cook — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited cook (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Detect the user's language from their first message. If the user writes in a non-English language, ALL skill output — status updates, slice reports, questions — MUST be in that language. Do not mix languages.
Before writing any code, detect the project language and load the corresponding convention file:
| Project type | Convention source |
|---|---|
Java (*.java, pom.xml, build.gradle) | /java-developer command |
Convention check hook: After touching ANY source file, verify the change against the loaded conventions BEFORE moving to the next step. If a violation is found, fix it immediately — do not proceed with a violation in place.
This is not optional. Every file touch triggers a convention check. No exceptions.
Build in thin vertical slices — implement one piece, test it, verify it, then move on. Never implement an entire feature in one pass. Each increment leaves the system in a working, testable state.
HARD GATE: Do NOT implement more than one slice without stopping to test and verify. Do NOT batch multiple slices into one pass. One slice at a time, no exceptions.
| Flag | Behavior |
|---|---|
| (default) | Incremental implementation with tests after each slice |
--tdd | Strict RED → GREEN → REFACTOR. Test written FIRST, must FAIL before any implementation |
--tdd with the Prove-It Pattern)When NOT to use: Single-line fixes, typo corrections, config-only changes.
┌──────────────────────────────────────┐
│ │
│ Implement ──→ Test ──→ Verify ──┐ │
│ ▲ │ │
│ └───── Commit ◄─────────────┘ │
│ │ │
│ ▼ │
│ Next slice │
│ │
└──────────────────────────────────────┘For each slice:
RED GREEN REFACTOR
Write a test Write minimal code Clean up the
that fails ──→ to make it pass ──→ implementation ──→ (repeat)
│ │ │
▼ ▼ ▼
Test FAILS Test PASSES Tests still PASSWrite the test first. It MUST fail. A test that passes immediately proves nothing.
// RED: This test fails because createTask doesn't exist yet
@Test
void shouldCreateTaskWithDefaultStatus() {
Task task = taskService.createTask("Buy groceries");
assertThat(task.getId()).isNotNull();
assertThat(task.getTitle()).isEqualTo("Buy groceries");
assertThat(task.getStatus()).isEqualTo(TaskStatus.PENDING);
}Write the MINIMUM code to make the test pass. No over-engineering.
With tests green, improve the code without changing behavior. Run tests after every refactor step.
Bug report arrives
│
▼
Write a test that demonstrates the bug
│
▼
Test FAILS (confirming the bug exists)
│
▼
Implement the fix
│
▼
Test PASSES (proving the fix works)
│
▼
Run full test suite (no regressions)Build one complete path through the stack:
Slice 1: Create a task (DB + API + basic UI)
→ Tests pass, user can create a task
Slice 2: List tasks (query + API + UI)
→ Tests pass, user can see their tasks
Slice 3: Edit a task (update + API + UI)
→ Tests pass, user can modify tasksEach slice delivers working end-to-end functionality.
Tackle the riskiest piece first:
Slice 1: Prove the WebSocket connection works (highest risk)
Slice 2: Build real-time updates on the proven connection
Slice 3: Add offline support and reconnectionIf Slice 1 fails, you discover it before investing in Slices 2 and 3.
Each increment changes one logical thing. Don't mix concerns.
Bad: One commit that adds a new component, refactors an existing one, and updates the build config.
Good: Three separate increments.
After each increment, the project MUST build and existing tests MUST pass.
Touch only what the task requires.
Do NOT:
Before writing any code, ask: "What is the simplest thing that could work?"
SIMPLICITY CHECK:
✗ Generic EventBus with middleware pipeline for one notification
✓ Simple function call
✗ Abstract factory pattern for two similar components
✓ Two straightforward components with shared utilitiesNEVER implement multiple slices in one go. After each slice:
This is non-negotiable. The user must see each slice land before the next begins.
Assert on the outcome, not on which methods were called internally.
Preference order:
1. Real implementation → Highest confidence
2. Fake → In-memory version of dependency
3. Stub → Returns canned data
4. Mock (interaction) → Use sparingly, at boundaries only
@Test
void shouldMarkOverdueTasksWhenDeadlinePassed() {
// Arrange
Task task = createTask("Test", LocalDate.of(2025, 1, 1));
// Act
OverdueResult result = checkOverdue(task, LocalDate.of(2025, 1, 2));
// Assert
assertThat(result.isOverdue()).isTrue();
}Each test verifies one behavior. Multiple assertions are fine if they verify the same concept.
| Rationalization | Reality |
|---|---|
| "I'll test it all at the end" | Bugs compound. A bug in Slice 1 makes Slices 2-5 wrong. |
| "It's faster to do it all at once" | Feels faster until something breaks and you can't find which of 500 lines caused it. |
| "These changes are too small to commit separately" | Small commits are free. Large commits hide bugs. |
| "This is too simple to test" | Simple code gets complicated. The test documents expected behavior. |
| "I'll write tests after the code works" | You won't. And tests written after test implementation, not behavior. |
| "Let me just quickly add this too" | Scope expansion. Stop. |
After each slice:
After all slices complete:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.