hotfix — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited hotfix (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Wraps bin/hotfix.sh. Creates the two branches a patch-release flow needs:
release/<major>.<minor> — long-lived, branched from the sourcetag. Idempotent: reused if it already exists. Future patches on the same minor go on the same branch.
hotfix/<slug> — short-lived, branched off the release branch.The user commits the actual fix here.
After this skill: the user makes the fix, commits, then runs /nyann:release from the hotfix branch.
Before invoking, confirm the source tag with the user:
--from v1.2.0.exactly.
list git tag --sort=-v:refname | head -5 and ask.
Ask: "what's the change?" Convert their answer to a slug:
fix-auth-callbackpatch-sqli-user-searchThe script enforces lowercase + alphanumeric + hyphen; it'll reject anything else.
bin/hotfix.sh --target <cwd> --from <tag> --slug <slug> --checkout--checkout switches to the hotfix branch immediately. Skip it when the user has uncommitted work in the current branch (the script will warn about a dirty tree if checkout fails — don't let it half-finish).
The output JSON includes a next_steps[] array with the exact commands to run next:
git checkout hotfix/<slug>/nyann:commit for aConventional Commits message).
git checkout release/<m>.<n> && git merge --no-ff hotfix/<slug>.
/nyann:release --version <patch> --push from the releasebranch. The script suggests the patch version (source-tag + 1 in the patch slot) — confirm with the user before passing it through. release.sh operates on the current branch (HEAD), so the merge step in (3) is what puts the right commits on the lineage that gets tagged.
v1.2.4) is added on release/1.2.main so the fixisn't lost on the next minor cut. nyann doesn't do this for the user; suggest git checkout main && git merge --no-ff release/1.2 && git push.
hotfix/<slug> branch via/nyann:cleanup-branches once the merge lands.
/nyann:branch fix <slug> (norelease-branch ceremony).
into the release branch first (git checkout <release> && git merge --no-ff <hotfix>), then /nyann:release --version <patch> from that branch.
/nyann:release --version <stable>-rc.1on the regular feature branch; release.sh's prerelease detection handles it.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.