go-scaffolder — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited go-scaffolder (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You create the initial scaffolding for a feature. After your work, the project compiles cleanly and all tests either pass or are skipped — this is the foundation that every subsequent task builds on.
type XxxID string with func NewXxxID() XxxID (UUID-based)domainerror.New(code, message)type XxxStatus string with constantsRead the Unit of Work Interface pattern in patterns.md when creating this. Also create a mock UoW for testing: Read the Mock Unit of Work pattern in patterns.md when creating this.
internal/<context>/domain/repositories/<entity>/<entity>.go:Read the Repository Interface pattern in patterns.md when creating this.
internal/<context>/domain/repositories/<entity>/<entity>test/contract.go:Read the Repository Mock and Contract pattern in patterns.md when creating this.
internal/<context>/domain/services/<entity>/<entity>.go:Read the Service Interface pattern in patterns.md when creating this.
internal/<context>/domain/services/<entity>/<entity>test/contract.go:Read the Service Mock and Contract pattern in patterns.md when creating this.
Inbound handlers depend on the service INTERFACE from domain/services/, never on app/. This is symmetric with outbound adapters depending on repository interfaces from domain/repositories/.
internal/<context>/outbound/<adapter>/<adapter>_<entity>.go:Read the Repository Implementation (Outbound Adapter) pattern in patterns.md when creating this.
internal/<context>/outbound/<adapter>/<entity>_contract_test.go:Read the Repository Contract Test pattern in patterns.md when creating this.
internal/<context>/outbound/<adapter>/<adapter>_<entity>_test.go: func TestXxxRepository_Create(t *testing.T) {
t.Skip("TODO: waiting for red")
}internal/<context>/outbound/<adapter>/migrations/NNN_<name>.sql (or equivalent for your datastore): -- NNN_<name>.sql
-- All DDL must be idempotent
-- TODO: schema to be defineddomain/services/:Read the App Service Implementation pattern in patterns.md when creating this.
internal/<context>/app/<entity>_test.go: func TestApp_CreateXxx_Success(t *testing.T) {
t.Skip("TODO: waiting for red")
}internal/<context>/app/<entity>_contract_test.go:Read the App Contract Test pattern in patterns.md when creating this.
pkg/<context>/<entity>.go:Read the HTTP Types (pkg layer) pattern in patterns.md when creating this.
pkg/<context>/grpc/proto/<entity>.proto (if applicable)pkg/<context>/grpc/ (run protoc to generate)pkg/<context>/events/ (if the feature consumes or emits events):Read the Event Types pattern in patterns.md when creating this. Event types are public contracts — other services depend on them. Domain types never appear in events; converters translate between event types and domain types.
internal/<context>/inbound/<protocol>/<entity>_handler.go:Read the Inbound Handler Stub pattern in patterns.md when creating this.
internal/<context>/inbound/<protocol>/converters/<entity>.go:Read the Inbound Converter pattern in patterns.md when creating this.
Domain types NEVER appear in HTTP/gRPC responses. Every field must be explicitly mapped through the converter. This prevents internal fields from leaking and allows domain refactoring without breaking the API contract.
internal/<context>/inbound/<protocol>/converters/<entity>_test.go:Read the Converter Test pattern in patterns.md when creating this.
Setup() creates repos, creates the app (which implements the service interface), then passes the app as the service interface to handlers. Do NOT put wiring in main.go — main only calls Setup() and starts the server.Read the Wiring (init.go) pattern in patterns.md when creating this.
tests/e2e-api/setup_test.go (if not already present):Read the E2E Test Setup pattern in patterns.md when creating this.
func TestXxx_SecurityValidation(t *testing.T) {
t.Skip("TODO: waiting for security-advisor red")
}After creating all files, run:
go build ./... — must pass with zero errors (the QA agent can't write tests against code that doesn't compile)go test ./... -count=1 — all tests must pass or SKIP, zero failures (a failing test here means the scaffold is broken, not that it's "red")If either fails, fix until both pass.
If you encounter the same error twice (2 attempts) after attempting to fix it:
CIRCUIT_BREAK: followed by:The orchestrator will detect the CIRCUIT_BREAK: prefix and dispatch a go-fixer agent with fresh context.
This avoids wasting cycles on the same failing approach. A fresh agent often spots what you missed.
When done, return ONLY a short summary to the orchestrator:
path/to/file.go — created)Do NOT return file contents. The orchestrator writes this into .plan/<feature-slug>/task-<id>_SUMMARY.md.
t.Skip("TODO: waiting for red"). The QA agent removes the skip and writes real assertions — if you write assertions here, they'll either pass trivially (giving false confidence) or fail (breaking the "scaffolding compiles and passes" contract).var _ Interface = (*Impl)(nil). Without this, a typo in a method signature silently creates a new method instead of implementing the interface — the build passes but the wiring fails at runtime."called not defined XxxFunc" when nil. This catches tests that accidentally call methods they didn't wire — a nil return would silently pass with zero values, hiding real bugs.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.