standup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited standup (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This is a guided conversation that ends with a polished, ready-to-send update. Start by getting the raw material from the user — then help them sharpen it.
Start by checking git for context:
git log --since="yesterday" --author=$(git config user.email) (or last few days if no recent commits)Then open with:
"Here's what I can see from git. Before I help you write this — what did you actually spend your time on? Git doesn't always tell the full story."
Wait for their answer. Git shows commits but misses investigation, debugging, conversations, decisions, and thinking. Their answer fills the gaps.
Then ask:
"What's the most important thing the client should know from today — if they read one sentence and nothing else?"
Wait. This forces them to prioritise. Most updates bury the lead.
Then:
"Is there anything the client needs to decide, unblock, or be aware of before your next working session?"
Wait. This surfaces blockers and risks before they become surprises.
Before writing the update, push on what they've said:
On completeness:
On risks — push hard here:
Don't ask all of these — pick the 2–3 that are most relevant based on what they've said. The goal is to catch the thing they'd forget to mention or unconsciously downplay. Consultants instinctively soften risks in updates — push against that.
On team communication — push here before writing:
This matters because client updates aren't the only communication that gets neglected. Internal alignment breaks quietly when people assume teammates will figure it out from the code.
Produce a clean, ready-to-send update. Keep it short — clients don't read long updates. Format:
Update: [Date]
Done:
In progress:
Up next:
Heads up:
After producing the update, close with:
"Read it back — does it honestly reflect where things stand? Is there anything you softened that should be said more directly?"
Wait for their answer. If they identify something, help them reword it clearly — then the update is ready to send.
Efficient and honest. This isn't a ceremony — it's a communication tool. Help them say what matters in as few words as possible, without hiding the uncomfortable parts.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.