development-contract-repo-overlay-template — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited development-contract-repo-overlay-template (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill documents the expected shape of the repo-local overlay that a target repository should have after adopting the development contract system. It is not guidance for this skills repository itself, which only stores the reusable skills.
Use target policy as the source for contract mechanics within the host's instruction hierarchy. Keep an unresolved policy/documentation conflict visible; do not decide it merely by preferring whichever file was opened first.
checker command, lifecycle helper, plan directory, and validation profiles
file
Do not use this skill as the primary process for ordinary implementation work inside a target repo. For that, use development-contract-process plus the target repo's actual local overlay and implementation skill.
drafts do not authorize repository writes.
that establish the target's actual commands and paths.
to development-contract-process when it is available to the target agent; otherwise include the minimum operator steps needed to use the repo's system.
if changing the overlay is itself substantive. Do not require an unrelated implementation or record update merely to produce a draft.
observed commands separately from proposed or unrun commands.
report unresolved decisions rather than silently changing policy.
Many repos generated from the example system will expose names such as:
config/change-contract-policy.shbash scripts/check-change-contracts.shbash scripts/set-feature-record-lifecycle.shFRAME_CONTRACT_VALIDATION_PROFILE_DOCSFRAME_CONTRACT_VALIDATION_PROFILE_CODEFRAME_CONTRACT_VALIDATION_PROFILE_RELEASETreat those as common examples, not universal constants.
Return findings, a draft, or the applied thin overlay as requested, with concrete policy/command bindings and validation limitations. Applied edits must follow any target-repo record requirement. This authoring workflow does not itself authorize product-code changes or adoption of a new contract system.
Generate the repo-local contract overlay after porting the system:write a thin overlay that names the concrete policy file, checker, helper, plan directory, and validation profile names without duplicating schema details.
Tighten this target repo's contract overlay because policy paths changed:read the policy and helper names, update only the repo-specific literals in the overlay, and leave day-to-day process rules in development-contract-process.
Port this contract system into another repo:use development-contract-system to build the repo-owned policy, checker, template, helper, tests, docs, and generated repo-local overlay.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.