workflow-spec-tdd — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited workflow-spec-tdd (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The antidote to vibe-coding. LLMs fail not because they can't write code, but because they skip the thinking: they guess requirements, write code before tests, and declare victory without verification. This skill forces the discipline. Stack-agnostic — works for web, React Native, and Capacitor.
>
Adapted from obra/superpowers (MIT) and the Karpathy LLM-coding guardrails.
Use for: a new feature, a multi-file refactor, a recurring bug, anything ambiguous, or any task where "looks done" has burned you before.
Skip for: one-line edits, pure formatting, a single obvious fix. Don't ceremony-tax trivial work.
0. Read the room → understand repo + exact ask
1. Brainstorm → surface assumptions, explore alternatives
2. Spec → write the contract: behavior, inputs, outputs, edge cases
3. Plan → ordered, file-mapped steps with a verification per step
4. TDD → RED (failing test) → GREEN (minimal code) → REFACTOR, per step
5. Self-review → spec coverage + quality gate before "done"mobile-mobile-capacitor-platform, mobile-mobile-rn-performance, enhance-*), note it.Write a short spec before coding. Template:
## Spec: [feature]
- Behavior: [what it does, observable]
- Inputs: [shape, types, sources]
- Outputs / side effects: [returns, DB writes, navigation, events]
- Edge cases: [empty, error, offline, large, concurrent, unauthorized]
- Out of scope: [what this explicitly does NOT do]
- Done when: [the concrete, checkable success criteria]"Done when" must be verifiable, not "it works". Weak criteria produce weak code.
## Plan
1. [file] — [change] — verify: [test/command]
2. [file] — [change] — verify: [test/command]
...
- New deps (if any): [pkg@version — why]
- Migrations / schema / RLS / edge fns touched: [list — deploy in same turn per full-stack-ship-discipline]
- Risk: [low/med/high per step]For 3+ files or ordering concerns, reason through with the Sequential Thinking MCP if available.
For each plan step:
Rules:
mobile-emulator-test for device; Capacitor → vitest + mobile-mobile-capacitor-platform E2E.Run this checklist. If any box fails, you are not done:
- [ ] Every "Done when" criterion is met and verified (not assumed)
- [ ] Every spec edge case is handled or explicitly deferred in the spec
- [ ] Tests fail without the change and pass with it (RED was real)
- [ ] No placeholder / TODO / dead code / stubbed return left behind
- [ ] No unrequested scope crept in (YAGNI held)
- [ ] Backend deps deployed + verified on the remote, not just on disk
- [ ] Error path actually exercises the new code (logs/network confirm, not a stale 404)
- [ ] Narrowest verification command for the surface was run and is greenfull-stack-ship-discipline.workflow-coding-discipline — behavioral guardrails (this skill operationalizes them).full-stack-ship-discipline — Phase 5 backend-deploy gate.mobile-mobile-capacitor-platform / mobile-mobile-rn-performance / enhance-* — surface domain knowledge for the plan.test-playwright / mobile-emulator-test / test-unit — the verification runners for Phase 4–5.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.