coding-conventions-agent — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited coding-conventions-agent (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill requires Python 3.8+ and standard library only. No external packages needed.
To install this skill's dependencies:
pip-compile ./requirements.in
pip install -r ./requirements.txtSee ./././requirements.txt for the dependency lockfile (currently empty — standard library only).
You enforce coding conventions and documentation standards for all code in the project.
snake_case (Python), camelCase (JS/TS), PascalCase (C# public){title, description, files} format (ADR 097)../../assets/templates/python-tool-header-template.py../../assets/templates/js-tool-header-template.js../../assets/templates/tsx-tool-header-template.tsx#!/usr/bin/env python
"""
Script Name
=====================================
Purpose:
What the script does and its role in the system.
Layer: Investigate / Codify / Curate / Retrieve
Usage:
python script.py [args]
"""/**
* path/to/file.js
* ================
*
* Purpose:
* Component responsibility and role in the system.
*
* Key Functions/Classes:
* - functionName() - Brief description
*//**
* ComponentName (React Component)
* =====================================
*
* Purpose:
* Component responsibility and role in the UI.
*
* Layer: Frontend / UI / Layout
*
* Usage Examples:
* <ComponentName />
*
* Props:
* - propName: description
*
* Key Functions:
* - handleEvent() - Description
*/// path/to/File.cs
// Purpose: Class responsibility.
// Layer: Service / Data access / API controller.
// Used by: Consuming services.def process_data(xml_path: str, fmt: str = 'markdown') -> Dict[str, Any]:
"""
Converts Oracle Forms XML to the specified format.
Args:
xml_path: Absolute path to the XML file.
fmt: Target format ('markdown', 'json').
Returns:
Dictionary with converted data and metadata.
Raises:
FileNotFoundError: If xml_path does not exist.
"""/**
* Fetches RCC data and updates component state.
*
* @param rccId - Unique identifier for the RCC record
* @returns Promise resolving to RCC data object
* @throws {ApiError} If the API request fails
*/| Language | Functions/Vars | Classes | Constants |
|---|---|---|---|
| Python | snake_case | PascalCase | UPPER_SNAKE_CASE |
| TS/JS | camelCase | PascalCase | UPPER_SNAKE_CASE |
| C# | PascalCase (public) | PascalCase | PascalCase |
C# private fields use _camelCase prefix.
module/
├── __init__.py # Exports
├── models.py # Data models / DTOs
├── services.py # Business logic
├── repositories.py # Data access
├── utils.py # Helpers
└── constants.py # Constants and enums// TODO(#123): descriptionsubprocess or python ../../.Please trigger the rlm-curator skill).plugins/<plugin>/skills/<skill>/scripts/foo.py).plugins/<plugin>/scripts/foo.py) and wire backward-looking, local symlinks into each consuming skills/ directory.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.