boyscout — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited boyscout (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Two opposite failures rot codebases. One: never cleaning up, so entropy compounds until the file is a no-go zone. The other: a "quick change" balloons into a 600-line refactor that's impossible to review and ships three bugs. Agents swing wildly between both — either touching nothing around the change or rewriting the whole file uninvited.
The Boy Scout Rule threads the needle: leave the code a little better than you found it. Small, bounded, in-scope, separate from the behavior change. This skill enforces the little — disciplined cleanup, not a crusade.
Don't use when: the file is brand new (nothing to clean), or the cleanup is large enough to deserve its own PR. If cleanup would exceed roughly a third of the size of your actual change, stop and file it as separate work — the cleanup is the tip, not the meal. For a deliberate dead-code sweep across a module, use delete-this instead — this skill is only for small, opportunistic, in-scope cleanup riding along with a change you're already making.
Do the thing you came to do. Get it working and verified. The cleanup is a tip, not the meal — never let it block or bloat the actual change.
Look at the functions and lines your change touched, plus their immediate neighbors. Do not scan the whole file for sins — that's how scope explodes. The rule applies to the campsite you used, not the whole forest.
An improvement qualifies only if it is all of:
If an idea fails any of these, it's not a Boy Scout fix — it's a separate task. Write it down (step 5) and move on.
Keep the cleanup in its own commit, distinct from the behavior change. The behavior commit must be readable on its own; the cleanup commit must contain zero logic changes. This keeps review honest and bisecting possible.
A qualifying cleanup may borrow a sibling skill at small scale — a better name (name-things), a deleted dead line (delete-this), a split that makes one thing testable (seams) — as long as it still passes the cheapness test in step 3. The discipline is the smallness, not the technique.
If you're not committing (editing a working tree for a human to commit, or running where commits aren't yours to make): still keep the two apart — clearly delineate in your diff and summary which changes are the behavior change and which are cleanup, so the human can split them or review them separately. The separation is the point; the commit is just the usual vehicle for it.
Anything that failed the cheapness test goes into a short "deferred" list — a TODO, an issue, or a note to the human — so it's captured without derailing the current change.
REAL CHANGE
<the behavior change you came to make — its own commit>
CAMPSITE CLEANUP (separate commit, no logic changes)
- <small safe improvement> @ <file:line>
- ...
DEFERRED (too big for now — filed, not done)
- <larger refactor idea> — why it's out of scope| Anti-Pattern | Why it defeats the skill |
|---|---|
| The "while I'm here" rewrite | A 10-line change becomes 400 lines and three bugs. Bound the scope. |
| Cleanup mixed into the behavior commit | Reviewer can't tell what actually changed; bisect points at the wrong line. |
| Reformatting the whole file | Drowns the real change in whitespace noise and conflicts. |
| Cleaning code you didn't touch | Out of scope. Note it, don't do it. |
| Skipping cleanup entirely | The other failure mode — entropy wins by default. Leave it a little better. |
Leave the campsite cleaner than you found it — the campsite, not the forest. Small, safe, separate. The discipline is the smallness.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.