code-quality-principles — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited code-quality-principles (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
EVERY CHANGE MUST BE INTENTIONAL. If you can't explain why a line changed, revert it.
Answer first, or return to EXPLORE: which task/criterion this code serves; which files change and why each; which existing project patterns apply; what could go wrong (error cases, edge cases, security); how you will verify it.
Leave every file you touch better than you found it. Touching a file means owning its known issues.
The proximity test is NOT a deferral mechanism for P1/P2 findings. It decides how a cleanup is committed (alongside the feature fix vs. a separate improve: commit), not whether it gets fixed. A P1 or P2 in a file the PR modifies is fixed in this PR.
A cleanup is a standalone `improve:` commit when ALL true:
A finding requires expanded scope (still fixed; may need a design note or tests) when ANY true:
P1/P2 in the expanded-scope bucket: fix in-PR with an appropriate commit message. Finding triage is NEVER a valid escalation trigger — do NOT file a six-field escalation to ask whether to fix a finding (see skills/llm-operator-principles/SKILL.md and references/escalation-format.md). "Disagree to fix" and "ask the user whether to fix" are not options.
Default mode: cosmetic P3 in truly untouched files is fixed if bounded (<10 lines) or documented inline in the PR body. Do NOT create follow-up issues for them.
Minimal-scope mode (`settings.json` → `minimalScope: true`): the follow-up issue workflow for cosmetic P3 in untouched files is restored.
Never commit secrets, credentials, or sensitive values. Use environment variables and gitignored .env files; reference secrets by name. A hardcoded secret is P1 immediately.
No TODO comments in committed code (track in issues); no console.log / puts / print debugging; no mocked or stubbed "implement later" code; no commented-out code blocks; no placeholder error messages.
Run independent quality commands (lint, test, typecheck) as parallel Bash calls, never chained with &&. After checks: P1 fix immediately, P2 before PR, P3 in-PR by default.
Do NOT: modify imports/formatting in files you aren't changing for the task; commit generated files without verifying them; copy-paste instead of extracting a shared function; catch exceptions silently (catch {} / rescue nil).
A file with 0 prior commits on the branch and large additions is "first touch": flag it in change classification, give it extra review attention, and ensure it follows project conventions.
Commit only when you can describe the change without "WIP" or "partial", it leaves the codebase working, and reverting it cleanly undoes one logical change.
Before marking any task complete: git diff shows only intended changes; no debug code or temporary files; new code follows existing project patterns; edge cases considered (null, empty, boundary); error messages helpful and specific. Tests passing is necessary, not sufficient.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.