ableton-mind-quality-audit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ableton-mind-quality-audit (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill for broad quality work: complete audits, command matrix validation, security review, usability and flow review, refactor planning, missing-test coverage, release/runtime readiness and follow-up hardening waves.
Use ableton-mind-build for feature phase execution. Use this skill when the goal is to increase repo quality across existing surfaces.
| Track | Agent | Domain |
|---|---|---|
| Lead | quality-audit-lead | scope, triage, severity, fan-in, remediation gate |
| Commands | command-surface-auditor | package scripts, bins, CI commands, docs commands |
| Security | security-supply-chain-auditor | dependencies, scripts, bridge safety, workflows, Docker |
| Usability | usability-flow-auditor | install, doctor, docs, CLI errors, MCP ergonomics |
| Coverage | test-coverage-engineer | missing tests, regression tests, offline fakes |
| Maintainability | refactor-maintainability-engineer | complexity, duplication, boundaries, safe refactors |
| Runtime | runtime-release-auditor | package artifacts, DXT/MCPB, Docker, docs, release gates |
| Gate | qa-integration | cross-boundary verification after fixes |
PLAN.md, _workspace/PROGRESS.md, _workspace/tech-debt.md if present, latest _workspace/qa reports and latest _workspace/quality-audit reports.package.json, pyproject.toml, ruff.toml, biome/eslint/tsconfig/vitest config, .github/workflows and Dockerfile.| Mode | When | Action |
|---|---|---|
| Full audit | User asks for complete audit or quality sweep | Create new audit briefing and launch all tracks |
| Targeted audit | User names one area | Launch only relevant tracks plus lead and QA gate |
| Fix wave | User asks to fix audit findings | Read latest report/backlog, add tests first where feasible, patch bounded items |
| Re-run | User asks to re-run or verify | Re-run the command matrix and affected checks only |
| Status | User asks what is pending | Summarize latest report/backlog without launching changes |
Write _workspace/quality-audit/briefing-{N}.md with:
Classify every command before execution:
| Class | Examples | Default action |
|---|---|---|
| Safe read/check | typecheck, lint, tests, build, docs build, dxt check, dep checks | Run locally |
| Local mutating | lint:fix, format, install remote script, generated graphs | Ask lead; prefer temporary copy or check mode |
| External read | npm audit, npm view, gh read-only checks | Run if network/auth is available and useful |
| Publish/write | npm publish, git push, gh release create/upload, Docker push, registry submit | Do not run without explicit user confirmation |
| Hardware/live | real Ableton Live or Push smoke | Run only when the user confirms the app/hardware is ready |
In Codex local execution, prefix shell commands with rtk proxy when running raw commands from this repo.
Launch tracks in parallel when their write scopes do not overlap. Read-only tracks may run together. If a track needs to edit files, assign a disjoint ownership boundary and remind it that other agents may be editing the repo.
Required track outputs:
The lead writes:
Finding format:
When the user asks to fix findings or when the audit scope explicitly includes fixes:
Build the exact matrix from current files, but these commands are expected in this repo when present:
npm run typecheck
npm run lint
npm test
npm run build
npm run build:dxt:check
npm run docs:build
npm run deps:validate
npm run complexity
npm run complexity:py
npm run lint:py
python3 -m unittest discover -s live/AbletonMind/tests -t live -v
npm pack --dry-run --json
npm audit --omit=dev
docker build -t ableton-mind:audit .Do not pretend hardware, publish, registry or credentialed checks passed. Report them as blocked with exact prerequisites.
Normal flow:
Error flow:
Follow-up flow:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.