debug-rules — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited debug-rules (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<!-- Last updated: 2026-03-23T16:30+11:00 -->
Use this skill when:
This skill requires the InstructionsLoaded audit hook. The hook is not registered by default - it's an on-demand diagnostic tool you enable when needed.
The hook script ~/.claude/hooks/log-instructions.sh should already exist. To enable logging, add this to ~/.claude/settings.json under "hooks":
"InstructionsLoaded": [
{
"hooks": [
{
"type": "command",
"command": "~/.claude/hooks/log-instructions.sh"
}
]
}
]Then start a new session, do some work that touches files matching your conditional rules, and run /debug-rules again.
Remove the hook from settings.json when done - it's lightweight but unnecessary for normal use.
~/.claude/hooks/log-instructions.sh exists and is executable~/.claude/settings.json has an InstructionsLoaded entry pointing to it~/.claude/instruction-audit.log exists and is non-emptyIf the hook script is missing, tell the user and stop. If the hook script exists but isn't registered in settings.json, show them the setup instructions above. If the log doesn't exist or is empty, tell the user: "No audit log found. Register the hook, start a new session, do some work, then run /debug-rules again."
Read ~/.claude/instruction-audit.log. If the user provided a timestamp, filter to entries from that session. If they said "latest" or gave no argument, use the most recent session (group by timestamp - entries within 2 seconds of each other are the same session start).
Read all files in ~/.claude/rules/. For each file:
paths: frontmatter → it should appear with reason: session_startpaths: frontmatter → it should appear with reason: path_glob_match only when matching files are readBuild a table of expected rules and their type (always-on vs conditional).
Present three sections:
Table with: file name, load reason, scope (User/Project). These are working as expected.
For each missing rule:
trigger_file_path entries that should have matched. If matching files were read but the rule didn't fire, flag it as BROKEN (likely the user-level paths: bug)Flag any of these:
session_start (should only load on path_glob_match)~/.claude/rules/ that aren't rule files (no frontmatter closing ---) loading as rulesBased on findings, suggest:
paths: uses YAML array syntax (broken in user-level rules) vs CSV string format (works). Show the fix.~/.claude/rules/~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.