ordito-detect-stale — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ordito-detect-stale (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Ordito の 読み出しスキル。IR ストアを走査し、未反映ページ（成果物が IR より古い）を一覧する（§3.4）。
ordito-update-block）の後、「反映（再生成）しますか？」の確認材料として未反映の件数・対象を提示するとき。ordito-generate）の only:"stale" の前段の確認に。{ "ir_dir": "samples/ir" }ir_dir(任意)。省略時はリポジトリルートの ordito.config.json の irDir（無ければ samples/ir）で解決する。
{ "ok": true, "total": 5, "stale_count": 1,
"stale": [ { "id": "guides/quickstart", "file": "...", "updated_at": "…", "generated_at": "…" } ] }generated_at が null（未生成）も未反映に含む。
注: 未反映判定は時刻比較（updated_at > generated_at）。ordito-generateはgenerated_at = max(now, updated_at)で 押印するため、updated_atがマシン時計より未来でも生成後に未反映は解消する（クロックスキュー耐性）。 時刻はミリ秒精度で、連続した update→generate を正しく順序づける。
echo '{}' | node "${CLAUDE_SKILL_DIR}/detect-stale.js"~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.