deepchat-sdd — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited deepchat-sdd (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill before substantial DeepChat source code, configuration, tests, docs, build scripts, release workflows, or project structure changes that need shared context or a durable decision record.
Skip SDD for trivial or tightly localized work unless the developer explicitly asks for it:
If the scope is unclear, inspect first and then ask whether SDD is wanted instead of creating artifacts by default.
Create one kebab-case folder per goal:
docs/features/<goal>/
docs/issues/<goal>/
design: docs/architecture/<goal>/
If one request contains multiple independent goals, split them into separate folders. Keep current architecture reference docs such as docs/architecture/agent-system.md in place; use subfolders for new architecture targets.
Treat a bug as SDD-worthy only when the root cause, blast radius, or fix path is complex enough that future developers benefit from the written record. For simple style defects or obvious local logic fixes, skip docs/issues/* and implement directly.
If a bug fix introduces a new user-visible capability, data migration, public contract, or cross-module redesign, classify the work as feature or architecture instead.
Feature and architecture goals use two artifacts:
spec.md: the normative RFC covering context, goals, non-goals, design, ownership, interfaces,data flow, invariants, compatibility, acceptance criteria, and open questions
plan.md: ordered implementation steps and live completion state, followed by whole-changereview, validation selection, cleanup, and quality gates
Do not create tasks.md. The plan is the only execution tracker.
Complex bug goals normally use one file:
spec.md: issue description, impact, root cause or suspected location, fix design, conciseimplementation checklist, validation outcome, and linked GitHub issue if one exists
Add plan.md only when a complex bug has multiple independently trackable implementation slices. Never add tasks.md.
Resolve every [NEEDS CLARIFICATION] marker before implementation. If the requested change is tiny, prefer skipping SDD over creating a token artifact.
Write spec.md as an RFC. It must explain enough implementation direction to constrain local code decisions without becoming a file-by-file task list. Acceptance criteria describe observable outcomes or independently verifiable contracts, not a test inventory.
Use plan.md as both plan and task tracker. Organize it into ordered checkbox sections whose steps are coherent, reviewable implementation slices. Include the objective, ownership boundary, essential guidance, dependencies when any, and completion condition. Reference the spec instead of repeating its design.
Do not sync GitHub issues by default. Issue sync is a follow-up record, not a gate for local SDD or implementation.
Only create or link a GitHub issue when the developer explicitly asks, or after asking and getting approval once the SDD artifacts are written or the implementation is complete.
Eligible work:
ordinary adjustments should not get issues.
If eligibility is unclear, ask the developer after the work is understood. Never self-authorize issue creation just because local gh is installed and authenticated.
When approved:
[feature] label.[bug] label.gh has permission.gh is unavailable or unauthorized, continue local-only and note that no GitHub issue wascreated only when sync was requested or approved.
When creating a PR for linked work, include Closes #NNN in the PR body so GitHub closes the issue automatically after merge.
without a separate task list or upfront test matrix.
shared/contracts/*api/*Clientretained spec.md if it is still a maintained contract.
checks may run at any time.
behavior, performance, security, naming, and maintenance cost.
only for qualifying behavior or contracts.
plan.md or the complex-bug spec checklist as coherent implementation slices land.scope, unless the developer already requested issue sync.
pnpm run format, pnpm run i18n, pnpm run lint, and pnpm run typecheck before handoffwhen app code, tests, i18n, or project docs changed.
Implementation-first means finishing the planned implementation before deciding whether to author new tests. It does not prohibit running existing tests, type checking, linting, builds, or manual checks during development.
New test code before implementation is exceptional. Use it only when the developer requests TDD, a minimal executable reproduction is required to understand a complex failure, or migration, concurrency, recovery, or protocol compatibility needs characterization of current behavior. Record the reason in one sentence in plan.md or the complex-bug spec.
After implementation, choose among:
contracts, persistence or migration, lifecycle or concurrency, recovery, security boundaries, or proven regressions.
Do not retain tests that mirror private control flow, assert incidental call order, duplicate the implementation through mocks, or exist only to increase coverage. Prefer no new test to a low-value implementation-coupled test.
deepchat-sdd-cleanup skill only when the developer explicitly asks to clean ororganize SDD documentation.
tasks.md files as legacy and migrate them only when that goal is activelyupdated. Merge remaining work into an existing plan.md; without one, keep a single-slice complex bug checklist in spec.md and create plan.md for feature, architecture, or multi-slice bug work. Do not perform a repository-wide migration during unrelated work.
contracts.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.