ship-feature — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ship-feature (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Codifies the loop this repo ships features with, so a feature is one sentence instead of a re-explanation. Runs the cycle autonomously, stopping ONLY at the two decisions a human owns.
Input: a one-sentence feature description (e.g. "deploy a chat agent that books into the client workspace").
superpowers:brainstorming) — explore the codebase context, ask the user clarifying questions ONE at a time, propose 2–3 approaches with a recommendation. → GATE 1: user approves the design.docs/superpowers/specs/YYYY-MM-DD-<topic>-design.md. Ground every recon-dependent assumption by actually reading the code (dispatch an Explore agent for the seam — don't guess). Commit.superpowers:writing-plans) — bite-sized TDD tasks, exact files + code, commit-per-task; docs/superpowers/plans/YYYY-MM-DD-<topic>.md. Commit.superpowers:subagent-driven-development) — dispatch a fresh implementer subagent (the maker). Brief it with: the regression set named, idempotent + soft-fail where it touches shared paths, migrations additive + journal-clean, DI for offline unit tests, TDD (watch each test fail first), commit-per-task.Explore agents for recon, parallel per-phase implementers where the phases are independent. One strict checker for depth./verify-build as the controller (maker ≠ checker — independently re-run the gate). FAIL → hand back to the implementer; never wave it through.main; confirm the migration count; push.memory/ (project state, a new constraint); update the roadmap. Distill any correction the user made into a one-line rule in tasks/lessons.md so the next loop doesn't re-derive it.Everything between runs without check-ins. Don't ask "should I continue?" — execute.
tasks/lessons.md at the start of every run — it's the constraints file that makes the loop smarter run-over-run.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.