preserve-directus-code-identifiers — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited preserve-directus-code-identifiers (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
When rebranding a Directus fork (e.g., Directus → d9), you must distinguish between prose text (which should be renamed) and code identifiers (which must NEVER be renamed). Code identifiers are tied to npm packages, database schemas, and environment variable parsing that will break if renamed.
.md, .ts, .js, or .vue extensions are being modified with string replacementOK to rename (prose):
NEVER rename (code identifiers):
@directus/ — npm package scope (imports, package.json dependencies)directus_ — database table prefix (directus_users, directus_roles, etc.)DIRECTUS_ — environment variables (DIRECTUS_SECRET, DIRECTUS_DB_*, etc.)npx directus — CLI invocationsnew Directus() — SDK constructor callscreateDirectus() — SDK factory functiondirectus/ in import paths@d9/sdk does not exist on npm — the package is @directus/sdk. Renaming the import scope causes build failures. (30min debug)d9_users doesn't exist — the schema uses directus_users. Renaming table prefixes causes API 500 errors on every data request. (1h debug)D9_SECRET is not read by the Directus engine — it expects DIRECTUS_SECRET. The app starts with default (insecure) values silently. (2h debug, security risk)new D9() is not a valid constructor. The SDK exports Directus or createDirectus. (30min debug)3 contributors made these mistakes independently during the d9 rebrand. Each occurrence cost 30min to 2h of debugging.
export { Directus as D9 }) — this adds maintenance burden for no benefit.env file@directus/ npm scope is owned by Directus Inc. — you cannot publish packages there anyway~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.