mushi-debug — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited mushi-debug (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Symptoms: Inventory → Discovery shows 0 events.
Mushi.init({ projectId: '...', apiKey: '...', capture: { discoverInventory: { enabled: true } } })mushi_ and belongs to the correct project.[Mushi] errors.mushi doctor — confirms reachability.Symptoms: "ALL_KEYS_EXHAUSTED" error, quota banner in Settings.
# Check key health
mushi keys list
# Add a backup key
mushi keys add --provider anthropic --key sk-ant-... --label "Backup"In the console: Settings → API Key Pool → keys in quota_exhausted state show cooldown timer (resets in 1 hour automatically).
Symptoms: mushi stories map returns error or crawl run shows failed.
mushi keys list
# Should show firecrawl [active]mushi stories map --url <url> --max-pages 5 --waitSymptoms: Slack message every hour — :warning: QA story <name> errored — or Firecrawl 401.
Most common root causes and fixes:
| Error | Cause | Fix |
|---|---|---|
Firecrawl 401 Unauthorized: Token missing | No Firecrawl BYOK key in project | mushi integrations test firecrawl → if fails, add key: mushi keys add --provider firecrawl --key fc-... |
no_target_url: set a Target URL on this story | Story has no target_url and prompt doesn't contain a URL | Edit story in QA Coverage → Edit → Target URL |
| Link in Slack opens wrong page | Old story created before Jun 2026 deep-link fix | Links now go to /qa-coverage?story=<id>&run=<run-id> — verify admin console URL is correct |
# Check all QA health in one command
mushi doctor --server --qa-stories
# See recent run errors
mushi qa runs <story-id>
# Manually trigger a run to verify the fix
mushi qa run <story-id>Symptoms: No Slack message when a QA story fails or a report is classified.
# Check connection
mushi slack status
# Send test message
mushi slack testIf slack status shows "not connected":
mushi slack testIf connected but no notifications for QA failures:
qa_story.failed must be enabledbrowser_provider is set (not null)Symptoms: Generated test stays in pending_review, doesn't appear in QA schedule.
mushi tdd pendingmushi tdd approve <id>enabled=true in the console: QA Coverage page.mushi qa run <qa-story-id>Check Supabase logs via MCP:
Use the Supabase MCP: get_logs(service: 'edge-functions') to see function errors.Or in Supabase dashboard: Functions → Logs → filter by function name.
Common edge function errors:
FIRECRAWL_API_KEY not set → Add key: mushi keys add --provider firecrawl --key fc-...no_target_url: set a Target URL on this story → Edit story in QA Coverage and set Target URLNo accepted inventory → Accept a proposal in Inventory → Discovery firststory not found → The story id must match an id in the accepted inventory's user_stories[]Symptoms: Failing tests not getting improved automatically.
SELECT * FROM cron.job WHERE jobname = 'pdca-qa-story-improve'; mushi tdd improvesource='test_gen_from_story' and automation_mode IN ('auto', 'review')..git stripped).fix_attempts table for error messages.MISSING_PROJECT: pass projectId argument explicitlyHTTP 403: API key lacks mcp:write scope — regenerate with correct scopesHTTP 429: All keys exhausted — add backup keys~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.