change-classification — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited change-classification (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Domain skill for analyzing and classifying code changes before committing.
CLASSIFY BEFORE COMMITTING. Every changed file gets a classification. Unclassified files do not get staged.
Committing without classification is how out-of-context changes, secrets, and unintended modifications reach the repository.
For each changed file, evaluate signals to classify as: in-context, uncertain, or out-of-context.
| Signal | Classification | Detection |
|---|---|---|
| File already in branch diff | in-context | git diff --name-only $DEFAULT_BRANCH...HEAD includes file |
| File matches issue keywords | in-context | File path contains words from issue title/body |
| File in active task | in-context | File path matches TaskList task descriptions |
| File matches task directory | in-context | Same top-level directory as task-related files |
| Signal | Classification | Detection |
|---|---|---|
| Same directory as other changes | lean in-context | Sibling of already-classified in-context file |
| Test file for changed module | lean in-context | Naming convention match (e.g., foo.rb → foo_test.rb) |
| Config in project root | uncertain | Changes to dotfiles, config, package manifests |
| Unrelated directory | out-of-context | No connection to issue or tasks |
These always get flagged regardless of context:
| Pattern | Action |
|---|---|
.env*, credentials*, *secret* | Block — never commit |
*.lock, package-lock.json | Warn — verify intentional |
| Large binary files (>1MB) | Warn — verify intentional |
| Auto-generated files | Note — may need regeneration |
A file is "first touch" when:
git log $DEFAULT_BRANCH..HEAD -- file is empty)First-touch files get extra review attention.
Display classification as a table (finding-first pattern):
| File | Classification | Signal | Notes |
|------|---------------|--------|-------|
| src/auth/login.rb | in-context | matches issue keywords | |
| src/utils/format.rb | out-of-context | unrelated directory | first-touch |
| .env.example | RED FLAG | secret pattern | NEVER COMMIT |After classification, group in-context files into atomic commits:
Each group gets one conventional commit with an accurate message.
| Excuse | Response |
|---|---|
| "It's obviously in-context" | Then classification takes 2 seconds. Do it. |
| "I only changed one file" | One file, same process. One-file commits have leaked secrets. |
| "The lock file changed automatically" | Automatic changes still need classification. Verify intentional. |
This skill is invoked by:
/flow:commit — Phase 1 (classify all changes)/flow:address — After fixes (verify no out-of-context changes)/flow:pr — Pre-flight (verify committed changes match intent)See references/classification-signals.md for the complete signal reference.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.