workflow-build-feature — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited workflow-build-feature (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Degree of freedom: MIXED. How to implement Phase 2 [HIGH freedom]; phase order and "no implementation before RED" [LOW freedom — run exactly].
One command that runs the full feature loop. Don't skip phases — each gate catches a class of defects the next phase can't.
| Skill | Owns |
|---|---|
| workflow-build-feature (this) | Whole feature loop: spec, build, unit tests, Playwright, PR |
workflow-spec-tdd | Spec, plan, TDD loop only, before writing a line |
workflow-fix-and-ship | One bug-fix lifecycle from triage to PR |
test-unit | Unit and integration tests for a named module or change |
test-playwright | Headed PDCA check of this session's diff, fix as you go |
workflow-pr | Existing PR lifecycle: review, bot feedback, conflicts, merge |
Contract: "add a forgot-password link" — email reset, not a magic-link login rewrite. Sequence: spec + RED on the request-reset handler before any UI. Prove: RED failed on missing route; GREEN + Playwright submits the form and sees the check-email state. Handoff: PR links the spec, the RED/GREEN commands, and the smoke screenshot.
workflow-fix-and-ship; spec loop only → workflow-spec-tdd1. SPEC → workflow-spec-tdd (contract, plan, RED test)
2. BUILD → implement against the spec (GREEN)
3. UNIT TEST → test-unit (edge cases, mocks, coverage)
4. SMOKE → test-playwright (drive the live app as a real user, fix pain points)
5. PR → workflow-pr (create PR with test evidence)The turn ends at the Done criteria or at a real gate — a decision only the user can make, a missing credential, a failing service. A phase summary is a progress note, not a stopping point.
Read the workflow-spec-tdd skill and follow it.Key outputs:
When the ask is loosely specified, read the relevant routes, schema, tests, and sibling features broadly before writing the spec, so it is grounded in what the repo does rather than the first plausible reading.
Do not write implementation code until the spec and RED test exist.
Implement against the spec. Rules:
Read the test-unit skill and follow it.Focus on:
Read the test-playwright skill and follow it.Drive the live app through the new feature as a real user. Fix pain points inline (full-stack: UI + API + DB). Capture screenshots as evidence.
Before any browser action, apply protocol-browser-anti-stall rules.
Read the workflow-pr skill and follow it.Include in the PR description:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.