clean-code — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited clean-code (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The aim is working software written plainly. Be concise, be direct, and solve the actual problem — nothing more.
| Thing | Convention | Good |
|---|---|---|
| Variables | Say what they hold | retryCount, not n |
| Functions | Action + subject | fetchOrder(), not order() |
| Booleans | Phrase as a yes/no | isReady, hasAccess, canDelete |
| Constants | Upper snake case | DEFAULT_TIMEOUT_MS |
If a name needs a comment to be understood, the name is wrong — rename it.
| Don't | Do instead |
|---|---|
| Annotate every line | Drop comments that restate the code |
| Wrap a one-liner in a helper | Inline it |
| Build a factory for two cases | Construct them directly |
Create utils.ts for a lone function | Put it where it's used |
| Open with "First we import…" | Just write the code |
| Nest four levels deep | Flatten with guard clauses |
| Sprinkle magic numbers | Name the constant |
| Write a 200-line god function | Split it by responsibility |
Changing one file can ripple outward. Before you edit, answer:
A quick trace:
Editing: OrderService.ts
imported by → OrderController.ts, CheckoutController.ts
signature changing? → update both call sites in this same taskEdit the file and every dependent file together. Never leave a half-applied change or a dangling import behind.
Don't call it finished until each holds:
If any fails, fix it first.
Some skills ship validation scripts. Each agent runs only the scripts that belong to its own skill — a frontend agent runs the UX and accessibility checkers, a backend agent runs the API validator, and so on. Running another skill's script is a misuse.
When you do run one, follow a strict read-then-report loop:
## Results: api_validator.py
Errors (2)
- routes/users.ts:40 — missing input validation
- routes/auth.ts:12 — unhandled rejection
Warnings (1)
- routes/items.ts:88 — response not typed
Passed (5)
- ... five checks green
Want me to fix the 2 errors?Two things count as failures: running a script and ignoring what it reported, and auto-fixing without first asking. Always read the output, summarize it, ask, then fix.
Bottom line: the user wants code that runs, not a lecture about it. Let clear names and small functions carry the explanation.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.