td-feature-build-bda7cc — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited td-feature-build-bda7cc (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Implement exactly what the spec says, in your own files, green in isolation. The parallel-build contract is simple: new files only; never edit anything shared (layer*/index.ts, tools/index.ts, cli/agent.ts, docs). That isolation is what lets builders run concurrently.
Every tool file exports a pure …Impl and a register…. Mirror a neighbour in the same layer, but the shape is:
import { z } from "zod";
import type { ToolRegistrar } from "../types.js"; // note the .js extension
import { runBuild, errorResult } from "../result.js";
export const fooSchema = z.object({
name: z.string().default("foo"),
intensity: z.number().min(0).max(1).default(0.5),
});
export async function fooImpl(ctx: ToolContext, args: z.infer<typeof fooSchema>) {
// build via the client; never throw — return errorResult / runBuild on failure
}
export const registerFoo: ToolRegistrar = (server, ctx) =>
server.registerTool(
"create_foo",
{ title: "…", description: "…", inputSchema: fooSchema.shape },
(args) => fooImpl(ctx, args),
);ctx is the ToolContext ({ client, knowledge, recipes, logger, vault?, allowRawPython }). …Impl is pure and unit-testable with a mocked client.
isError results with errorResult / runBuild / friendlyTdError. Return, don't throw.noUncheckedIndexedAccess is on — guard indexed access../node_modules/.bin/biome check <yourfiles> directly — npm run lint fails with a false ESLint parse error under the RTK proxy.tests/unit/<feature>.test.ts. Do not touch shared files; report your export names to the integrator instead.buildPayloadScript (encodes args as __PAYLOAD_B64__), execute through the client, parse the reply with parsePythonReport.executePythonScript payload must assign a `result` variable — the bridge reads it back.td/ modules: keep TD-globals (op, app, project) inside functions so modules import cleanly, and run python3 -m py_compile on changed files.gain — use brightness1. There is no ParMode.out vec4 fragColor;; there is no built-in uTime (add your own uniform); avoid preamble #define collisions (F1/F2). KB shader snippets are references, not drop-in.msw (no live TouchDesigner). Assert the real returned shape — operators created, params set, wiring, and isError paths — not a cast-away generic.npx vitest run tests/unit/<feature>.test.ts. Green + biome-clean = done. You do NOT run the full build (the integrator does after wiring).The new tool file + test file, plus a note at _workspace/02_build_<feature>.md: files created, exported symbols (<feature>Impl, register<Feature>), target layer index, what the test asserts, and any spec deviation + reason. Then tell td-integrator the export names.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.