fix-parser-gap — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited fix-parser-gap (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Implements missing ECMA-376 Office parsing features using a TDD red-to-green workflow: write a failing test first, read the spec, implement in AILANG, verify the test goes green, then re-run benchmarks.
If the user specifies a feature, use that. Otherwise pick the highest-priority unresolved gap from the audit:
# Show current gap scores (0% = complete gap, 100% = fully handled)
uv run benchmarks/office/eval_gaps.py --verboseConsult resources/reference.md for the priority table and spec page numbers.
This step is critical. No implementation without a failing test first.
Two places tests live:
check_custom_heading_styles(output) that returns a score from 0.0-1.0. If a check doesn't exist for the gap, add one. If it exists but is too lenient, tighten it.** — Hand-verified ground truth for challenge files. These files have "verified": true so annotate.py` won't overwrite them. If the ground truth doesn't reflect the expected correct behavior, fix it.Also create or verify the challenge test file in data/test_files/challenge/ — these are generated by benchmarks/create_challenge_files.py using python-docx/openpyxl. If the existing challenge file doesn't test the feature well enough, update the generator.
Run the test to confirm it fails (RED):
uv run benchmarks/office/eval_gaps.py --verbose # Check the specific gap shows 0%Read the relevant ECMA-376 spec section for the feature being implemented:
# Spec PDF is at:
specs/ecma-376/part1/ECMA-376-1-5th-edition-december-2016-Part1.pdfUse the page numbers from resources/reference.md. Focus on:
r:id references)Also examine the actual challenge file XML to understand the real structure:
# Extract and inspect the XML from a test file
cd /tmp && mkdir -p inspect && cd inspect
unzip -o /path/to/data/test_files/challenge/challenge_*.docx
cat word/document.xml | xmllint --format - | head -100Modify the parser file (see reference.md for which file). Follow these principles:
docxParserExtractNumDef) to avoid name collisionsensures { result >= 0 && result <= 6 } for heading levels, ensures { listLength(result) == listLength(input) } for mappers). Z3 verifies these hold for ALL inputs.! {FS}. The pure func core + effectful shell pattern lets Z3 verify the parsing logic statically.extractFileFromZip(zipData, "word/numbering.xml")ailang check docparse/./bin/docparse --prove (Z3 static verification)ailang run --entry main --caps IO,FS,Env docparse/main.ail --testAfter implementing, run the test to confirm it passes (GREEN):
# Parse the challenge file
./bin/docparse data/test_files/challenge/challenge_*.docx
# Check the output
cat docparse/data/challenge_*.docx.json | python3 -m json.tool | head -50
# Run gap analysis — the specific check should now score > 0%
uv run benchmarks/office/eval_gaps.py --verboseAfter the parser change, regenerate golden outputs for affected files:
# Regenerate golden outputs for the changed format
bash benchmarks/generate_golden.sh
# Re-run the full benchmark to see the composite score improve
uv run benchmarks/officedocbench/eval_officedocbench.pyUpdate design_docs/planned/v0_5_0/spec_coverage_audit.md:
# Type-check all modules
ailang check docparse/
# Quick smoke test — must still pass
bash benchmarks/quick_check.sh
# Full gap analysis
uv run benchmarks/office/eval_gaps.py --verbose
# Full benchmark
uv run benchmarks/officedocbench/eval_officedocbench.py
# API tests (if touching shared code)
bash tests/test_serve_api.shCommit message should reference the spec section and show the score improvement:
Implement §17.9 numbering definitions in DOCX parser
Gap score: 0% -> 100% (list detection)
Benchmark: 97.8% -> 98.X% compositescripts/run_gap_check.shRuns both gap analysis and OfficeDocBench benchmark in sequence.
.claude/skills/fix-parser-gap/scripts/run_gap_check.sh # both
.claude/skills/fix-parser-gap/scripts/run_gap_check.sh --gaps-only # gap analysis only
.claude/skills/fix-parser-gap/scripts/run_gap_check.sh --bench-only # benchmark onlySee resources/reference.md for:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.