no-debug — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited no-debug (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A `console.log("here")` is how you debugged it, not how it ships.
The prints, breakpoints, and dumps you scatter while working something out are scaffolding for you. Left in, they leak internals to stdout, slow hot paths, clutter logs, and tell the next reader "this was never cleaned up." The model adds them constantly and forgets them just as often.
Strip debug noise before "done." Every debug print, breakpoint, and dump you added to work the problem out comes back out — or becomes a real log line, deliberately.
console.log( / console.debug( / console.trace( / console.dir(, debugger;pdb.set_trace(), breakpoint(), import pdb / import ipdb, ipdb.set_trace(), and a print(...) whose content is a debug marker (print("DEBUG", x), print("here"))binding.pry, binding.irb, byebugvar_dump(, print_r(, dd(, dump(, error_log(fmt.Println( / fmt.Printf( that's clearly a debug trace (DEBUG/here/XXX)dbg!(, a debug-ish eprintln!(System.out.println(console.error( / console.warn( — that's legitimate error/warn reportinglogger.info(...), log.warn(...), logging.getLogger(...), winston, pino, slog, Log.d(...)print(...) that's part of the program's output (prompts, results, --help text)The gate already knows the difference — it leaves console.error/console.warn, real loggers, commented-out lines, and bare CLI prints alone.
Every print/breakpoint you dropped to watch a value go through is now answered. Re-read your own diff for this turn and find them.
console.log — use the project's logger at the right level (logger.info / log.warn / console.error for genuine errors). A real logger is filterable, levelled, and routable; a stray console.log is none of those.A CLI tool, a build script, a one-off utility — these legitimately print to stdout. That's fine, but make it a decision, not a leftover. Declare it:
NO-DEBUG: INTENTIONAL — CLI entrypoint; prints results to stdout by design
NO-DEBUG: INTENTIONAL — migration script; progress output is the UXThe Stop hook scans code you edited this turn for debug markers and blocks the turn unless it's clean or you've recorded that line.
The gate is conservative by design: it never flags console.error/console.warn, never flags a recognised logger, never flags a commented-out line, and only flags an ambiguous print / fmt.Println / System.out.println when the line also carries debug-ish content (DEBUG, here, ===, an emoji). A bare print("Enter name:") in a CLI passes untouched.
False positive (a CLI that prints by design, a print the gate misread): touch .no-debug-off in the project root, or export NO_DEBUG_GATE=off.
console.log(token) is also how secrets leak; strip the log, keep the secret out.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.