class-refactoring — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited class-refactoring (Agent Skill) and scored it 91/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
ignore/disregard/forget … previous instructions sentence.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Improve code structure and quality without changing behavior.
Focus on:
This skill runs in one of two modes, selected by the caller via MODE (default apply):
MODE=cr.Completeness contract (`MODE=cr`). The lens walks the complete guideline set of this skill against the diff — every bullet of Refactoring Guidelines, every bullet of Laravel Context, and the behavior-preservation clauses of the Execution section — not only the DRY / oversized-method subset the caller happens to name in its invocation line. A caller's summary of the lens ("surface DRY duplication and oversized methods") is a description of the common case, never a restriction of the walk. Each matched guideline produces one item, and the caller must render every returned item in the published report — the CR routes it, it never drops it. The routing and de-duplication contract lives in @rules/code-review/general.mdc Refactoring & Tech Debt (DRY) Analysis — diff-scoped detail.
@rules/laravel/laravel.mdc, @rules/laravel/architecture.mdc, @rules/laravel/filament.mdc, and @rules/laravel/livewire.mdc`MODE=cr`: perform Read and Map read-only to ground the proposals in the real code; Verify is the audit you already run. Do not modify code.
Reading, mapping, and verifying come first; refactoring comes last. This pre-flight is blocking — do not edit a single line of production code until all three steps pass, and never act on an assumption you have not confirmed by reading the code.
Only after Read, Map, and Verify are complete may the Test Coverage Gate and the refactor proceed.
`MODE=cr`: do not write tests or commits. Run the coverage check read-only and report any target lines below 100% coverage as a refactoring finding (a refactor cannot land safely without them) — then continue the analysis. The steps below that author tests / commits apply to MODE=apply only.The gate is blocking. Refactoring may not edit a single line of production code until tests for the target lines reach 100% coverage. Satisfy the Test Coverage Contract defined in @rules/refactoring/general.mdc:
@rules/php/core-standards.mdc Testing section). Every line, branch, and condition must already be at 100%.@skills/create-test/SKILL.md to author them; commit them in a dedicated test(scope): cover <area> before refactor commit per @rules/git/general.mdc Allowed Types. The pre-refactor coverage commit and the refactor commit are always two separate commits — never squash them and never mix new tests into the refactor commit.feat(scope): … / fix(scope): … commit, not the refactor commit).@rules/refactoring/general.mdc (stabilize → identify entry points → introduce Action pattern → split responsibilities → modernize → DRY → concurrency). Never propose a big-bang rewrite.@rules/refactoring/general.mdc, @rules/php/core-standards.mdc, @rules/code-testing/general.mdc, and (for Laravel projects) @rules/laravel/laravel.mdc + @rules/laravel/architecture.mdc + @rules/laravel/filament.mdc + @rules/laravel/livewire.mdc. The refactor rewrites the existing code into the target architecture (Action / Service / Repository / ModelManager / Data Validator / Data Builder / DTO per project rules) and the target code-style (naming, structure, parameter count, nesting, design principles). Anything that would deviate from the rules is rewritten until it complies; do not invent ad-hoc structure outside the rule set.test(scope): … commit after the refactor.@rules/refactoring/general.mdc.git log actually reflects that split and reshape it when it does not (split a bundled commit, fixup a scattered one, amend a subject that no longer describes its contents, add the commit a change never got), per @rules/git/general.mdc Git Rules.interface types that have neither at least two non-test consumers nor at least two non-test implementations back into their concrete class. Test doubles, mocks, and fakes do not count toward either threshold. Implementing a framework or vendor interface (e.g. ShouldQueue, HasLabel, Arrayable) is always allowed. Keep a single-implementation, single-consumer project interface only when there is a documented architectural reason — a published package API surface or a plugin extension point with a written contract. See @rules/php/core-standards.mdc Design Principles.@rules/laravel/architecture.mdc "Business Logic Layers"). When a class file contains business logic that spans more than one of these layers, contains business logic that does not fit any of them, or holds an Eloquent model method that crosses the simple-logic boundary (calls services / repositories / model managers, issues new queries, performs persistence side effects, or coordinates multiple entities), propose a refactoring that splits the responsibilities into dedicated classes from the seven-layer list. Surface every detected violation in the refactoring plan with the target layer for each extracted responsibility.@rules/sql/optimalize.mdc "Batch over per-row operations" — ModelManager batchUpdate / batchInsert, whereIn(...)->delete(), or a single bulk read keyed in memory. Keep per-row work only when an explicit side-effect dependency between iterations cannot be batched.@rules/sql/optimalize.mdc "Performance Non-Regression on Query Changes". Capture the original query's baseline (EXPLAIN / EXPLAIN ANALYZE) before the refactor and compare after. If the refactored query is measurably slower, it is not a clean refactor — stop, document why it is slower and the remaining optimization options (or that none exist and why), and surface the trade-off in the refactoring plan / PR description instead of shipping the regression silently. In MODE=cr, raise a slower query introduced by the diff as a finding with the same reason + options requirement.@rules/laravel/architecture.mdc Data Modification (DRY) section (Data Builder, DTO named constructor, Data Validator, ModelManager, Repository).@rules/php/core-standards.mdc Design Principles or, on Laravel projects, @rules/laravel/architecture.mdc. When two refactoring options preserve behavior equally well, pick the shorter, less layered one ("if you write 200 lines and it could be 50, rewrite it"). Reuse existing helpers / Services / Actions / Repositories before extracting a new class. In MODE=cr, surface every such speculative addition the PR diff introduces as a refactoring proposal rather than a code change.@rules/php/core-standards.mdc Documentation. Never propose merely rewording or shortening a comment while leaving the unreadable block intact, and never add a comment as the fix for code you could have made clearer. This applies to the comments already in the class, not only to the ones the refactor would add: a class you restructure is delivered with its pre-existing what-narration removed — the restatements of the signature, the redundant type docblocks, the section banners, the commented-out code, the descriptions the restructuring just made false. Leaving them is not "preserving behavior", it is shipping a rewritten class still explained by prose written for the old one. In MODE=cr, surface each such surviving comment as part of the refactoring proposal for the block it sits in, never as a separate repo-wide comment sweep.__invoke(), or other callable crosses the threshold, propose extracting a dedicated typed DTO and passing it as a single argument, per @rules/php/core-standards.mdc Structure section (parameter counting rules, exemption list, and required fix are defined there).@rules/laravel/architecture.mdc Model Services, a Service-role class that does not extend BaseModelService — and in particular one exposing exactly one public method with the rest private — is an Action wearing a Service name. Propose the conversion: move it to app/Actions/{Domain}/, rename the single public method to __invoke(), keep the helpers private, and update every call site to $action($payload). In MODE=cr, emit it as a written proposal listing the call sites rather than applying the change.@rules/laravel/architecture.mdc Pass-through Action rule, an Action whose entire __invoke() body is a single delegating call to one collaborator — a Model Service method or another Action — with no orchestration of its own (no validation delegation, no DTO / data transformation, no coordination of multiple collaborators, no extra business step, no return-value reshaping) — is a redundant indirection layer and must be collapsed during the refactor. Detect every such pass-through Action touched by the refactor and resolve it by the collaborator it forwards to: (1) the wrapped Service method is used only once in the codebase → move its logic into the Action and delete the method (the Single-use Service method rule), so the Action does real work; (2) the method is reused elsewhere → remove the Action entirely and rewrite the entry point to call the Service method directly ($action($payload) → $service->method($payload)), updating every call site; (3) the body forwards to another Action → delete the outer Action and invoke the inner one from the entry point ($outerAction($payload) → $innerAction($payload)), or merge the two into one Action when the outer name states the use case better and the inner has no other caller — never keep both. A body that adapts around the single call (input mapping, return reshaping, validation delegation, transaction / lock / authorization wrapping) is orchestration, not a pass-through. In MODE=cr, emit each pass-through Action as a written refactoring proposal (target resolution + every call site that must change) rather than applying the change.@rules/laravel/architecture.mdc Repositories and ModelManagers section).app/Livewire/**/*.php, resources/views/livewire/**/*.blade.php, resources/views/**/*.blade.php), analyze its HTML as a tree of UI concerns per @rules/laravel/livewire.mdc HTML / Blade Layout Splitting. Walk every trigger in that section (repeated markup, >150 Blade lines, self-contained wire:* cluster, self-contained data shape, cross-page reuse, independent loading / empty / error state, distinct named UI concern) and propose an extraction for each match. Pick Livewire children only for blocks with their own state / lifecycle / server interaction; pick Blade components for stateless presentation — wrapping presentational markup in a Livewire component just to enable reuse is itself a refactoring finding. Every extracted component must satisfy the Reusability contract in that rule (typed input, one concern, no business logic, events not parent reach-through, independently renderable, correct tree placement, concern-based name). The layout split is a structural refactor — the Test Coverage Gate above applies in spirit: every rendered branch of the touched view (initial render, wire:loading, @empty, error banner, each @if / @foreach arm) must be exercised by a Livewire / Blade feature test committed before the layout refactor, and the same feature tests must stay green through the refactor commit unchanged. PHP --coverage-clover does not measure .blade.php line-by-line, so the binding gate is feature-test parity, not a numeric coverage percentage on the view file.test(scope): cover <area> before refactor commit per @rules/refactoring/general.mdc Test Coverage Contract.test(scope): … commit after the refactor.file:line on the PR diff, the structural problem in one sentence, the concrete consolidation step (target layer per @rules/laravel/architecture.mdc), and the guideline it matched (the bullet in this skill, plus the underlying rule reference — e.g. @rules/laravel/architecture.mdc Pass-through Action rule, @rules/php/core-standards.mdc Design Principles). The guideline reference is what lets the CR route the item and de-duplicate it against its own walks; an item returned without one is incomplete. The CR places in-scope items in its Refactoring (DRY / tech debt) section, out-of-scope structural problems in Refactoring proposals, and items whose underlying rule declares a severity in the matching Critical / Moderate / Minor bucket instead — but it renders every returned item somewhere.Skip this entire section in MODE=cr — a read-only lens pushes nothing.build.xml/phing.xml; fall back to Composer scripts in composer.json)@rules/php/core-standards.mdc PHP Practices)Skip this entire section in MODE=cr — the CR is the caller, so chaining back into it would recurse. Return the findings to the caller and stop.@skills/code-review/SKILL.md directly in this skill's context, passing the refactor commit range plus the instruction to return Critical / Moderate / Minor findings with their reproducer fields. Do not dispatch the review as a subagent — run it sequentially in the current context.@skills/process-code-review/SKILL.md (also invoked inline per its own contract).~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.