ordito-generate — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ordito-generate (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Ordito の 読み出し（生成）スキル（§7.2）。明示トリガーで成果物を生成し、meta.generated_at を進める（§5.4）。
ordito-detect-stale の結果を見せて確認を取ってから。ordito-update-block）。{ "collection": "samples/collection.json", "out": "site",
"only": "stale", "mode": "deterministic", "ir_dir": "samples/ir", "ai_cache": "site/ai-fragments" }collection / out(出力先): 入力で渡すか、省略時は ordito.config.json の collection / out で解決（どちらも無ければエラー）。only(任意): ["guides/quickstart", …]（id 指定）か "stale"（未反映のみ, §3.4）。省略時は全ページ。mode(任意, 既定 deterministic): deterministic / mixed(構造化=決定論・散文=AI) / ai。ai_cache(任意): mixed/ai 用の L2 断片ディレクトリ。{ ok, trigger:"explicit", mode, out, generated:[id…], generated_at, results:[{id,via,valid,warnings}], note } 生成された各ページの IR の generated_at が更新され、ordito-detect-stale から外れる。
# collection/out を ordito.config.json で解決する場合は省略可
echo '{"only":"stale"}' | node "${CLAUDE_SKILL_DIR}/generate.js"~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.