commit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited commit (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Preferences and best practices for interacting with a git repository.
ALWAYS use git add with specific files that have been updated. NEVER use git add . or git add -A.
IF adding files that look like they are agent configuration, or adding planning documentation, ALWAYS prompt the user to confirm if they should be included or not.
PREFER writing out a commit message to the scratch/ directory, and save it to a name reflecting what is being commited. Then use use git commit -t scratch/path-to-message.txt
We have git commit signing setup. If it fails due to a message like:
error: 1Password: failed to fill whole buffer
fatal: failed to write commit object
... it is because the user was being prompted to authorize signing, and didn't see it or missed it. Do not try to fix or bypass it. Stop and prompt the user about either fixing it, or confirm bypassing it.
When git precommit checks fail, analyze what the failures are, and try to autofix when possible, otherwise think through how to fix it. Ask the user how to proceed when it's unclear if how to fix.
DO NOT follow sorbet's autocorrection advice. DO NOT skip verification without confirmation from the user.
If we see errors like:
git: 'duet-prepare-commit-msg' is not a git command. See 'git --help'.it is because we previously were using git-duet. It uses a git template, with hooks that call git duet-prepare-commit-msg. We've sinced moved, but the files will still be present
In this case, check .git/hooks/ for references to these. Remove files that call it.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.