name-things — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited name-things (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Bad names are the cheapest bug to introduce and the most expensive to live with. data, handle, process, manager, info, util, temp, obj — every one is a place where the author gave up on saying what the thing is. Agents are especially prone to this: they generate plausible-but-vague names at scale. The result is code that's technically correct and cognitively exhausting.
This skill makes names carry their weight: a good name tells you what something is and what role it plays, so you don't have to read the implementation to use it.
user vs userData vs userInfo)Don't use when: the name is already domain-standard and clear (id, i in a tight loop, well-known abbreviations like url, db). Framework-idiomatic names in their conventional position (req/res in an Express handler, ctx, self/cls) are also exempt — fighting the ecosystem costs more than it clarifies. Don't rename for the sake of renaming.
Names encode role. Before naming, classify:
isReady, hasAccess, shouldRetry (not flag, status, check). Phrase it positively — isEnabled, not isNotDisabled; negatives double up at the call site (!isNotReady)chargeCard, parseWebhook, evictStaleSessions (not handle, process, doWork)pendingInvoices (not list, arr, data)cents not convert, normalizedEmail not fixEmailReject any name that is, or contains, a filler word unless it's genuinely the most precise term:
data, info, value, item, obj, thing, stuff, temp, tmp, handle, process, manage(r), do, util(s), helper, misc, common, base, foo, result, response, res, ret, val, x/y/z (outside math/loops)
For each, ask: "data about what? handle what event? manager of what?" The answer is the real name.
If two names differ only by a vague suffix (user / userData / userInfo), they are lying about being different. Either they're the same thing (merge the name) or they play different roles (name the role: requestingUser vs targetUser).
Use the team's and the product's actual vocabulary. If the business says "subscriber," don't invent "memberAccount." If a CONTEXT.md or glossary exists, names must match it. Mismatched vocabulary is how two engineers build the same thing twice.
A rename isn't done until every reference moves with it. Before applying:
When proposing renames, present a table so the human can scan and approve:
| Current | Proposed | Why |
|--------------|---------------------|---------------------------------------|
| data | pendingInvoices | it's a list of invoices awaiting send |
| handle() | retryFailedCharge() | it retries; "handle" hides the effect |
| userInfo | requestingUser | distinguishes from targetUser || Anti-Pattern | Why it defeats the skill |
|---|---|
Type-in-the-name (userObject, nameString, itemsArray) | The type system already knows. The name should add meaning, not repeat it. |
Comment-as-crutch (// the list of active users above data) | Move the meaning into the name; delete the comment. |
| Cute or clever names | Thanos.snap() is funny once and confusing forever. |
| Renaming without grep | A rename you don't propagate creates two vocabularies. Find every call site. |
A name is a one-word comment that can never go stale. If you need a comment to explain a name, the name is wrong.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.