flowguard — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited flowguard (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill as the single lifecycle entrypoint for agent work that can drift, lose context, or become expensive. It routes the task, verifies current state, runs bounded execution loops, and leaves a resumable handoff.
This skill coordinates other skills; it does not replace them. Use task-specific skills such as fixflow, plan-flow, codex-retrospective, or vibeguard only when their trigger is clearly met.
Choose one route before editing files or running a long loop:
| Route | Use When | Action |
|---|---|---|
execute_direct | Goal, context, constraints, and done-when are clear; scope is small or verification is cheap. | Work directly with short checkpoints. |
plan_first | Work spans many files, sessions, agents, architecture decisions, migrations, or risky sequencing. | Create a brief execution plan or use the relevant planning skill before edits. |
clarify_first | Goal, target files, constraints, done-when, destructive permission, production impact, or ownership is unclear. | Ask the smallest blocking question before continuing. |
Do not hide ambiguity inside assumptions. If a wrong assumption would cause large rewrites, production risk, data loss, credential exposure, or wasted long-loop cost, use clarify_first.
AGENTS.md for files that may be edited.# From the installed flowguard skill directory, the directory containing this SKILL.md:
scripts/workflow_state_snapshot.sh /path/to/target/repoWhen already in the target repo, pass . as the target to the installed script, for example /path/to/installed/flowguard/scripts/workflow_state_snapshot.sh ..
Before substantial work, write or state the compact preflight:
route:
goal:
context:
constraints:
done_when:
out_of_scope:
verification_commands:
stop_conditions:
handoff_location:For short direct tasks, this can be one concise paragraph. For long tasks, make it explicit and keep it available for compaction or resume.
Use a step-test-update loop:
Stop and re-evaluate when any condition occurs:
execute_direct, but new evidence shows missing goal, constraints, or done-when. Stop and re-route.Do not claim completion from expectation or older output. Report fresh evidence from this session.
Pick checks from the repo, AGENTS.md, and changed surface. Common defaults:
| Stack | Before Completion | Before Submission |
|---|---|---|
| Rust | cargo check | cargo test |
| TypeScript | npx tsc --noEmit | project test command |
| Go | go build ./... | go test ./... |
| Python | focused import/type/lint check if present | pytest |
If a check cannot run, say why and name the nearest useful fallback that did run.
Read references/state-contract.md when asked to create a handoff, resume after compaction, continue a previous task, or prepare automation.
Required handoff fields:
Resume must start by comparing the handoff with current local truth. If cwd, branch, files, tests, or user priority changed, update the plan before editing.
Use parallel agents only when file ownership is disjoint and merge ownership is explicit. A delegation must name:
If two agents need to write the same file, do not run them in parallel.
Skill workflows are manual first. Automate only after the workflow has been manually validated on real tasks. Scheduled automation should start as read-only: state scans, handoff drafts, stale-worktree reports, or verification summaries. Code edits, deploys, credential changes, or PR submissions require explicit user intent unless a separate trusted automation contract exists.
scripts/workflow_state_snapshot.sh <path>: read-only snapshot for cwd, git state, nearby agent instructions, dirty files, and likely verification commands.references/state-contract.md: templates for preflight, checkpoints, handoff, resume, loop guards, and automation readiness.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.