assess-impact — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited assess-impact (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Understand the potential blast radius of changes before making them by analyzing dependencies, coupling patterns, and ownership.
Omen CLI must be installed and available in PATH.
Use the impact command to get transitive callers and callees in one call:
omen -f json impact --symbol <symbol-name> --depth 2This returns affected files, caller/callee BFS levels, and the total count — much faster than building the picture manually.
To inspect a specific symbol first:
omen -f json symbol --name <symbol-name>Run the dependency graph analysis for file-level coupling:
omen -f json graph --compactIdentify:
Run the temporal coupling analysis:
omen -f json temporalFiles with high temporal coupling to the target often need to change together even without explicit imports.
Run the ownership analysis:
omen -f json ownershipIdentify:
Classify impact by type:
| Category | Description | Action |
|---|---|---|
| Direct | Explicit imports/calls | Will break if signature changes |
| Implicit | Temporal coupling | May break due to shared assumptions |
| Behavioral | Same owner/team | Likely understands the change |
| Unknown | No coupling, different owner | Needs extra review |
Present impact analysis as:
# Change Impact: `target/file.go:FunctionName`
## Direct Dependencies (will break)
- `consumer/a.go` - calls FunctionName directly
- `consumer/b.go` - uses returned type
- `test/target_test.go` - tests the function
## Implicit Dependencies (may break)
- `related/cache.go` - 0.85 temporal coupling
- Always changes with target
- Likely shares state or assumptions
- `related/config.go` - 0.72 temporal coupling
- Often changes together
- May depend on same configuration
## Stakeholders to Notify
- [email protected] - Primary owner of target (85% of commits)
- [email protected] - Owns consumer/a.go
- [email protected] - Owns related/cache.go
## Risk Assessment
- **Blast Radius**: 5 files directly, 12 files transitively
- **Coupling Risk**: 2 files with implicit dependencies
- **Team Impact**: 3 developers should be notified
## Recommended Approach
1. Coordinate with alice (primary owner)
2. Update tests in target_test.go first
3. Check related/cache.go for shared assumptions
4. Notify bob and charlie before mergingStrategies to minimize blast radius:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.