workflow-quality-gate — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited workflow-quality-gate (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Run before any production release. Each skill contributes a specific defect class. The combined result is a single verdict.
1. RED-TEAM → test-red-team (adversarial: UX + pipeline + security + perf)
2. SECURITY → audit-security (static code review: OWASP, auth, RLS, secrets)
3. BUNDLE → audit-bundle-size (JS payload: lazy loading, tree-shaking, chunks)
4. PERFORMANCE→ audit-performance (Core Web Vitals, LCP, CLS, INP)
5. UNIT TESTS → test-unit (coverage gaps, regression suite green?)Run gates in order — earlier gates often surface issues that make later gates redundant or change their scope.
Read ~/.cursor/skills/test-red-team/SKILL.md and follow it.Output: coverage matrix + severity-ranked defect list.
Blocker for gates 2–5: if any Critical defect is found in Gate 1, pause and ask the user whether to fix it now or continue with the remaining gates. Critical defects must be resolved before the verdict can be GO.
Read ~/.cursor/skills/audit-security/SKILL.md and follow it.Focus on static code patterns missed by the live red team:
Read ~/.cursor/skills/audit-bundle-size/SKILL.md and follow it.Threshold: first-load JS > 200 KB (gzip) is a Medium defect; > 400 KB is High.
Read ~/.cursor/skills/audit-performance/SKILL.md and follow it.Thresholds (Lighthouse mobile, simulated 4G):
Read ~/.cursor/skills/test-unit/SKILL.md and follow it.Check: does the existing test suite pass? Are there obvious coverage gaps in the code path that was changed for this release?
## Quality Gate Report — [App] — [Date]
### Verdict: GO / NO-GO / GO WITH CONDITIONS
### Blockers (must fix before release)
| # | Gate | Finding | Severity | File | Fix |
|---|------|---------|----------|------|-----|
### Recommended (fix soon, not blockers)
| # | Gate | Finding | Severity |
|---|------|---------|----------|
### Passed
- Gate 1 (Red team): [N] defects, [N] Critical, [N] High
- Gate 2 (Security): clean / [N issues]
- Gate 3 (Bundle): [X KB] first-load JS
- Gate 4 (Performance): LCP [X]s, CLS [X], INP [X]ms
- Gate 5 (Unit tests): [pass/fail], coverage [X%]GO = no Critical or High blockers, all gates passed GO WITH CONDITIONS = High defects present but agreed to fix post-release with a named owner + deadline NO-GO = any Critical defect, or 2+ High defects without mitigation plan
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.