quality-evaluator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited quality-evaluator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Runs test cases through agent CLIs both with and without the target skill loaded, capturing outputs and timing data. This produces the raw material for downstream grading and comparison.
Read quality eval test cases from <skill-dir>/evals/evals.json:
[
{
"id": "eval-1",
"prompt": "Create a chart showing monthly revenue from the CSV file",
"expected_output": "A PNG bar chart with labeled axes",
"files": ["data.csv"],
"assertions": [
"Output includes a PNG image file",
"X-axis has month labels",
"Y-axis has revenue labels"
]
}
]files (optional): input files to stage in the workspace before running the prompt.
Create a clean workspace for each iteration:
evals/workspace/quality-results/iteration-<N>/
├── eval-<id>/
│ ├── with_skill/
│ │ ├── workspace/ # fresh workspace for this run
│ │ └── outputs/ # captured outputs
│ └── without_skill/
│ ├── workspace/
│ └── outputs/Each run gets a clean workspace — no leftover files, no cached agent state, no prior context. This is mandatory for valid comparison.
For test cases that specify files, copy the referenced files into the workspace directory before invoking the CLI. Files are relative to <skill-dir>/evals/.
Invoke the CLI with the skill directory available in the agent's scope:
go run ./cmd/invoke-cli \
--cli <opencode|gemini> \
--prompt "<prompt>" \
--workspace evals/workspace/quality-results/iteration-<N>/eval-<id>/with_skill/workspace \
--skill <skill-path>Invoke the CLI without providing a skill path — omit the --skill flag so the agent does not discover or load the target skill:
go run ./cmd/invoke-cli \
--cli <opencode|gemini> \
--prompt "<prompt>" \
--workspace evals/workspace/quality-results/iteration-<N>/eval-<id>/without_skill/workspaceFor each run, save:
<run>/outputs/<run>/outputs/response.txt<run>/outputs/timing.json: {
"token_count": { "input": 500, "output": 1200 },
"duration_ms": 8500
}If the agent produces an error, capture the error output rather than aborting:
<run>/outputs/error.txt"error": trueruns will contaminate results. Always use --new-session or equivalent flags. The gemini CLI in particular may hold context across invocations unless explicitly reset.
--new-session, gemini carriesforward prior conversation context, which can make the with-skill and without-skill runs share state and invalidate the comparison.
unexpected locations (temp directories, global caches). Ensure invoke-cli captures the full workspace after the run, not just the initial directory.
picked up as inputs by the next run. Always rm -rf the workspace directory before creating it fresh.
on the same prompt due to model nondeterminism. Treat small timing differences as noise; use token efficiency delta in candidate-selector, not absolute timing.
exclusion or increase the CLI timeout. A single hung evaluation should not block the entire pipeline.
Verify this skill produces correct output:
evals.json with one test case: "List allPython files in the workspace."
.py files and 2 .txt files.with_skill/outputs/response.txt andwithout_skill/outputs/response.txt both exist.
timing.json is present in both output directories.without_skill workspace does not contain any skill-loadedartifacts.
from iteration-1).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.