testing-ticket-workflow — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited testing-ticket-workflow (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Thin entry for agent skill discovery. Full procedure: WORKFLOW.md.
When invoked:
Using **testing-ticket-workflow** to test the ticket with Playwright.bash block per step that loops over the accounts (each isolated, prints OK / FAILED with a log path): relink every needed account, then setup/mint only the FAILED ones; the user runs them, then probe the session and report. Never ask for, collect or fill a password. Full steps: WORKFLOW Phase D Fresh login (parallel-test-lanes.md §3).Claude Code shortcut: /testing-ticket → commands/testing-ticket.md.
The must-read files for this workflow, linked directly from here (references already linked above are not repeated; WORKFLOW.md links any further file at the step that uses it). Read the Always tier at the start; read each On trigger file only when its trigger is reached.
Grouped by the phase that reaches the trigger; each line names its exact trigger.
#### Intake and plan (Phases A–C)
#### Run (Phases D–E)
#### Verdicts and defects (Phases E–F)
#### Writes outside the chat (Phase G)
#### Close-out
Next: create-bug for {ids} when F3 lists a defect).#### Any phase
All preconditions and refusal rules are in WORKFLOW.md. MUST NOT run Playwright until intake is complete and the WORKFLOW Phase C confirm gate has passed.
All close-out gates are in WORKFLOW.md and verify-closing-checklist.md (Testing ticket section). MUST NOT claim tests passed without fresh runner output, without a design node (or its BLOCKED-with-reason) on every UI row, or with passed rows that carry no evidence.
Run the check for each of these after step 2 (strategy) and before Phase A — one order: strategize, then this check, then intake; check commands and install hints are in dependencies.md:
tools/lane-lease-check, tools/adoption-check){QA_TOOLS_ROOT})engineering:testing-strategysuperpowers:systematic-debugging~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.