nasde-benchmark-from-history — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited nasde-benchmark-from-history (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Generate NASDE benchmark tasks by mining git history. You analyze commits, diffs, and PR descriptions to identify self-contained changes that make good evaluation candidates, then generate task files with user approval.
nasde init first, or use the nasde-benchmark-creator skill)When generating tests/test.sh, solution/solve.sh, or environment/Dockerfile on a Windows host, write them with LF line endings or every trial fails with bash: required file not found (the kernel reads #!/bin/bash\r as the shebang). See the full explanation and .gitattributes template in the nasde-benchmark-creator skill.
Quick rules:
.gitattributes enforcing *.sh text eol=lf and Dockerfile text eol=lf. nasde init creates this. If the existing project lacks it, create `.gitattributes` before generating any task files.path.write_text(content, encoding="utf-8", newline="") — never the bare default which translates \n→\r\n on Windows.find tasks/<new-task> -name '*.sh' -o -name 'Dockerfile' | xargs file | grep CRLF should print nothing.Ask the user:
abc123..def456)HEAD~20..HEAD)gh pr view)If the user says "just find good candidates," proceed to Step 2 with the last 50 commits.
For each commit in the range, read the diff and evaluate whether it's a good benchmark candidate.
Good candidates have:
Bad candidates (skip these):
For each candidate, extract:
before_ref: the parent commit hash (the state the agent will start from)after_ref: the commit hash (the reference solution)description: what the change does (from commit message / PR description)files_changed: list of modified fileshas_tests: whether the commit includes test changesestimated_difficulty: easy / intermediate / hard (based on diff size and complexity)Present a numbered list of candidates. For each one, show:
[1] abc1234 — "Add discount calculation for threshold-based pricing"
Files: src/Pricing/ThresholdDiscount.cs, tests/Pricing/ThresholdDiscountTests.cs
Difficulty: intermediate | Has tests: yes
Before: abc1233 (parent commit)
[2] def5678 — "Fix race condition in order processing pipeline"
Files: src/Orders/OrderProcessor.cs, src/Orders/OrderLock.cs
Difficulty: hard | Has tests: yes
Before: def5677 (parent commit)
[3] ...Ask the user to select which candidates to turn into tasks (comma-separated numbers, or "all").
For each selected candidate, proceed to Step 4.
For each approved candidate, generate the full task directory structure. Work through each file with the user — present it, get approval or edits, then write it.
Generate from commit metadata. nasde-specific fields go under [nasde.*].
version = "1.0"
[task]
name = "<benchmark-name>/<slugified-commit-description>" # Harbor requires org/name format
description = "<commit message, cleaned up>"
[metadata]
difficulty = "<estimated_difficulty>"
language = "<detected-language>"
framework = "<detected-framework>"
source_commit = "<after_ref>"
[agent]
timeout_sec = 1800 # Rule of thumb: estimated_time_minutes × 60
[environment]
memory_mb = 4096 # Claude Code needs 4096+, default 2048 is too low.
[verifier]
timeout_sec = 300 # Timeout for tests/test.sh
[nasde.source] # Only needed when task has no environment/Dockerfile (auto-generation).
git = "<repo-url-or-local-path>"
ref = "<before_ref>"For [nasde.source] git:
Generate from the commit message, PR description (if available via gh), and the diff:
# Task: <Human-readable task name>
## Context
You are working in a <language/framework> codebase located at `/app`.
<Brief description of the project and the area of code being modified.>
## Requirement
<What the agent must implement/fix/change. Derived from the commit message and diff.
Be specific — describe the expected behavior, not the implementation approach.
Include concrete examples where possible.>
## Scope
- Files likely to be modified: <list based on the actual commit diff>
- Do NOT modify: <files outside the commit's scope, especially tests if they exist>
## Quality Expectations
<Inferred from the codebase style — mention patterns visible in surrounding code.>
## Success Criteria
<Numbered list derived from what the commit actually changed and what tests verify.>Important: The instruction must describe the problem to solve, not the solution. Don't leak implementation details from the actual commit diff into the instruction. The agent should arrive at a solution independently.
Present the generated instruction to the user for review. They may want to:
Generate based on the repo's tech stack (detected from files like package.json, *.csproj, Cargo.toml, requirements.txt, go.mod):
FROM <base-image-for-detected-stack>
RUN apt-get update && apt-get install -y git curl wget ca-certificates && rm -rf /var/lib/apt/lists/*
WORKDIR /app
# Clone at the "before" state — the commit BEFORE the fix
RUN git clone <repo-url> . && git checkout <before_ref>
# Install dependencies
RUN <dependency-install-command>
# Verify the environment builds
RUN <build-command>
CMD ["/bin/bash"]Base image selection:
.csproj / .sln → mcr.microsoft.com/dotnet/sdk:8.0package.json → node:20requirements.txt / pyproject.toml → python:3.12Cargo.toml → rust:1.78go.mod → golang:1.22If the commit includes test files, generate a verifier that runs those tests:
#!/bin/bash
cd /app
echo "Step 1: Verifying build..."
if <build-command>; then
echo "✓ Build succeeded"
else
echo "✗ Build failed"
echo 0 > /logs/verifier/reward.txt
exit 1
fi
echo "Step 2: Running tests..."
if <test-command-targeting-relevant-tests>; then
echo "✓ Tests pass"
else
echo "✗ Tests failed"
echo 0 > /logs/verifier/reward.txt
exit 1
fi
echo "EVALUATION PASSED ✓"
echo 1 > /logs/verifier/reward.txt
exit 0If the commit does NOT include tests, inform the user and offer options:
Generate a per-task rubric using the benchmark project's assessment_dimensions.json. For each dimension, create scoring criteria specific to this task:
# Assessment Criteria: <Task Name>
Evaluate the agent's solution across the following dimensions.
## 1. <Dimension from assessment_dimensions.json> (0–<max_score>)
| Score | Criteria |
|-------|----------|
| 0 | <worst case — specific to this task> |
| ... | <intermediate levels> |
| <max> | <best case — specific to this task> |
**Key checks:**
- <What to look for in the code, specific to this task and dimension>Present to the user for review — they know the codebase best and can add nuance.
Offer to generate a reference solution script that applies the actual commit diff:
#!/bin/bash
cd /app
git cherry-pick <after_ref> --no-commitOr, if cherry-pick won't apply cleanly, generate a patch-based approach:
#!/bin/bash
cd /app
git diff <before_ref> <after_ref> | git applyThis is useful for verifying that test.sh passes on a known-good solution.
After all selected tasks are generated:
assessment_dimensions.json is missing or empty, prompt the user to define dimensions (delegate to nasde-benchmark-creator Step 3). docker build -t benchmark-test-<task-name> -f tasks/<task-name>/environment/Dockerfile . docker run --rm -v $(pwd)/tasks/<task-name>/solution:/solution \
-v $(pwd)/tasks/<task-name>/tests:/tests \
benchmark-test-<task-name> bash -c "
bash /solution/solve.sh && mkdir -p /logs/verifier && bash /tests/test.sh
"Expected: exit 0 and reward.txt contains 1.
nasde run --variant <any-variant> --tasks <task-name> --without-eval -C <benchmark-dir>source.git. No need to push to a public remote for company repos.nasde-benchmark-creator handles the project scaffold, dimensions, and variants. Use them together.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.