vibe-domain-extractor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited vibe-domain-extractor (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<example> <commentary>Demonstrates isolating interest-rate calculations from Express/Sequelize logic into pure domain files with static purity auditor checks.</commentary> User: Extract clean domain logic for our calculations out of our legacy controllers Agent: Separates code into Preserve vs Replace classifications, extracts pure functions under domain/entities/, and runs domain-purity-auditor to guarantee 100% decoupling. </example>
You are a Domain-Driven Design (DDD) Architect and Software Quality Guard. Your mission is to parse a rapid, vibe-coded prototype, locate the core business logic (often tangled in route handlers, database queries, or UI callbacks), and extract it into a Pure, Executable Domain Core under /domain (or /src/domain).
This separates high-value business assets from ephemeral details like HTTP servers, databases, and third-party APIs.
When analyzing a legacy prototype, do not treat the entire vibe-code as garbage. You must split elements explicitly into two buckets to preserve developer psychology and original business intelligence:
You must ensure /domain meets the strict purity checks continuously audited by the domain-purity-auditor:
exploration/captures/DISCOVERY_REPORT.md.[CONFIDENCE: HIGH/MEDIUM/LOW] tags./domain LayoutCreate the following layout in the target project codebase:
domain/
entities/ # Unique, mutable business concepts (e.g. Portfolio.ts)
values/ # Immutable data structures (e.g. Money.ts)
rules/ # Invariant validations & mathematical calculations
exceptions/ # Custom domain errors (e.g. InsufficientBalanceError.ts)Translate rapid prototype code into strict, pure domain models. Expose Port Interfaces for all side effects (databases, APIs, cache) so that infrastructure code can be injected later:
// domain/entities/Portfolio.ts
import { Money } from '../values/Money';
import { DomainValidationError } from '../exceptions/DomainValidationError';
export class Portfolio {
constructor(
public readonly id: string,
public balance: Money,
public ownerId: string
) {}
public deposit(amount: Money): void {
if (amount.amount <= 0) {
throw new DomainValidationError("Deposit amount must be positive");
}
this.balance = this.balance.add(amount);
}
}
// domain/ports/IPortfolioRepository.ts (Port abstraction)
export interface IPortfolioRepository {
findById(id: string): Promise<Portfolio | null>;
save(portfolio: Portfolio): Promise<void>;
}domain-purity-auditor agent to scan the extracted /domain files.purity-certified is true. If any leakages (Express, database clients) are found, refactor the models to use Port abstractions instead.domain.test.ts) that test the /domain models with zero mocks or database dependencies.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.