ordito-validate — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ordito-validate (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Ordito の検証スキル(§6 二層のうち機械チェック層+未マップ検出)。読み出しのみ。
field_map 網羅(§4.4)を満たすか確認。out を渡すと生成済みページの本文フラグメントを許可リスト照合(§6.1)+ IR 忠実度(§6.2 の決定論版)で確認。{ "doc": "guides/quickstart", "ir_dir": "samples/ir", "out": "site", "contract": "reference/templates/dev-docs-standard/contract.json" }doc(任意): 省略時は ir_dir 内の全 IR。ir_dir / out / contract(任意): 省略時は ordito.config.json(irDir / out / template)で解決。out があれば生成済み HTML の機械チェック+忠実度も実施。contract 既定は config の template → 無ければ標準テンプレートの契約。{ "ok": true, "checked": 1, "results": [
{ "id": "guides/quickstart",
"ir_schema": { "ok": true, "errors": [] },
"fieldmap": { "ok": true, "warnings": [] },
"mechanical": { "ok": true, "violations": [] },
"fidelity": { "ok": true, "warnings": [] } } ] }# ir_dir / out を ordito.config.json で解決する場合は空入力でよい
echo '{}' | node "${CLAUDE_SKILL_DIR}/validate.js"~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.