biome-v2 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited biome-v2 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Version: 2.x Docs: https://biomejs.dev/
# Check (format + lint + organize imports)
biome check . # Read-only check
biome check --write . # Apply safe fixes + formatting
biome check --unsafe . # Apply unsafe fixes (requires --write)
# Lint only
biome lint ./src
biome lint --write ./src # Apply safe fixes
# Format only
biome format --write ./src
# CI mode (read-only, optimized output)
biome ci ./src
# VCS-based filtering
biome check --staged # Only staged files
biome check --changed # Changed vs default branch
biome check --since=origin/develop
# Migrate from ESLint/Prettier
biome migrate eslint --write
biome migrate prettier --writebiome.json){
"formatter": {
"enabled": true,
"indentStyle": "space", // "tab" | "space"
"indentWidth": 2,
"lineWidth": 120,
"lineEnding": "lf",
"bracketSpacing": true
},
"javascript": {
"formatter": {
"quoteStyle": "single", // "single" | "double"
"semicolons": "always", // "always" | "asNeeded"
"trailingCommas": "es5" // "all" | "es5" | "none"
}
}
}{
"linter": {
"enabled": true,
"rules": {
"recommended": true,
"suspicious": {
"noExplicitAny": "error"
},
"style": {
"useImportType": "error",
"noNonNullAssertion": "warn"
},
"correctness": {
"noUnusedImports": "error",
"noUnusedVariables": "error"
}
}
}
}Rule severity levels: "off" | "warn" | "error" | "info"
Rule groups:
accessibility — A11y checkscomplexity — Overly complex codecorrectness — Guaranteed incorrect/useless codeperformance — Efficiency improvementssecurity — Vulnerabilitiesstyle — Code style consistencysuspicious — Likely incorrect patterns{
"vcs": {
"enabled": true,
"clientKind": "git",
"useIgnoreFile": true,
"defaultBranch": "main"
}
}{
"assist": {
"actions": {
"source": {
"organizeImports": "on"
}
}
}
}Apply different settings to specific file patterns:
{
"overrides": [
{
"includes": ["**/__tests__/**", "**/*.test.ts"],
"linter": {
"rules": {
"suspicious": { "noExplicitAny": "off" }
}
}
}
]
}{
"files": {
"includes": ["**", "!**/node_modules", "!**/dist"],
"maxSize": 1048576
}
}Glob patterns:
* — Files only (not directories)** — Recursive!pattern — Exclude!!pattern — Force-ignore (prevents indexing)| Rule | Group | Default | Description |
|---|---|---|---|
noExplicitAny | suspicious | off | Disallow any type |
useImportType | style | off | Promote import type for types |
noUnusedImports | correctness | error | Remove unused imports |
noUnusedVariables | correctness | error | Detect unused variables |
noNonNullAssertion | style | warn | Discourage ! operator |
useConst | style | warn | Prefer const over let |
noForEach | complexity | warn | Prefer for-of over .forEach() |
// biome-ignore lint/suspicious/noExplicitAny: legacy code
function legacyFunction(data: any) {}
// biome-ignore lint/suspicious/noExplicitAny lint/style/useConst: testing
let testVar: any = 'test';Install extension: biomejs.biome
.vscode/settings.json:
{
"[typescript]": {
"editor.defaultFormatter": "biomejs.biome"
},
"[javascript]": {
"editor.defaultFormatter": "biomejs.biome"
},
"editor.codeActionsOnSave": {
"source.fixAll.biome": "explicit",
"source.organizeImports.biome": "explicit"
}
}Default indentation is tabs, not spaces — Override with indentStyle: "space" if needed.
Default quotes are double, not single — Override with quoteStyle: "single".
97% Prettier compatibility — Some edge cases format differently. Not a drop-in replacement.
VCS integration required for .gitignore — Enable vcs.enabled: true to respect .gitignore (not enabled by default).
node_modules always ignored — Even if not in files.ignoreUnknown.
`--write` required for fixes — biome check without --write is read-only.
`--unsafe` requires `--write` — Cannot apply unsafe fixes without write mode.
Rule configuration object vs severity — Rules accept either a string ("error") or object ({ "level": "error", "options": {} }).
Overrides apply in order — Later overrides win. Be careful with order-dependent config.
Migration overwrites biome.json — Commit before running biome migrate.
Type-aware linting in v2 — Doesn't rely on TypeScript compiler (unlike ESLint).
Install with --save-exact — Avoid unexpected breaking changes across minor versions.
{
"vcs": { "enabled": false }
}{
"vcs": {
"enabled": true,
"clientKind": "git",
"useIgnoreFile": true
}
}biome format --write .
biome lint --write .biome check --write .{
"linter": {
"rules": {
"suspicious": { "noExplicitAny": "off" }
}
}
}{
"overrides": [{
"includes": ["**/__tests__/**"],
"linter": {
"rules": {
"suspicious": { "noExplicitAny": "off" }
}
}
}]
}{
"linter": {
"rules": {
"correctness": { "noUnusedImports": "off" }
}
}
}{
"linter": {
"rules": {
"correctness": { "noUnusedImports": "error" }
}
}
}~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.