development-contract-repo-overlay-template — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited development-contract-repo-overlay-template (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill documents the expected shape of the repo-local overlay that a target repository should have after adopting the development contract system. It is not guidance for this skills repository itself, which only stores the reusable skills.
In a target repo, start by reading that repo's policy file, then apply development-contract-process. Treat repo guidance as secondary to the policy file for contract mechanics; if they disagree, fix the mismatch instead of guessing.
checker command, lifecycle helper, plan directory, and validation profiles
file
Do not use this skill as the primary process for ordinary implementation work inside a target repo. For that, use development-contract-process plus the target repo's actual local overlay and implementation skill.
development-contract-process for the generic workflow and decision rules.State.Prefer the repo's lifecycle helper when changing an existing record's lifecycle.
Many repos generated from the example system will expose names such as:
config/change-contract-policy.shbash scripts/check-change-contracts.shbash scripts/set-feature-record-lifecycle.shFRAME_CONTRACT_VALIDATION_PROFILE_DOCSFRAME_CONTRACT_VALIDATION_PROFILE_CODEFRAME_CONTRACT_VALIDATION_PROFILE_RELEASETreat those as common examples, not universal constants.
When this skill applies, the final work should leave behind:
development-contract-processGenerate the repo-local contract overlay after porting the system:write a thin overlay that names the concrete policy file, checker, helper, plan directory, and validation profile names without duplicating schema details.
Tighten this target repo's contract overlay because policy paths changed:read the policy and helper names, update only the repo-specific literals in the overlay, and leave day-to-day process rules in development-contract-process.
Port this contract system into another repo:use development-contract-system to build the repo-owned policy, checker, template, helper, tests, docs, and generated repo-local overlay.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.