strict-validation-setup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited strict-validation-setup (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The skill ships two distinct concerns split by temporal phase:
init; this skill only ensures it exists and references the per-task pattern)..agent-tasks/<task-id>/GOALS.md per task plus failing-test scaffolding co-located with it.These never mix. Task goals never go into AGENTS.md (would leak as project policy). Project invariants never go into per-task GOALS.md (would duplicate per task and drift).
| Skill | Owns |
|---|---|
| `strict-validation-setup` | Strict-mode tooling configs + per-task GOALS.md convention (this file) |
init | AGENTS.md authoring (project-stable) — defer to it for content |
test-driven | TDD discipline (RED → GREEN → REFACTOR) — defer for test-writing methodology |
type-driven | Refined-type / typestate specs — defer for type-system invariants |
design-by-contract | Pre/post conditions, runtime contracts — defer for assertion patterns |
validation-first | State-machine specs (typestate / FSM / actor) — defer for FSM modeling |
tests-adversarial | Assumption-violation tests — defer for the adversarial test pattern |
setup-pre-commit | Commit-hook installation — defer for hook tooling |
setup-gitignore | Gitignore patterns — defer for ignore-file composition |
Duplication with the existing skills was audited and accepted; bodies cite each rather than re-doing the work. When the surface narrows to a single concern above, defer.
Detect the ecosystem from manifests, then write strict-mode config per the relevant references/<ecosystem>.md. Idempotency: merge with existing config; raise if a destructive overwrite would be required and --overwrite is not explicit. Never silently replace.
Languages with bundled references (Q5-approved set; framework specifics deferred to a follow-up):
references/typescript.mdreferences/python.mdreferences/rust.mdreferences/go.mdreferences/ocaml.mdLanguages noted but not yet bundled — write deferred per Q8 rollback path: C++, Java, Kotlin, plus framework specifics (Spring Boot, Nest, React-strict). When the user invokes the skill on one of these, surface the gap explicitly and propose authoring the reference now or escalating to a follow-up commit.
.agent-tasks/<task-id>/GOALS.md or whatever path the project chooses). Defer authoring the AGENTS.md content to `init` — this skill only ensures the file exists and contains the goal-location pointer..agent-tasks/<task-id>/tests/. Cleaned up after the task merges.The architectural rule: task A's goals never appear in AGENTS.md. AGENTS.md never contains task-specific success criteria. If the line blurs, surface and refuse.
For the current task, translate the user's stated goal into failing tests / contract assertions. The tests live in .agent-tasks/<task-id>/tests/ alongside the GOALS.md. The loop runs until the tests pass. Goals therefore exist both as prose (GOALS.md) and as code (tests).
Three sub-shapes, decide while drafting per task:
references/ (per-ecosystem). Pick the matching language template; let the user fill specifics.The term verifiable goals (Devin Agents101, Jun 2025) is preferred over TDD-for-agents (non-idiomatic in 2026 production stacks).
Pairs with llm-self-loop runtime: this skill runs once at bootstrap, then llm-self-loop runs many times against the gates and goal files this skill installed. The pair is: bootstrap → run-many.
Bootstrap is a one-shot mode. After running, do not stay resident. The loop that follows is llm-self-loop's territory.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.