delete-this — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited delete-this (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Codebases accrete. Every feature adds; almost nothing subtracts. Agents make this worse — they're trained to produce code, not remove it, so they route around dead code instead of deleting it. The result is a graveyard of commented-out blocks, flags that are always true, abstractions invented for a second caller that never arrived, and TODOs from engineers who left two years ago. Every line of it is read, parsed, and feared by everyone who touches the file.
The best refactor is often a deletion. This skill finds what no longer earns its place and removes it safely — proving it's dead before it's gone.
// TODO (2023), or if (false) branchesDon't use when: you can't yet prove the code is unused, or when "dead" code is actually a public API / plugin surface others depend on. When in doubt, prove first (step 2). For a small dead line you noticed while editing something else, don't open a deliberate sweep — that's boyscout territory (bounded, in-scope cleanup). This skill is the deliberate, repo-wide hunt.
Scan the target scope and list deletion candidates by category:
if (false), flags pinned to one value)For each candidate, establish unused with evidence, not vibes:
git log/blame for the commit that introduced it. "Looks pointless" plus a commit message saying "fixes race on concurrent checkout" changes the verdictCONTEXT.md (if present) — public exports, plugin/route surfaces, and dynamic-access points listed there are never deletion candidates, regardless of grep results.Group deletions so each is its own revertible commit:
remove unused export X, not cleanup)After each deletion: typecheck, build, run tests — using the project's actual commands (take them from CONTEXT.md if it records a build/typecheck/test command, otherwise detect them). A deletion that breaks the build wasn't dead. Roll back that one and move it to the verify list. If there is no way to typecheck/build/test the change, you cannot verify the removal is safe — treat those candidates as "verify with a human," not "safe to delete."
For each removal, record why it was safe (the evidence from step 2). This is what lets a reviewer approve a deletion PR with confidence.
SAFE TO DELETE (proven unused)
- <symbol/block> @ <file:line> — evidence: <grep result / no callers / flag pinned since X>
VERIFY WITH HUMAN (looks dead, can't prove)
- <symbol/block> @ <file:line> — uncertainty: <dynamic access? public API? external consumer?>
PLAN
commit 1: <single deletion>
commit 2: <single deletion>
...| Anti-Pattern | Why it defeats the skill |
|---|---|
git stash-ing into a comment | Version control already remembers. Commented code rots and lies. |
| Deleting on a hunch | If you can't prove it's unused, you're gambling with prod. Prove or punt. |
| One giant "cleanup" commit | Impossible to review, impossible to bisect, impossible to partially revert. |
| Mixing deletion with a fix | When it breaks, no one can tell which half did it. |
| Keeping code "just in case" | That's what git history is for. Fear-driven retention is how graveyards grow. |
Code is a liability, not an asset. The question is never "why delete this?" — it's "what is this still earning?" If the answer is silence, it goes.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.