpoint:
src/fdicEndpointMetadata.ts — authoritative catalog
src/fdicSchema.ts — validation layer (uses the catalog)Common typo classes found in this codebase:
NAMHCR → NAMEHCR (institutions endpoint, holding company name)LNOTH → not valid for the financials endpoint (was in CREDIT_FIELDS and UBPR_FIELDS)These rules govern how a skill must reason about FDIC data. Violating them produces silently wrong output.
| Data source | Date field | Format | Cadence | How to derive |
|---|---|---|---|---|
| Financials / UBPR | REPDTE | YYYYMMDD | Quarterly | Pass repdte param or omit for latest |
| SOD (branch/deposit) | YEAR | YYYY | Annual (June 30) | Most recent year where June 30 ≤ analysis date |
| Institution profile | n/a | n/a | Current only | fdic_get_institution is not date-scoped — always returns the current record |
Inactive institution `repdte` derivation: The institution record contains a REPDTE field in MM/DD/YYYY format. Convert it to YYYYMMDD before passing to financial tools. Do not use today's date.
Absolute date statements: Any output that mixes data from different date bases (e.g., financials at Q3 2024 and SOD at 2023) must state the basis date for each section explicitly. Never write "as of the latest period" without specifying which period.
Ambiguous name resolution is unresolved until CERT is confirmed. If a search returns multiple candidates, the institution is not yet identified. Do not pass names downstream — wait until the user has confirmed a specific CERT.
Inactive institution handling: Always check the ACTIVE field from fdic_get_institution. If ACTIVE: 0:
repdte from the institution's REPDTE field.Distinguish these in skill output — they have different meanings and should never be collapsed:
| State | Meaning | Correct representation |
|---|---|---|
| No data | The API returned zero records for this metric | State explicitly: "No data available for [metric]" |
| Not applicable | The metric structurally does not apply (e.g., HC profile for an independent bank) | State explicitly: "Not applicable — [reason]" |
| Tool failure | The tool returned an error or timed out | State explicitly: "Tool error — [tool name]" and degrade per tier |
Never use "n/a" as a catch-all that merges all three states.
Every tool in a skill chain must be assigned a tier before the skill is written:
| Tier | Definition | On failure |
|---|---|---|
| Hard | Report cannot be produced without this data | Stop and report the error; do not produce partial output |
| Soft | Report degrades but remains useful | Omit the section; note the omission in the report |
| Context | Enriches the report; not load-bearing | Silently omit if unavailable |
Document the tier assignment in the skill's dependency table (or prose) so future editors know the intent.
A section in the output can be in one of three states. These map directly to the three outcome states in Phase 2 — do not collapse them:
Skills that reference structuredContent paths must use exact, verified paths from live tool responses. Do not guess or derive paths from text output alone.
Rules:
[live] before the skill ships.[source-derived] paths derived from TypeScript interfaces in src/tools/*.ts. Mark the tool as broken in the dependency table and add a TODO to re-capture once fixed.references/tool-output-shapes.md for verified paths for all analysis and comparison tools.Skills orchestrate; servers compute.
Run in this exact order. Do not skip steps.
Before running any tests, confirm that all tools in the skill chain return valid responses. If Phase 1 uncovered bugs and they were fixed, re-run the live probes now to confirm.
npm run typecheckMust pass clean. Fix all errors before proceeding.
npm testAll tests must pass. If a pre-existing failure exists, explicitly verify at execution time that it is unrelated to your changes (check the test name, file, and failure message against your diff). Do not carry forward a blanket waiver — re-confirm at each run.
Invoke the skill with a known-good institution and a known-inactive institution. Verify:
After the skill is working, update the docs to match.
docs/tool-reference.md — add the skill to the Claude Code Skills table if it introduces a new skill; update any tool coverage claims that changeddocs/index.md — update hero panel and "Browse by need" cards if a new skill was addeddocs/prompting.md — add a skill card if the skill warrants user discoverydocs/usage-examples.md — add one representative example of the skill in usedocs/prompting-guide.md — update any coverage claims if tool count changedNAMHCR for NAMEHCR).structuredContent shape, not the text rendering.MSA <code>) or Non-MSA / Rural, not by MSA name.references/tool-output-shapes.md — verified structuredContent paths for all analysis and comparison tools used in deep-dive style skills~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.