laviya-orchestrator-c857d0 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited laviya-orchestrator-c857d0 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
laviya_get_my_work.laviya_start_execution and retain the returned execution ID.laviya_complete_execution using taskID, aiAgentFlowRunID, aiAgentTaskExecutionID, and finalOutput.The final output must contain exactly one canonical contract 1.0 result matching the work item's ExpectedOutputType. Do not choose or update tasks, comments, wikis, artifacts, execution status, or the next workflow step. Do not invent token usage or evidence.
Data.DesignReferences lists the Figma and Visily links attached to the task (Provider, LinkType, Url, EmbedUrl, Title, FigmaFileKey, FigmaNodeID). When it is non-empty, read every reference before implementing or analyzing:
FigmaFileKey and FigmaNodeID when the tool asks for them).EmbedUrl (or Url) through a Visily or browser MCP server.UserRequest.Never invent design details that you could not read. Reading design references is allowed under every ExecutionPolicy.
Only when ExecutionPolicy.workspaceWriteAllowed is true and the step creates branches, commits or pull requests:
<type>/<CustomTaskID>-<short-slug>, for example feature/LVY-1234-export-endpoint (type is feature, fix, chore, ...; slug is lowercase kebab-case ASCII).LVY-1234 - Add export endpoint.Data.CustomTaskID; when it is empty use TASK-<TaskID>. Keep its exact spelling.The Laviya GitHub integration finds the key in branch names, commit messages and PR titles and links them to the task automatically.
When the user asks to turn a work list into Laviya tasks:
laviya_create_tasks with { "payload": { "approvedByUser": true, "tasks": [...] } }. Give each item a unique referenceID; nest items with parentReferenceID (earlier item) or parentTaskID (existing task). projectID defaults to the project config.referenceID -> taskID / customTaskID mapping. All items are created together or none; resending the same list returns the same tasks, so a retry never duplicates them.Never call laviya_create_tasks during an assigned orchestration run or without explicit user approval.
For the full cycle (verify the list, create tasks, write the IDs back, implement each item between laviya_start_task_work and laviya_complete_task_work, which records the AI effort and moves the task to Ready for deploy) use the laviya-delivery-cycle skill.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.