td-feature-qa-532f6b — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited td-feature-qa-532f6b (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Most defects here live at boundaries, and a tool that returns success can still cook to errors or a black frame. So: read both sides of every boundary together, and check errors after the network cooks, not just the create_* return flag. Run incrementally — validate each feature as it lands so an early boundary bug doesn't propagate.
npm run typecheck · npm run build · npm test./node_modules/.bin/biome check . (NOT npm run lint — RTK proxy gives a false ESLint parse error)npm run validate:recipes · npm run test:bridge (python3 -m unittest discover -s td/tests)| Boundary | Left (producer) | Right (consumer) | Compare |
|---|---|---|---|
| Tool ↔ CLI | tool's Zod inputSchema | command in src/cli/agent.ts | every param reachable from CLI; types/defaults align; name maps to the right handler |
| Tool ↔ registry | register… export | layer*/index.ts + tools/index.ts | actually registered + aggregated, not just written |
| Tool ↔ docs | live registry | generated docs/reference/tools.md | regenerates and includes the new tool |
…Impl ↔ test | real return / isError shape | msw test assertions | test exercises the actual shape, not a cast-away generic |
| Code ↔ TD | operator types created | what this build can create | optype exists + is createable (dir(td) suffix-match over-counts; ~22 names not createable; KB lags ~14 ops) |
| Bridge ↔ client | td/ endpoint/payload | touchDesignerClient.ts + validators.ts envelope | response shape matches the Zod validator |
Policy: offline gates always; live when available. Call get_td_info first.
get_preview, and check get_td_node_errors after it cooks.Live gotchas to rule out before declaring a bug:
gain (it's brightness1); no cross-container wires (Select TOP).op('/').time.play is false — check it before concluding a reactive chain is dead.mcp__tdmcp__* runs the old build until restarted; editing td/ doesn't reload the running bridge (reload_bridge / restart) — suspect stale modules before "fixing" correct code.out vec4 fragColor + a self-supplied time uniform.A report at _workspace/04_qa_<feature|batch>.md with three explicit buckets — PASS, FAIL (file:line + concrete fix + owning agent), UNVERIFIED (what wasn't checked + why, e.g. bridge offline). Never silently skip a check; list it as UNVERIFIED.
td-builder for handler/schema/test, td-integrator for wiring/CLI/docs); boundary bugs go to both. Re-validate after each fix.vitest run <yourfile>).~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.