trigger-evaluator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited trigger-evaluator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Evaluates how reliably a skill's description field causes agent CLIs to activate the skill for relevant queries. Runs each test query multiple times to account for model nondeterminism and records per-run trigger state.
Read <skill-dir>/evals/evals.json. This file contains an array of test queries with the schema:
[
{"id": "q1", "query": "write an ADR for auth", "should_trigger": true},
{"id": "q2", "query": "add a comment to the login function", "should_trigger": false}
]should_trigger: true means the skill description SHOULD cause the CLI to activate this skill. should_trigger: false means the skill should NOT activate.
For each query, invoke the target CLI 3 times per CLI target (opencode and gemini):
go run ./cmd/invoke-cli \
--cli <opencode|gemini> \
--prompt "<query>" \
--workspace <workspace> \
--skill <skill-path>Use a 120-second timeout per invocation. The invoke-cli tool outputs JSON with a skill_activated boolean field.
For each CLI target, produce a result file at evals/workspace/trigger-results/<cli>.json:
{
"cli": "opencode",
"results": [
{
"id": "q1",
"query": "write an ADR for auth",
"should_trigger": true,
"runs": [true, false, true],
"trigger_count": 2,
"total_runs": 3
},
{
"id": "q2",
"query": "add a comment to the login function",
"should_trigger": false,
"runs": [false, false, false],
"trigger_count": 0,
"total_runs": 3
}
]
}If a CLI invocation times out (exceeds 120s), record that run as null and reduce total_runs accordingly. If all 3 runs for a query time out, flag the query as status: "unavailable" and exclude it from downstream aggregation with a note in the output.
If invoke-cli crashes or returns malformed JSON, retry once. If the retry also fails, mark all remaining queries for that CLI as status: "cli_error" and write a partial results file.
invoke-cli reads the full stream before parsing, or activation events may be missed.--skill path must be registered or resolvable by the CLI's skill discovery mechanism. If the skill is not found, skill_activated will always be false regardless of query relevance.Verify this skill produces correct output:
evals.json with two queries: one about "deploy to k8s" (should_trigger: true) and one about "sort an array" (should_trigger: false).evals/workspace/trigger-results/opencode.json and gemini.json exist.trigger_count is a number between 0 and 3 (or fewer if timeouts occurred) for each query.null entries in the runs array, not false.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.