story-repo-scout — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited story-repo-scout (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use a story card to find the repo files most likely to matter before implementation starts. Favor evidence, exact paths, and small output.
user-story-clarifiersecurityuser-story-clarifier or ask for the missing behavior before scouting.
names, data fields, and acceptance-criteria verbs
user, data, page, service, and featureunless paired with a specific qualifier
rg --files when availabletest directories only enough to orient the search
they explain the story terms
packages/, apps/,services/, crates/, or workspace manifests (pnpm-workspace.yaml, lerna.json, turbo.json, nx.json, go.work, Cargo workspaces, Bazel WORKSPACE/MODULE.bazel), restrict the search to the workspace implied by the story. Record the workspace in Repo Context. If the story spans multiple workspaces, name them and search each separately.
searches miss
behavior or acceptance criterion directly, treat it as an anchor — use it to find the implementation file it exercises. Record the observed evidence: symbol, route, test name, docs phrase, config key, or nearby behavior. Do not include a file based only on a filename guess.
docs, add an open repo question instead of silently renaming concepts.
nearby paths that should not shape the implementation.
local-small: 6-8 pathsstandard-agent / frontier-gpt / human (default): 10-12 pathsMark speculative or weak matches instead of overstating certainty. If no strong hits appear after all passes, report the handles tried and the most plausible directories to inspect next; do not invent paths.
context there. Otherwise output an appendable Markdown block.
Use this structure by default:
## Repo Context
### Workspace
- Workspace, package, or app the story targets. Omit only for single-workspace repos.
### Search Handles
- Concrete terms searched or derived from the story.
### Relevant Files
| Path | Evidence | Why It Matters | Confidence |
|---|---|---|---|
| path/to/file.ext | Route, symbol, test, docs phrase, or config key observed. | One-line rationale. | High/Medium/Low |
### Likely Entry Points
- path/to/file.ext: where implementation probably starts.
### Tests to Update
- path/to/test.ext: existing test that will need modification for this story.
### Tests and Validation Targets
- path/to/test.ext: behavior or command this may validate.
### Documented Commands
- Commands found in repo docs or manifests that may validate the story.
### Likely Unrelated / Do Not Touch
- path/to/file.ext: why it is nearby but outside this story.
- `None identified` when this output will feed
`story-implementation-orchestrator` and no boundary was found.
### Open Repo Questions
- Only unresolved repo questions that materially affect implementation.Omit empty sections when they add no signal, except keep Likely Unrelated / Do Not Touch as None identified when a full story-to-plan packet or orchestrator quality gate will consume the output. Prefer exact paths over prose. Include line numbers only when (a) the symbol's location is non-obvious from the file or (b) the implementer will need to navigate directly there. Never paste line numbers as decoration.
Confidence uses the same High/Medium/Low scale as user-story-clarifier story confidence. See story-implementation-orchestrator for the canonical vocabulary block when run end-to-end.
Reject and rewrite when these appear:
symbol, route, or test was opened to confirm relevance.
implementation file was found. Record as an open repo question, not as a relevant file.
*.pb.go, *.generated.*, dist/, build/, target/,__generated__/. Point to the source/schema instead.
High when only the filename wasinspected. Default to Low when evidence is thin.
directories to inspect next.
For executor-specific planning rules (token budget, first-action, stop-and- report), see story-implementation-planner local-small profile — this skill does not duplicate that guidance.
the user explicitly asks.
user-story-clarifier (story card).Output is consumed by story-implementation-planner. Preserve Likely Unrelated / Do Not Touch paths verbatim — the planner relies on those boundaries.
user-story-clarifier first when acceptance criteria, boundaries, orexpected behavior are unclear.
story-implementation-planner after this skill has appended repo context.tester-mindset when the main question is what risk or evidence matters,not where the current implementation lives.
security for exploit-focused review or threat modeling.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.