mk:story-sizer — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited mk:story-sizer (Agent Skill) and scored it 82/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 2 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
ignore/disregard/forget … previous instructions sentence.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Forks to the story-sizer agent (system prompt at .claude/agents/story-sizer.md). v1 ships paste-mode only: the user provides a markdown block of stories, the agent applies heuristics, and a Story Sizing Report is written to tasks/reports/story-sizing-{YYMMDD}-{slug}.md. No Jira side effects in default mode.
| Mode | Invocation | Side effects |
|---|---|---|
| Default | /mk:story-sizer --paste [--scout] [--story <id>] | Writes Story Sizing Report only. No Jira calls. |
| Auto-create | /mk:story-sizer --paste --auto-create --project <KEY> [--epic <KEY>] | After dry-run + single confirmation, delegates ticket creation per story. |
Paste-mode contract: see references/input-adapter.md for the strict markdown template, StoryRecord schema, validation rules, and failure modes. The parser is scripts/parse-paste-stories.py (deterministic; SHA-256 source-hash recorded for the auto-create source-consistency check).
Fibonacci sizing rules: see references/sizing-heuristics.md for complexity dimensions, scoring tables, inconsistency detection, split-proposal triggers, and DoR advisory. Scorer is scripts/score-story.py (integer-arithmetic over text-derived counts; same input → same numeric output).
Report template + slot semantics: references/report-writer.md. Renderer is scripts/write-sizing-report.py. Default path: tasks/reports/story-sizing-{YYMMDD}-{slug}.md. Idempotency by source_hash — repeated runs on the identical paste body re-prompt before overwriting.
Per-story suggested create commands obey the v1 field whitelist: --project, --type, --summary, --story-points, --description, optional --epic, --components, --labels. No --assignee, --priority, --sprint, --blocks, or --custom-fields in v1.
End-to-end default flow + --scout extract-or-prompt pattern + filtering rules: references/orchestration.md. Story-sizer NEVER auto-invokes /mk:scout — it extracts existing session output or prompts the user to run scout first.
--auto-create --project <KEY> [--epic <KEY>] runs 5 pre-flight checks (NO_ACS, Rule-1 injection, length cap, duplicate suspect via mk:jira-search, source-hash mismatch). If all pass, a markdown dry-run table renders + a single AskUserQuestion gate decides ship-or-abort. Gating rules: references/auto-create-gating.md. Rule-1 inventory copy: references/injection-patterns.md. Gating check: scripts/check-auto-create-gating.py.
../../agents/story-sizer.mdmk:jira-evaluator (post-ticket complexity), mk:jira-estimator (post-ticket estimation), mk:planning-engine (sprint capacity)mk:jira-issue (create), mk:jira-collaborate (audit comment via --internal)../jira/references/estimation-guide.md (Fibonacci heuristic conventions)source_hash recorded in the report header is the SHA-256 of the _exact_ paste body. If you edit the paste locally between sizing and --auto-create, the source-consistency check will ABORT — re-paste the modified body and re-run --paste to regenerate the report.--scout does not auto-invoke /mk:scout. Run /mk:scout first when you want codebase signals; otherwise the report carries [NO_CODEBASE_CONTEXT].mk:agent-detector loaded .claude/rules-conditional/agile-story-gates.md for the current session.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.