td-feature-qa-28805f — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited td-feature-qa-28805f (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Most defects here live at boundaries, and a tool that returns success can still cook to errors or a black frame. So: read both sides of every boundary together, and check errors after the network cooks, not just the create_* return flag. Run incrementally — validate each feature as it lands so an early boundary bug doesn't propagate.
npm run typecheck · npm run build · npm test./node_modules/.bin/biome check . (NOT npm run lint — RTK proxy gives a false ESLint parse error)npm run validate:recipes · npm run test:bridge (python3 -m unittest discover -s td/tests)| Boundary | Left (producer) | Right (consumer) | Compare |
|---|---|---|---|
| Tool ↔ CLI | tool's Zod inputSchema | command in src/cli/agent.ts | every param reachable from CLI; types/defaults align; name maps to the right handler |
| Tool ↔ registry | register… export | layer*/index.ts + tools/index.ts | actually registered + aggregated, not just written |
| Tool ↔ docs | live registry | generated docs/reference/tools.md | regenerates and includes the new tool |
…Impl ↔ test | real return / isError shape | msw test assertions | test exercises the actual shape, not a cast-away generic |
| Code ↔ TD | operator types created | what this build can create | optype exists + is createable (dir(td) suffix-match over-counts; ~22 names not createable; KB lags ~14 ops) |
| Bridge ↔ client | td/ endpoint/payload | touchDesignerClient.ts + validators.ts envelope | response shape matches the Zod validator |
Policy: offline gates always; live when available. Call get_td_info first.
get_preview, and check get_td_node_errors after it cooks.Before any live mutation, record the exact disposable PID/project/port and confirm the artist PID owns none of those resources. Do not probe the app binary with guessed flags and do not use Accessibility/menu/Textport automation when multiple TD processes are open. After Python bridge edits, restart only the disposable runtime, verify the loaded module paths and confirm arbitrary exec is disabled before calling product routes.
Live gotchas to rule out before declaring a bug:
gain (it's brightness1); no cross-container wires (Select TOP).op('/').time.play is false — check it before concluding a reactive chain is dead.mcp__tdmcp__* runs the old build until restarted; editing td/ doesn't reload the running bridge (reload_bridge / restart) — suspect stale modules before "fixing" correct code.out vec4 fragColor + a self-supplied time uniform.A report at _workspace/04_qa_<feature|batch>.md with three explicit buckets — PASS, FAIL (file:line + concrete fix + owning agent), UNVERIFIED (what wasn't checked + why, e.g. bridge offline). Never silently skip a check; list it as UNVERIFIED.
td-builder for handler/schema/test, td-integrator for wiring/CLI/docs); boundary bugs go to both. Re-validate after each fix.vitest run <yourfile>).~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.