refactor-session — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited refactor-session (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Change structure, not behavior. If behavior changes, that's a feature or fix — not a refactor.
Hard rule: Never refactor and change behavior in the same commit. Pick one.
Before jumping into structural changes:
Don't start moving code until you can describe where everything should end up.
Rule of Three before abstraction: Count concrete use cases RIGHT NOW (not hypothetical). If < 3, write the concrete version. Three similar lines of code is better than one premature abstraction. Only extract when you have 3+ real instances.
test: add characterization tests for <module>Now any breakage is immediately visible.
| Type | When to use | Example |
|---|---|---|
| Extract function | Block of code does one thing, deserves a name | 20-line loop → calculate_total() |
| Rename | Name doesn't describe what it actually does | data → player_stats_by_game |
| Remove duplication | Same logic in 3+ places (rule of three) | Extract to shared utility |
| Simplify condition | Complex boolean → named predicate | if score > 0 and game_played → if is_valid_game(score, game_played) |
| Split large function | Function does more than one thing | Split at natural seams |
| Flatten nesting | More than 3 levels deep | Early returns, guard clauses |
1. Make ONE structural change
2. Run tests — must still pass
3. Commit: "refactor: <what changed>"
4. RepeatNever batch multiple refactors. One change = one commit = easy to revert if needed.
# BEFORE: hard to read with deep nesting
def process(data):
if data:
if data.is_valid():
if not data.is_processed:
do_work(data)
# AFTER: guard clauses (same behavior, flat structure)
def process(data):
if not data:
return
if not data.is_valid():
return
if data.is_processed:
return
do_work(data)Rename one thing at a time. After renaming, verify all usages updated:
grep -r "old_name" . # find any remaining referencesFix every usage before committing. IDE refactor tools are safer than manual find-replace.
Stop immediately if:
fix: commit, then resumefeat: commitgit diff to see what changed, revert the last step| Situation | What to do |
|---|---|
| Found a bug while refactoring | Stop. git stash refactor, fix bug, then restore. |
| Tests fail after rename | grep -r "old_name" . — find missed references |
| Function getting complex | Extract smaller pieces before touching names |
| Unsure if behavior changed | Your characterization tests will tell you |
| Refactor feels like a rewrite | Stop — you're redesigning, not refactoring |
| Tempted to add a feature | Open a TODO. Finish the refactor first. |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.