32-trust-posture — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited 32-trust-posture (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The contract is rules/trust-posture.md. This skill is the how — what /codify, /redteam, /implement, and rule authors do to wire a rule into the graduated-trust loop.
/codify)/redteam)/implement halts, /sweep reports)/posture, posture-auditor agent)If your task is none of the above, this skill is not for you.
Every rule authored by /codify MUST answer these in a "Trust Posture Wiring" section. See rule-authoring-checklist.md for the canonical format.
block / halt-and-report / advisory / post-mortem. Use block only when the action MUST be physically prevented (PreToolUse + destructive). Use halt-and-report when the action already happened but the agent must surface and wait. Use advisory for soft warnings. Use post-mortem for Stop-class detections (forensic only, surfaces next session).pending_verification; SessionStart announces it; violations trigger regression_within_grace.[ack: <rule_id>] from the agent in the first response of every new session? Reserve for high-stakes rules where evidence shows the agent ignores SessionStart context.advisory/post-mortem. Auto-downgrade requires structural or behavioral signal.| If the action is… | And it's at this hook event… | Severity |
|---|---|---|
| Destructive + reversible (rm -rf in tmp dir) | PreToolUse | block |
| Destructive + irreversible (force-push to main, secret leak) | PreToolUse | block |
| Already executed (Edit wrote a fastapi import) | PostToolUse | halt-and-report |
| Policy violation, file already on disk | PostToolUse | halt-and-report |
| Soft warning, work continues | Pre/PostToolUse | advisory |
| Detected in agent's final message | Stop | post-mortem |
| User regression signal in prompt | UserPromptSubmit | additionalContext injection (no violation log) |
rules/trust-posture.md.skills/co-reference/..claude/hooks/detect-violations.js + lib/instruct-and-wait.js.codify-integration.md — what /codify reads, writes, and emits per cycleimplement-integration.md — how /implement behaves at L4/L3/L2redteam-integration.md — how /redteam audit depth scales with posturerule-authoring-checklist.md — the canonical "Trust Posture Wiring" section formatposture-spec.md — data shapes for posture.json, violations.jsonlgrace-period-mechanics.md — pending_verification lifecycle, regression-within-graceOrigin: 2026-05-05 design session validated by 21/21 subprocess tests; promoted from .claude/test-harness/trust-posture-poc/.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.