trace-mcp-pre-commit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited trace-mcp-pre-commit (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Before creating a commit or opening a pull request, run the trace-mcp validation suite. Fix any critical or high findings before committing.
scan_security({ rules: ["all"] })OWASP Top-10 vulnerability scan across the changed scope. If the change touches untrusted data flows, add:
taint_analysis({})Trace untrusted sources to sensitive sinks (SQL, shell, file system, HTTP).
check_quality_gates({ scope: "changed" })Validates complexity, coverage, duplication, and any project-configured gates on only the files you changed.
detect_antipatterns({})Flags N+1 queries, eager loading, inefficient iteration, and language-specific performance footguns.
compare_branches({ branch: "current" })Produces a symbol-level diff (functions added/removed/modified, signatures changed, exports changed). Use this as the basis for an accurate PR description instead of a raw line diff.
predict_bugs({})
get_risk_hotspots({})Flags files where the combination of high complexity and high churn makes regressions likely. If your change touches a hotspot, add extra tests.
If the commit is part of a larger series, consider:
get_changed_symbols({ since: "<base-ref>" })to generate an accurate changelog entry grounded in the symbol graph rather than commit messages.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.