app-user-story-qa — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited app-user-story-qa (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill to turn a broad "test every feature in this app" request into a controlled loop with one source of truth. Anchor every feature to code, track expected behavior in a canonical spreadsheet, run tests against each user story, classify failures, fix only in-scope logistical or UX defects, and retest.
Use plan_first for most runs. Switch to clarify_first only when the app boundary, writable checkout, production risk, or acceptance criteria are unclear enough that a wrong assumption would waste substantial work.
Before editing:
AGENTS.md, README, architecture docs, and feature entrypoints.Direct actions:
Escalate before:
Evidence-backed pushback:
Feedback loop:
Create or update exactly one tracker. Prefer a real spreadsheet when the runtime supports it; otherwise use a CSV and treat it as the canonical spreadsheet. Do not scatter status across side reports.
Use these columns:
Feature ID,Surface,Feature / capability,User story,Expected behavior based on code,Code anchors,Initial test approach,Initial test command or route,Status,Test result,Errors,Fix status,Retest result,NotesRules:
F001, F002.Use a small, consistent status set:
Not TestedPassedFailed - ProductFailed - UXFailed - LogisticalFailed - Test InfraBlocked - EnvFixedPassed after fixUse Failed - Logistical for repo-owned setup, script, port, packaging, or local workflow defects that block a valid user path. Use Blocked - Env for local machine issues such as missing credentials, occupied services outside the repo, stale PATH binaries, or unavailable optional runtimes. Do not "fix" the user's environment unless they explicitly ask.
Classify every failure before fixing:
Product: implemented behavior violates the user story or loses data.UX: behavior works but the user path is confusing, brittle, or poorly surfaced.Logistical: scripts, ports, setup, packaging, or local workflow make valid behavior hard to exercise.Test Infra: the test itself is flaky, racy, or asserts the wrong contract.Env: external setup blocks execution and is not a repo defect.Fix only defects that are in scope for the task. Record out-of-scope defects in the tracker with clear rationale.
Map all user-visible surfaces first:
For each feature, record the user story as:
As a <user>, I want <capability>, so <outcome>.Keep stories practical. Do not create rows for private helpers unless the user can observe the behavior through a surface.
For every tracker row, choose the strongest feasible evidence:
Record the command, route, or manual steps in the tracker. Fresh output from the current session is required before marking a row passed.
Before editing, state the exact defect and files being changed. Keep fixes narrow:
Stop and re-evaluate after three failed attempts on the same defect.
After each fix:
Fix status and Retest result.Errors so the tracker remains an audit log.Before completion, run the repo's required formatting, build, typecheck, lint, and test commands when practical.
Finish only when:
Failed row is fixed, explicitly out of scope, or blocked by environment with evidence;If the repo has existing dirty work that is not yours, mention the isolated worktree or scope boundary in the final answer.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.