workflow-launch-ready — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited workflow-launch-ready (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The pre-launch sequence. Run once, get the complete picture across SEO, PWA, performance, quality, and post-launch monitoring.
1. SEO → enhance-web-seo (meta, OG, JSON-LD, sitemap, canonicals)
2. PWA → enhance-pwa (manifest, service worker, offline, install)
3. BUNDLE → audit-bundle-size (first-load JS ≤ 200 KB goal)
4. i18n → audit-i18n (if multi-locale: natural copy, no hardcoded strings)
5. QUALITY GATE → workflow-quality-gate (red-team + security + perf + unit tests)
6. DEPLOY → deploy-verify (post-deploy smoke after the release)
7. ITERATE → iterate-post-launch (close loop on day-1 production signals)Skip steps 2 (PWA) and 4 (i18n) if not applicable — note the skip in the checklist.
Read ~/.cursor/skills/enhance-web-seo/SKILL.md and follow it.Every public page needs: <title>, meta description, OG tags, canonical URL, structured data (JSON-LD), and a sitemap entry.
Read ~/.cursor/skills/enhance-pwa/SKILL.md and follow it.Required: Web App Manifest + service worker with offline fallback. Lighthouse PWA score ≥ 90 before launch.
Read ~/.cursor/skills/audit-bundle-size/SKILL.md and follow it.Target: first-load JS ≤ 200 KB gzip. All routes lazy-loaded.
Read ~/.cursor/skills/audit-i18n/SKILL.md and follow it.Priority: no hardcoded user-facing strings, natural copy in all supported locales, correct date/number/currency formatting.
Read ~/.cursor/skills/workflow-quality-gate/SKILL.md and follow it.This step runs test-red-team, audit-security, audit-performance, and test-unit internally. A NO-GO verdict from this step blocks launch.
Read ~/.cursor/skills/deploy-verify/SKILL.md and follow it.Run immediately after the production deploy. Confirm no new Sentry errors, schema is healthy, and critical flows work.
Read ~/.cursor/skills/iterate-post-launch/SKILL.md and follow it.Schedule this 24–48 hours after launch. Pull first real-user signals and prioritize the first fix pass.
## Launch Readiness — [App] — [Date]
### Verdict: LAUNCH-READY / LAUNCH WITH CONDITIONS / NOT READY
| Step | Status | Open items |
|------|--------|------------|
| SEO | ✅ / ⚠️ / ❌ | [list] |
| PWA | ✅ / ⚠️ / ❌ / skipped | [list] |
| Bundle size | ✅ / ⚠️ / ❌ | [X KB] |
| i18n | ✅ / ⚠️ / skipped | [list] |
| Quality gate | GO / NO-GO / CONDITIONAL | [see gate report] |
| Deploy smoke | ✅ / ❌ | [notes] |
| Day-1 plan | scheduled / not yet | [date] |
### Blockers (must fix before launch)
[list]
### Post-launch backlog (fix within 48 h)
[list]~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.