product-capability — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited product-capability (Agent Skill) and scored it 91/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
ignore/disregard/forget … previous instructions sentence.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
@rules/laravel/architecture.mdc — actors, surfaces, states, and data model must fit the existing layers (Action → ModelService → Repository / ModelManager), not invent new abstractions.@rules/compound-engineering/general.mdc — the plan is a durable artifact the next agent reuses, not throwaway prose.@rules/compound-engineering/general.mdc Assign the most relevant existing label when creating a tracker issue for any tracker issue this plan creates or hands off to @skills/create-issues-from-text/SKILL.md to create.The gap is not "what should we build?" but "what exactly must be true before implementation starts?".
Walk these four steps in order. Each feeds the next.
@rules/laravel/architecture.mdc),Tag every item as fixed policy, architectural preference, or open question.
Keep the contract aligned with the existing architecture; flag any place where it would force a new layer.
@skills/blueprint/SKILL.md for a multi-PR plan, or to @skills/create-issues-from-text/SKILL.md to break it into tracker issues.@rules/laravel/architecture.mdc before planning.Write the plan to a durable file (PRODUCT.md at the repo root, or a docs/ capability doc) so the next agent picks it up — per @rules/compound-engineering/general.mdc. State the file path in your reply. Use exactly these sections:
blueprint, create-issues-from-text, or architecture review).Fill every section. If a section has nothing, write an explicit note (e.g. No non-goals identified.) rather than leaving it blank.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.