loud-errors — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited loud-errors (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The worst error is the one you can't see. Code that swallows failures — catch {}, except: pass, an error logged at debug and then execution continues as if nothing happened — turns a clean crash into a silent corruption that surfaces hours later, somewhere else, with no trace back to the cause. The second-worst is the error that is loud but says nothing: throw new Error("something went wrong") tells the on-call engineer at 3am exactly nothing.
Agents are especially prone to both. They're optimizing for "make the happy path run," so they wrap risky calls in a try that quietly eats the failure, or they emit a generic message to satisfy a linter. The result is code that looks defensive and is actually blind.
This skill does the opposite of defensive-by-swallowing: it makes failures loud (they stop the wrong thing from continuing) and specific (they carry enough context to diagnose without a debugger).
catch (e) {}, except: pass, catch { return null }, rescue nil"something went wrong", "error", "failed", a bare re-throw with no contextDon't use when: the swallow is deliberate and correct — a genuinely optional operation (best-effort cache warm, telemetry that must never break the request), a documented retry/fallback, or a control-flow exception in a language that uses them idiomatically. In those cases the rule is not "make it loud," it's "make the intent to swallow explicit" (see step 4). Don't turn an intentional fallback into a crash.
Scan the target scope for the swallow patterns:
catch {}, except: pass, catch { return null }, .catch(() => {})200 OK / a generic pagecatch (e) { throw new Error("failed") } that discards eFor each swallowed failure, classify the intended behavior:
PaymentDeclined, not a raw StripeError), but keep the original as the cause (throw new X(..., { cause: e }), raise X from e).A good error answers three questions without a debugger:
Bad:throw new Error("failed")Good:throw new Error(\charge failed for order \${orderId}: gateway rejected (retryable)\, { cause: err })
Preserve the original cause every time you wrap. A new error that drops the stack trace is just a different way of swallowing.
Report once, at the boundary that owns the response. Intermediate layers add context by wrapping with cause — they don't log. A failure that appears five times in the logs as it bubbles up is noise the on-call engineer has to dedupe by hand; loud means visible once with full context, not echoed at every layer.
If a failure really should be ignored, it must say so on purpose — so the next reader (and the next agent) knows it's a decision, not an accident:
// best-effort; a cold cache is fine)Validate and reject bad inputs at the edge (where the request, file, or message enters) — the closer the error surfaces to its cause, the cheaper it is to diagnose.
For at least the highest-risk path, confirm the new behavior: trigger (or reason through) the failure and check that it surfaces with its context — a test that asserts the error is thrown with the right message/cause is the proof. If conventions are recorded in CONTEXT.md (error-handling style: exceptions vs result types vs error returns), match them rather than imposing a new pattern.
SWALLOWED / VAGUE FAILURES
- <location> @ <file:line> — pattern: <empty catch / log-and-continue / cause-dropped / vague throw>
intended: <must-fail | translate-with-cause | genuinely-optional>
fix: <propagate | specific message + cause | explicit intentional swallow>
PROPOSED MESSAGES (before -> after)
- "failed" -> "charge failed for order {orderId}: gateway rejected (retryable)"
INTENTIONAL SWALLOWS (kept, now explicit)
- <location> — why it's safe to ignore: <reason>
PROOF
<a test asserting the error surfaces with its context, or the path you verified>| Anti-Pattern | Why it defeats the skill |
|---|---|
catch (e) {} / except: pass | The failure becomes invisible; corruption surfaces later, elsewhere, untraceable. |
| Catch-all that swallows everything | You meant to ignore one thing and silenced a hundred — including the bug you'll spend a day hunting. |
throw new Error("failed") | Loud but useless. No operation, no input, no next step — the on-call engineer learns nothing. |
| Wrapping that drops the cause | A new error with no cause/original stack is just swallowing with extra steps. |
| Logging secrets/PII into the message | An error you can't paste into a ticket is a new problem, not a fix. Identifiers, never secrets. |
| Making an intentional fallback crash | Best-effort work (cache, telemetry) must not fail the request. Make the swallow explicit, don't remove it. |
| Catch-log-rethrow at every layer | The same failure shows up five times in the logs. Wrap with cause as it bubbles; log once, at the boundary. |
A swallowed error is a bug you've agreed not to find out about. Make failures loud enough to notice and specific enough to fix — and if you really must ignore one, say so on purpose.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.