mk:verify — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited mk:verify (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Runs build → lint → type-check → tests → coverage in sequence. Fails fast on first failure. Produces a single PASS/FAIL verdict with per-step results.
mk:ship pre-flight)Phase: 3→4 transition (Build → Review) Handoff: If PASS → proceed to mk:review. If FAIL → developer fixes, re-run verify.
Detect project type by checking for marker files in this order:
| Marker File | Language | Build | Lint | Type-check | Test | Coverage |
|---|---|---|---|---|---|---|
package.json | JS/TS | npm run build | npm run lint | npm run typecheck or tsc --noEmit | npm test | .nycrc or jest.config threshold |
pyproject.toml | Python | python -m build | ruff check . or flake8 | mypy . | pytest | pyproject.toml coverage threshold |
go.mod | Go | go build ./... | golangci-lint run | (built-in to build) | go test ./... | coverage report |
Gemfile | Ruby | bundle exec rake build | rubocop | (N/A) | bundle exec rspec | .simplecov |
Cargo.toml | Rust | cargo build | cargo clippy | (built-in to build) | cargo test | cargo tarpaulin |
Multiple markers found: Use the most specific one (e.g., Cargo.toml over package.json if both exist in a mixed repo).
No marker found: Ask user — "What build and test commands should I use for this project?"
See references/project-detection.md for detailed detection logic and edge cases.
By default this skill checks only what changed — it does NOT lint or test the whole project. Post-change verification stays fast and focused on the current work; the complete whole-project gate runs later at ship time (pre-ship.sh).
unstaged + untracked:
BASE=$(git merge-base HEAD origin/HEAD 2>/dev/null \
|| git merge-base HEAD main 2>/dev/null \
|| git merge-base HEAD master 2>/dev/null)
{ [ -n "$BASE" ] && git diff --name-only "$BASE"...HEAD
git diff --name-only
git diff --name-only --cached
git ls-files --others --exclude-standard
} | sort -unpx eslint <files>, ruff check <files>).jest --findRelatedTests,vitest related, the changed test files for pytest).
tsc --noEmitpass is unsound and would miss cross-file breakage.
coverage) and reported as SCOPED.
Fallbacks: if git is unavailable, or no changed files are detected, run the whole project (equivalent to --full). Pass --full to force a complete whole-project run — use it for releases and CI.
See references/project-detection.md for per-language scoped command mappings.
Execute each step in order. Stop immediately on first failure — do not continue to the next step.
changed set; build + type-check run whole-program. --full runs every step across the whole project.
--full)--full)--full only (a related-tests run does not reflect global coverage).nycrc, jest.config, pyproject.toml [tool.coverage], etc.)--coverage-threshold N flag provided: override with N%## Verification Report
- Build: PASS (npm run build, 4.2s)
- Lint: PASS (0 errors, 2 warnings)
- Type-check: PASS (0 errors)
- Tests: PASS (142 passed, 0 failed, 3 skipped)
- Coverage: PASS (87% vs 80% threshold)
**Overall: PASS** — ready for reviewIn scoped (default) mode, Lint and Tests note the changed-file count and Coverage shows SCOPED:
- Lint: PASS (3 changed files, 0 errors)
- Tests: PASS (related to 3 changed files — 18 passed, 0 failed)
- Coverage: SCOPED (run with --full for global coverage)Failure example (stops after lint):
## Verification Report
- Build: PASS (npm run build, 3.8s)
- Lint: FAIL (3 errors in src/auth.ts:12, src/user.ts:45)
- Type-check: SKIPPED (lint failed)
- Tests: SKIPPED (lint failed)
- Coverage: SKIPPED (lint failed)
**Overall: FAIL** — fix lint errors before proceeding
Errors:
src/auth.ts:12 error 'password' is assigned but never used no-unused-vars
src/user.ts:45 error Expected '===' but saw '==' eqeqeq| Flag | Effect |
|---|---|
--full | Check the whole project (build+lint+test+coverage across all files). Use for releases/CI. Default is changed-files scope |
--coverage-threshold N | Override coverage threshold with N% |
--skip-build | Skip build step (use if build runs separately) |
--skip-coverage | Skip coverage check (use for quick verification) |
config or dependencies (package.json, lockfiles, tsconfig*, ESLint/Prettier config, jest/vitest/pytest/ruff config, CI workflows, oxlint), scoping is unsafe — those affect the whole project. Run the whole project instead.
source files, related-tests scoping finds nothing — fall back to --full to confirm nothing downstream broke.
pnpm-lock.yaml, yarn.lock, or bun.lockb before defaulting to npmpackage.json found, ask user which workspace to verify or run from root.simplecov config may not exist; default to 80% threshold if missing~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.