implement-c97ef1 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited implement-c97ef1 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
implement/ subdirectory (e.g., ${TOOLBOX_PLUGIN_ROOT}/profiles/k8s/implement/), its index.md lists per-task gotchas the skill must consult BEFORE writing. See Step 2.Two modes, determined automatically: plan mode when the user references a docs/wip feature or task number; standalone mode otherwise (bug fix, GitHub issue, one-off change). When ambiguous, ask.
Both modes share the same execution core (Step 2 onward) — profile detection, dependency handling, verification, review.
After each execution + review cycle, verify all outputs:
/kk:review-code — which owns indexing its own kk:review-findings)kk:project-conventions (skip if none established)tasks.md updated to doneIndexing ownership: Review skills (/kk:review-code, /kk:review-spec) index their own findings. This skill only indexes kk:project-conventions for non-obvious patterns discovered during implementation. Do NOT duplicate review indexing here.
By default, review checkpoints use isolated mode (kk:review-code:isolated, kk:review-spec:isolated). This is mandatory because the implementing session has authorship bias — the same model that wrote the code produces weaker reviews of it. Isolated mode spawns an independent sub-agent with no prior exposure to the implementation.
The user can override at any checkpoint ("use standard review for this one") to fall back to in-session /kk:review-code.
Mandatory order — understand before executing. The flow below is strictly sequential. Do not read source files to modify, write code, edit files, run tests, or otherwise act on any task until you have loaded full context (design, implementation plan, task list in plan mode, or full problem understanding in standalone) and completed profile detection and loaded all resolved profile content. The only early contact with the codebase is the task's target filenames — enough to drive profile detection, not enough to pattern-match implementation.
Determine mode (see §Modes), then read the appropriate mode file and follow its entry procedure:
After completing the mode's entry procedure, continue with Step 2.
Mandatory order — instructions before action. Steps 1–3 load instructions; step 4 is the first step that touches subject matter. Do not write code, edit files, or otherwise act until steps 1–3 have been performed in order. If a later step reveals that an instruction was missed, return to step 1.
tasks.md: set the task's status to in-progress.shared-profile-detection.md against the target files (and any diff-so-far). For each active profile that contributes an implement/ subdirectory, load ${TOOLBOX_PLUGIN_ROOT}/profiles/<name>/implement/index.md and read the always-load + any matching conditional content. Apply those gotchas to the upcoming edits — they exist to prevent mistakes the post-write reviewer would otherwise catch. If no active profile contributes an implement/ subdirectory, skip this step./kk:dependency-handling skill BEFORE writing the call. Do not guess signatures, API versions, or configuration; look them up via capy/context7 per that skill's rules. Per-profile lookup cascades live in each profile's overview.md (e.g., ${TOOLBOX_PLUGIN_ROOT}/profiles/k8s/overview.md §Looking up Kubernetes dependencies).- [x]) in tasks.md as you complete them./kk:test skill.kk:review-code:isolated skill — this handles both sub-agent and pal codereview internally with independent reviewers. Do NOT run a separate pal codereview call, as it is already included in the isolated workflow.tasks.md: set the task's status to doneAfter finalizing, verify all items in the Required Outputs section above:
/kk:test completed/kk:review-code:isolated skill — which owns indexing its own kk:review-findings)kk:project-conventions (skip if none established)tasks.md updated to doneIf any item is unchecked, go back and complete it. Do NOT proceed to the next task with incomplete outputs.
Follow the iteration procedure in plan-mode.md — move to next task, repeat Steps 1–3.
Follow the completion procedure in plan-mode.md — final validation, documentation, reflection.
STOP executing immediately when:
IMPORTANT! Always ask for clarification rather than guessing.
Return to Step 1 when:
IMPORTANT! Don't force through blockers — stop and ask.
/kk:dependency-handling, /kk:test, /kk:review-code:isolated) (Plan mode: also when the plan says to do so)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.