review-and-handoff — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited review-and-handoff (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Every session should end cleanly. The /end command triggers this, but understanding the protocol matters more than the command.
Before ending:
PROGRESS.md is the single source of truth for project state across sessions.
Update these sections:
## Current Status
{What phase/feature is active}
## Completed This Session
- {Specific thing done}
- {Another specific thing done}
## In Progress
- {What's partially done, and where it stands}
## Blockers
- {Anything preventing forward progress}
## Next Steps
- {Ordered list of what to do next}Be specific. "Worked on auth" is useless. "Implemented JWT token generation and validation in src/auth/tokens.js; unit tests passing; integration tests not yet written" is useful.
When ending mid-task, PROGRESS.md isn't enough. Write a handoff at docs/handoffs/HANDOFF_{date}.md.
# Handoff: {Date}
## What I Was Doing
{1-2 sentences on the exact task}
## Current State
- Branch: {branch name}
- Last commit: {hash and message}
- Tests: {passing/failing, which ones}
- Files changed: {list of modified files}
## What's Left
1. {Next specific step}
2. {Step after that}
3. {Final step for this task}
## Context That Matters
- {Decision made during this session and why}
- {Gotcha discovered that isn't documented elsewhere}
- {Assumption being made that should be validated}
## How to Verify When Done
{What "done" looks like for this task}Include in handoffs:
Don't include:
A good handoff passes this test: could a fresh Claude session, reading only PROGRESS.md and the HANDOFF file, continue the work without asking clarifying questions?
If no, the handoff is missing context.
this task for days. What's obvious now will be opaque later.
stale handoffs accumulate — they become misleading.
If the code isn't committed, the handoff points to nothing.
state; HANDOFF is the detailed supplement.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.