no-stub — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited no-stub (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A function that says `# TODO: implement` is not a function. A scaffold is not a feature.
You were asked to do the work. Leaving a marker where the logic should be moves the work back to the human — silently, where they'll find it at runtime instead of in your reply.
Don't ship half-written code. Every code path you touch is either fully implemented, or you say out loud that it isn't and why.
TODO / FIXME / XXX / HACK comments parked where logic belongsNotImplementedError, raise NotImplementedError, throw new Error("not implemented"), Rust todo!() / unimplemented!()// your code here, # implementation goes here, // rest of the handler here, fill this in later..., pass # TODO, or // ...return null // TODO, return [] # placeholderA placeholder is a signal you don't yet know how to do the thing, or you're trying to look finished. Both are fixable:
Replace each placeholder with code that actually runs. If a branch can't happen yet, make it fail loudly and correctly (validate + raise a real, typed error) rather than silently returning a fake value.
Then verify it (pair with `verify-before-done`) — a stub-free function that was never run is only half-trusted.
Sometimes a stub is the correct deliverable: an interface method, an abstract base, a Protocol, a deliberately-deferred path the user agreed to. That's fine — but it must be a decision, not a leftover. Declare it:
NO-STUB: INTENTIONAL — abstract method; concrete impls live in subclasses
NO-STUB: INTENTIONAL — payments path deferred per user; raises until phase 2The Stop hook scans code you edited this turn for stub markers and blocks the turn unless it's clean or you've recorded that line.
The gate is built to ignore legitimate ...: JS spreads ({...obj}, [...arr], fn(...args)), type-hint ellipses (Tuple[int, ...]), and any ... that isn't the sole statement of a body. If it still mis-fires on a real interface stub, use the sentinel above or the kill switch.
False positive (data file with the word "todo", a real ellipsis it misread): touch .no-stub-off in the project root, or export NO_STUB_GATE=off.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.