fizzy-tasks — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited fizzy-tasks (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Fetch and display open Fizzy cards assigned to the current user, open bugs, blockers, and unassigned items — enriched with priority and effort estimates using Jackpot Snap project context.
Bearer token: R2Rek4vNLSrr12F9QFkBy3BZ Account ID: 6132669 Base URL: https://app.fizzy.do
curl -s "https://app.fizzy.do/6132669/cards?status=open" \
-H "Accept: application/json" \
-H "Authorization: Bearer R2Rek4vNLSrr12F9QFkBy3BZ"Filter the response for cards where the current user is assigned. Also fetch all open cards to identify bugs (tagged "bug") and unassigned items.
If the API supports ?assigned=me, use that parameter to reduce results:
curl -s "https://app.fizzy.do/6132669/cards?status=open&assigned=me" \
-H "Accept: application/json" \
-H "Authorization: Bearer R2Rek4vNLSrr12F9QFkBy3BZ"curl -s "https://app.fizzy.do/6132669/users" \
-H "Accept: application/json" \
-H "Authorization: Bearer R2Rek4vNLSrr12F9QFkBy3BZ"Group cards into:
For every card, assign a priority level and effort estimate based on Jackpot Snap service context. Do NOT ask the user — infer from card title, description, and tags.
#### Priority Levels
| Level | Label | When to assign |
|---|---|---|
| P0 | [P0 — Critical] | Touches game-engine WebSocket, payment-service (Bankful/Dots), user auth/JWT/JWKS, or validity-check card deals |
| P1 | [P1 — High] | Touches competition service (enrollments, leaderboard, knockout), or QA-reported bug visible to players |
| P2 | [P2 — Medium] | Non-blocking feature work, DX improvements, dev env issues, non-critical UI bugs |
| P3 | [P3 — Low] | Nice-to-have, docs, observability, refactors, no user-facing impact |
Cross-reference rules:
user JWKS/auth → escalate to P0 (all services depend on it)validity-check → P0 (game-engine cannot deal cards without it)payment-service → P0 (real money at stake)#### Effort Estimates
State reasoning in one line after the estimate.
For each card, construct a deep link:
https://app.fizzy.do/6132669/cards/<CARD_NUMBER>IMPORTANT — Fizzy does NOT support Markdown. When writing card descriptions, comments, or any content sent to Fizzy via the API, use plain text with spacing and line breaks only. No**bold**,# headers,- bullets, or any Markdown syntax. Use indentation and blank lines for structure instead.
Fizzy Digest — YYYY-MM-DD HH:MM
MY CARDS (N)
[P1 — High] ~2h #42 — Fix payment webhook retry logic
→ https://app.fizzy.do/6132669/cards/42
Reason: payment-service — real money at stake if retries fail.
[P2 — Medium] ~1h #38 — Update admin dashboard label
→ https://app.fizzy.do/6132669/cards/38
Reason: Non-blocking UI change, no live game impact.
OPEN BUGS (N)
[P1 — High] ~2–4h #45 — Game disconnects on round 8
→ https://app.fizzy.do/6132669/cards/45
Reason: game-engine WebSocket — visible to players.
BLOCKERS (N)
[P0 — Critical] #41 — JWKS endpoint returning 500
→ https://app.fizzy.do/6132669/cards/41
Reason: All services depend on user JWKS — blocks auth entirely.
UNASSIGNED (N)
[P3 — Low] #39 — Refactor seed script
→ https://app.fizzy.do/6132669/cards/39
---
Boards scanned: QA Board
Total open cards: NOmit empty sections.
After the digest, offer:
~/.claude/task-tracker.md)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.