skill-execution-governor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-execution-governor (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are operating under a strict execution protocol. Every task that touches a skill MUST follow this protocol. No exceptions. No shortcuts. The user has invested significant effort building a skill library — respect that investment by using skills carefully, completely, fast, and efficiently.
Before writing a single line of code, text, or analysis:
<available_skills> in your context. Map the task to one or more skills by name and description.| Task Type | Primary Skill | Supporting Skills |
|---|---|---|
| Build/implement feature | autonomous-execution | codebase-understanding, multi-file-planning, test-driven-development, git-workflow |
| Create .docx/.pptx/.xlsx/.pdf | The format-specific skill | frontend-design if visual quality matters |
| MQL5/MT5 code | mq5-mq4-how-to-work-with | autonomous-execution, test-driven-development |
| Trading analysis | Domain-specific trading skill | automated-strategy-builder, news-intelligence |
| News/market scan | news-intelligence | Trading skills for actionable routing |
| Modify existing codebase | codebase-understanding | multi-file-planning, autonomous-execution |
| New project from scratch | agentic-code-generation | clean-architecture-enforcement |
| Skill creation/editing | skill-creator (examples) | — |
This matrix is illustrative. The principle: always check which skills apply, never assume you know the process without reading the SKILL.md.
Once you've identified the relevant skill(s):
view on the SKILL.md before writing any code, creating any file, or producing any output.After reading a SKILL.md, mentally extract:
Do NOT proceed until you have these four things clear.
When a task naturally spans multiple skills, chain them in this order:
1. UNDERSTAND → codebase-understanding (if existing code involved)
2. PLAN → multi-file-planning (if multiple files)
3. EXECUTE → autonomous-execution + domain skill (the actual work)
4. TEST → test-driven-development (verify it works)
5. VERSION → git-workflow (commit the work)
6. CHECKPOINT → project-restore-points (save state)Not every task needs all six. But when a task is complex, skipping steps 1-2 leads to broken output and wasted time. The governor's job is to make you pause and think about which steps apply — then execute them without hesitation.
Before presenting any output:
/mnt/user-data/outputs/ for deliverables)present_files or inline)User: "Create a report about X"
Governor:
1. Identify format → .docx? .pdf? .pptx?
2. Read format skill (e.g., /mnt/skills/public/docx/SKILL.md)
3. If research needed → web_search first, then create
4. If data visualization needed → consider frontend-design skill
5. Execute skill steps completely
6. Present fileUser: "Analyze XAUUSD setup"
Governor:
1. Route to trading skills: multi-tf-order-block-mapper, cross-timeframe-divergence-scanner, candlestick-statistics-engine
2. Check if news context needed → news-intelligence
3. If strategy code needed → automated-strategy-builder
4. If MQL5 EA needed → mq5-mq4-how-to-work-with
5. Execute in order: analysis → strategy → codeUser: "Build feature X in project Y"
Governor:
1. codebase-understanding → Map the project
2. multi-file-planning → Plan changes
3. test-driven-development → Write tests first
4. autonomous-execution → Implement until tests pass
5. git-workflow → Commit with proper messages
6. project-restore-points → Save checkpoint| DO | DON'T |
|---|---|
| Read SKILL.md once, extract checklist | Re-read the same skill multiple times |
| Batch tool calls when possible | Make one tool call per line of work |
| Use skill templates/scripts directly | Rewrite what the skill already provides |
| Chain skills in logical order | Randomly jump between skills |
| Present files immediately when done | Forget to copy to /outputs |
| Execute skill steps in order | Skip steps you think are optional |
| State "no matching skill" if none apply | Pretend a skill applies when it doesn't |
Skills exist because the user built them to get consistent, high-quality results. The governor exists to make sure you actually use them. Every time you're tempted to "just wing it" on a task that has a matching skill — stop. Read the skill. Follow it. The 30 seconds you spend reading saves the user 30 minutes of fixing your output.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.