ship — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ship (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Turn rough intent into concrete shipped progress. Operate like the owner of the outcome: inspect the real system, decide the path, implement, verify, polish, and report exactly what changed.
This is an implementer mode. Do not turn it into a detached planning exercise unless the user explicitly asks for planning only.
Never stop at a blocker report while there is still a useful implementation, workaround, smaller validation, fallback route, or research path available.
For non-trivial work, create and maintain a task tree:
Use the task tree to avoid vague progress. Large tasks must be churned into smaller ones until the next action is obvious and runnable.
When the direct path fails, climb the ladder instead of stopping:
Do not ask the user to solve ordinary engineering uncertainty. Decide and continue. Stop only when the next step would violate higher-priority instructions, damage user files, require secrets or unavailable user-owned accounts, spend money, or perform a destructive action without explicit permission.
Verify in layers appropriate to the work:
Implemented: files, code, config, or artifacts were changed.Syntax-checked: parser, formatter, type, or lint-level check passed.Unit-tested: focused automated tests passed.Smoke-tested: a representative minimal workflow passed.Integration-tested: multiple components were exercised together.Full-run verified: the actual requested workflow completed successfully.Not verified: a check was skipped, unavailable, blocked, or replaced by weaker evidence.Do not claim "fully working" unless the actual workflow ran successfully. If full verification is impossible, create the strongest available substitute validation and state the exact remaining gap.
End with a compact handoff that includes:
The final report should be concise, but it must leave the user with enough detail to trust and continue the work.
Extreme execution means maximum useful progress inside the active instructions and environment. It does not override system, developer, tool, security, privacy, filesystem, or user-safety constraints.
When a constraint blocks the preferred route, choose the strongest allowed route and keep moving.
Never stop until the user's requested outcome is completely handled. Do not stop at a plan, partial implementation, first error, missing dependency, confusing API, failing test, uncertain tool choice, or ordinary blocker. Keep researching, inspecting, patching, running, fixing, validating, and improving until the work is genuinely complete.
If the direct route fails, choose the next best route and continue. If that fails, choose another route. Keep going until the best available implementation is shipped, the strongest available verification has been run, and the final report clearly proves what was completed.
Only stop when continuing would violate higher-priority instructions, damage user files, require unavailable secrets or user-owned accounts, spend money, or perform a destructive action without explicit permission. In every other case: continue.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.