nasde-benchmark-from-public-repos — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited nasde-benchmark-from-public-repos (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Build a diverse NASDE benchmark by curating tasks from multiple public GitHub repositories. Designed for validating universal skills — skills that should work across different languages, frameworks, project sizes, and architectural styles.
nasde init first, or use the nasde-benchmark-creator skill)When generating tests/test.sh, solution/solve.sh, or environment/Dockerfile on a Windows host, write them with LF line endings or every trial fails with bash: required file not found (the kernel reads #!/bin/bash\r as the shebang). See the full explanation and .gitattributes template in the nasde-benchmark-creator skill.
Quick rules:
.gitattributes enforcing *.sh text eol=lf and Dockerfile text eol=lf. nasde init creates this. If the existing project lacks it, create `.gitattributes` before generating any task files.path.write_text(content, encoding="utf-8", newline="") — never the bare default which translates \n→\r\n on Windows.find tasks/<new-task> -name '*.sh' -o -name 'Dockerfile' | xargs file | grep CRLF should print nothing.Ask the user:
Based on the skill description, define axes of variation that the benchmark should cover. Present these to the user as a table:
| Axis | Values to cover | Why it matters |
|---|---|---|
| Language | Python, TypeScript, Go, Rust, C# | Refactoring idioms differ per language |
| Project size | Small (<5K LOC), Medium (5-50K), Large (>50K) | Large codebases stress navigation and context |
| Test coverage | Extensive tests, Minimal tests, No tests | Refactoring with no safety net is harder |
| Architecture | Monolith, Microservice, Library | Different refactoring patterns apply |
| Difficulty | Extract function, Split module, Restructure package | Increasing complexity |
Not every cell in the matrix needs a task. Aim for 8–15 tasks that provide meaningful coverage across the axes. Ask the user which axes matter most — they may want to emphasize language diversity over project size, or vice versa.
For each cell in the matrix that needs coverage, search for public repositories that fit.
Good source repositories have:
Search strategies:
For each candidate repo, present:
[1] github.com/user/repo — "Description from GitHub"
Language: Python | Size: ~15K LOC | Stars: 2.3K | License: MIT
Tests: pytest suite, good coverage
Why: Medium Python project, clean architecture, good refactoring target
Proposed task: "Extract the database access layer into a repository pattern"
[2] github.com/user/repo2 — "Description from GitHub"
Language: TypeScript | Size: ~40K LOC | Stars: 890 | License: Apache 2.0
Tests: Jest, moderate coverage
Why: Large TS project, component-heavy, tests UI refactoring
Proposed task: "Split the UserDashboard component into focused sub-components"Ask the user to select which repos and tasks to include.
For each approved repo+task pair, generate the full task directory. Work through each file with the user.
Unlike nasde-benchmark-from-history (which uses a specific commit), here you choose a state of the repo that presents the problem to solve:
source.ref to a specific commit hash on main for reproducibility.Always pin to a specific commit hash, not a branch name — branches move, hashes don't.
version = "1.0"
[task]
name = "<benchmark-name>/<language>-<repo-slug>-<task-slug>" # Harbor requires org/name format
description = "<What the agent must do>"
[metadata]
difficulty = "<easy|intermediate|hard>"
language = "<language>"
framework = "<framework>"
source_repo = "https://github.com/<owner>/<repo>"
diversity_axes = ["<axis:value>", "<axis:value>"]
[agent]
timeout_sec = 1800 # Rule of thumb: estimated_time_minutes × 60
[environment]
memory_mb = 4096 # Claude Code needs 4096+, default 2048 is too low.
[verifier]
timeout_sec = 300
[nasde.source] # Only needed when task has no environment/Dockerfile (auto-generation).
git = "https://github.com/<owner>/<repo>.git"
ref = "<pinned-commit-hash>"The [metadata] diversity_axes helps track coverage across the matrix. Always pin [nasde.source] ref to a specific commit hash, not a branch name.
Write a task instruction that:
# Task: <Descriptive name>
## Context
You are working in `/app`, a <language> <framework> project that <brief description>.
The project structure relevant to this task:
<tree of relevant directories/files>
## Requirement
<What needs to change. Describe the problem, not the solution.
Example: "The UserService class handles authentication, authorization, profile management,
and notification dispatch. It's 800 lines and growing. Separate these concerns into
focused services.">
## Scope
- Focus on: <specific files/directories>
- Do NOT modify: <test files, configuration, unrelated modules>
- Preserve: <all existing public APIs, test behavior>
## Quality Expectations
- Follow <language> idioms and the project's existing style
- Maintain or improve test coverage
- Keep changes minimal — change what needs changing, nothing more
## Success Criteria
1. <Specific, testable criterion>
2. <Specific, testable criterion>
3. All existing tests continue to passImportant for universal skill benchmarks: Write the instruction as if the agent has no special skill. The skill configuration is injected via the variant's CLAUDE.md — the instruction describes the raw problem.
Each repo needs its own Dockerfile. Detect the stack and generate:
FROM <base-image>
RUN apt-get update && apt-get install -y git curl wget ca-certificates && rm -rf /var/lib/apt/lists/*
WORKDIR /app
RUN git clone https://github.com/<owner>/<repo>.git . && git checkout <pinned-hash>
# Install dependencies
RUN <dependency-install-command>
# Verify build works at the "before" state
RUN <build-or-compile-command>
CMD ["/bin/bash"]Test the Dockerfile before moving on:
docker build -t benchmark-test-<task-name> -f tasks/<task-name>/environment/Dockerfile .For public repos, the verifier typically:
#!/bin/bash
cd /app
echo "Step 1: Verifying build..."
if <build-command>; then
echo "✓ Build succeeded"
else
echo "✗ Build failed"
echo 0 > /logs/verifier/reward.txt
exit 1
fi
echo "Step 2: Running existing tests..."
if <test-command>; then
echo "✓ Existing tests pass"
else
echo "✗ Existing tests failed — regression detected"
echo 0 > /logs/verifier/reward.txt
exit 1
fi
echo "Step 3: Checking task-specific criteria..."
# Example: verify a specific file was created or a class was split
if <task-specific-check>; then
echo "✓ Task criteria met"
else
echo "✗ Task criteria not met"
echo 0 > /logs/verifier/reward.txt
exit 1
fi
echo "EVALUATION PASSED ✓"
echo 1 > /logs/verifier/reward.txt
exit 0Task-specific checks depend on the task type:
Use the benchmark project's assessment_dimensions.json and adapt each dimension to this specific task and language:
# Assessment Criteria: <Task Name>
Evaluate the agent's solution across the following dimensions.
This task is in <language> using <framework> — apply language-specific standards.
## 1. <Dimension> (0–<max_score>)
| Score | Criteria |
|-------|----------|
| 0 | <worst — specific to this language and task> |
| ... | ... |
| <max> | <best — specific to this language and task> |
**Key checks:**
- <Language-specific things to look for>Important: Assessment criteria should reflect language idioms. "Good refactoring" looks different in Rust (ownership, lifetimes) vs Python (duck typing, protocols) vs Go (interfaces, embedding).
After all tasks are created, present the filled diversity matrix to the user:
Coverage matrix for "refactoring" skill benchmark:
| Language | Small | Medium | Large |
|------------|-------|--------|-------|
| Python | | ✓ fastapi-extract | |
| TypeScript | | | ✓ dashboard-split |
| Go | ✓ cli-service-layer | | |
| Rust | ✓ error-handling | | |
| C# | | ✓ ddd-aggregate | |
Gaps: No large Python project, no small TypeScript project.Ask the user if they want to fill gaps or if current coverage is sufficient.
nasde run --variant <skill-variant> --tasks <task-name> --without-eval -C <benchmark-dir>CLAUDE.md. This separation lets you test the same tasks with and without the skill.nasde-benchmark-creator handles project scaffold, dimensions, and variants. Use them together.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.