workflow-refactor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited workflow-refactor (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Improve code quality without changing external behavior. Research-aware.
BEFORE refactoring any code, you MUST:
README.md (project overview)
src/[domain]/@_[domain]-README.md (domain architecture)
CONTRIBUTING.md (code standards)Use Grep and SemanticSearch to find:
Before changing any function, class, or component:
rg "functionName" --type ts # find all callers
rg "import.*from.*module" --type ts # find all importersList every file that will be affected by the change. If the blast radius is large (10+ files), consider a phased approach.
If the refactoring introduces a new pattern, verify it's current best practice:
CallMcpTool(server: "user-firecrawl", toolName: "firecrawl_search", arguments: {
"query": "<framework> <pattern> best practice <current year>",
"limit": 5,
"sources": [{ "type": "web" }]
})Scrape the most authoritative result:
CallMcpTool(server: "user-firecrawl", toolName: "firecrawl_scrape", arguments: {
"url": "<best-result-url>",
"formats": ["markdown"],
"onlyMainContent": true
})This prevents refactoring FROM one outdated pattern TO another outdated pattern.
Before refactoring, state:
"Pre-refactoring check:
- README/docs read: [list]
- Dependent files identified: [list files that import this code]
- Blast radius: [N files affected]
- Tests exist: [YES/NO — if NO, write tests first]
- Pattern verified: [YES via research / YES matches codebase / SKIP — trivial refactor]"| Smell | Symptom | Solution |
|---|---|---|
| Long Function | >20 lines, does multiple things | Extract functions |
| Duplicate Code | Same logic in 2+ places | Extract shared function/hook |
| Magic Numbers | Unexplained literals | Named constants or config |
| Deep Nesting | 3+ levels of if/loops | Early returns, extract functions |
| Long Parameter List | >3 parameters | Object parameter with interface |
| Feature Envy | Function uses another module's data heavily | Move function to that module |
| God Object | One class/component does everything | Split by responsibility |
| Primitive Obsession | Using strings/numbers where a type would be safer | Create domain types |
| Shotgun Surgery | One change requires editing many files | Consolidate related logic |
| Dead Code | Unreachable or unused code | Delete it (git has history) |
Before:
function processOrder(order: Order) {
if (!order.items.length) throw new Error('Empty order');
if (!order.customer) throw new Error('No customer');
if (order.total < 0) throw new Error('Invalid total');
const subtotal = order.items.reduce((sum, i) => sum + i.price, 0);
const tax = subtotal * 0.1;
const total = subtotal + tax;
db.orders.insert({ ...order, total });
}After:
function processOrder(order: Order) {
validateOrder(order);
const total = calculateTotal(order);
saveOrder({ ...order, total });
}Before:
function getDiscount(user: User, order: Order) {
if (user) {
if (user.isPremium) {
if (order.total > 100) {
return 0.2;
} else {
return 0.1;
}
}
}
return 0;
}After:
function getDiscount(user: User | null, order: Order) {
if (!user) return 0;
if (user.isPremium && order.total > 100) return 0.2;
if (user.isPremium) return 0.1;
return 0;
}// Before
if (password.length < 8) { ... }
if (retries > 3) { ... }
const tax = amount * 0.1;
// After
const MIN_PASSWORD_LENGTH = 8;
const MAX_RETRIES = 3;
const TAX_RATE = 0.1;// Before — positional args are error-prone
function createUser(name: string, email: string, age: number, role: string) { ... }
// After — named, self-documenting, extensible
interface CreateUserParams {
name: string;
email: string;
age: number;
role: string;
}
function createUser(params: CreateUserParams) { ... }1. Verify tests pass → 2. Make one small change → 3. Verify tests pass → 4. Commit → 5. Repeatrefactor(scope): description of structural change
- What was changed and why
- No behavior changeany or casts)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.