verifying-claims — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited verifying-claims (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Check that what a document says about code is true, by reading the document, the code, and the tests together and reporting where they disagree.
v0.1 was a comment-DSL: you hand-wrote <!-- claim: ... --> next to prose and a script checked the comment against the code. That had a fatal gap — the comment and the prose were two artifacts stapled together, and only the comment was checked, while humans read the prose. The prose could lie with a green run.
v0.2 drops the DSL. The reviewer is the agent: it reads the prose's meaning directly and compares it to what the code does and what the tests assert. No shadow copy, because the thing being checked is the thing the human reads. (Existing tools already own the alternatives — Gherkin binds executable scenarios, Lean's Verso transcludes facts into prose, TDD couples code to tests. This fills the remaining slot: free-prose documentation, judged.)
This skill does NOT gate merges and is NOT a test framework.
cheap, auditable, gated. A green check is something you can hold CI to.
That needs semantic judgment across artifacts, which is non-deterministic and fallible — so it runs as a triggered review (before docs ship, on request, as a sweep), not as a per-commit gate. "The agent said the docs match" is not a guarantee you gate a merge on; it's a review you act on.
Tests are the anchor. The docs are correct when they agree with what the tests assert about the code. So write/keep good tests first; this skill keeps the prose pinned to them.
SRC --tests TESTS`. It ast-parses source (no imports, no execution) and bundles the document text, the public API surface, and the test inventory.
code (signatures, behavior, return shapes, defaults, guarantees, examples). Do this by reading; there are no claim markers.
the contradicting reality (file/function). Use the verdicts below.
that need a test (an UNSUPPORTED claim is a missing test, not just a doc bug).
regressed and the doc caught it).
nothing protects it from future drift. Surface as a missing test.
docs/api.md still match pkg/?"Run it at moments that matter — pre-publish, post-refactor, on a docs PR — not on every commit. The deterministic gate is the test suite; this is the layer tests can't reach.
output as a careful review, not a proof.
test run. Don't wire it where a cheap deterministic check belongs.
are correct. Garbage tests → confident-but-wrong PASS. TDD discipline upstream still matters.
scripts/gather_context.py — deterministic input bundler (doc + API surface +test inventory), ast-only, no imports.
references/drift-report-example.md — what a review report looks like.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.