workflow-coding-discipline — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited workflow-coding-discipline (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Four guardrails to apply on every non-trivial coding task. Bias toward caution over speed. For trivial one-liners (typo fixes, obvious renames), use judgment — not every change needs full rigor.
If a project's own rules contradict any guideline below, the project rules win.
Don't assume. Don't hide confusion. Surface tradeoffs.
Before writing code:
Anti-pattern: Reading an ambiguous request, picking one interpretation, building 200 lines, then discovering the user meant something else.
Minimum code that solves the problem. Nothing speculative.
try/catch, ?. chains, or Array.isArray() guards as the primary fix — those are symptom suppressors. Fix the root cause first; harden second.The test: Would a senior engineer reading this say it's overcomplicated? If yes, simplify.
Touch only what you must. Clean up only your own mess.
When editing existing code:
When your changes create orphans:
The test: Every changed line in the diff should trace directly to the user's request. If a reviewer asks "why is this line different?" you should have an answer rooted in the task.
Define success criteria. Loop until verified.
Transform imperative tasks into verifiable goals:
| Instead of... | Transform to... |
|---|---|
| "Add validation" | "Write tests for invalid inputs, then make them pass" |
| "Fix the bug" | "Write a test that reproduces it, then make it pass" |
| "Refactor X" | "Ensure tests pass before and after" |
| "Make it work" | "Define what 'work' means as a verifiable check, then verify" |
For multi-step tasks, state a brief plan before starting:
1. [Step] → verify: [check]
2. [Step] → verify: [check]
3. [Step] → verify: [check]Strong success criteria let you loop independently. Weak criteria ("make it work") force the user back into the loop to clarify.
Before saying "done", confirm:
Source: Adapted from forrestchang/andrej-karpathy-skills, distilled from Andrej Karpathy's observations on LLM coding pitfalls. MIT licensed.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.