dx — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited dx (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are in AUTONOMOUS MODE. Do NOT ask questions. Do NOT pause for confirmation. Execute every phase below in sequence, making decisions based on what you find.
============================================================ PHASE 0 — INPUT ============================================================
$ARGUMENTS may contain:
--fix — automatically apply fixes and generate missing configs (default: report only)--focus=AREA — limit scan to a specific area: devcontainer, hooks, lint, env, monorepo, release--score-only — output just the numeric scores, skip recommendationsIf no arguments are provided, run a full audit in report-only mode.
============================================================ PHASE 1 — STACK DETECTION ============================================================
Detect the project stack by scanning for manifest files:
package.json (Node/TS), pyproject.toml/requirements.txt (Python), go.mod (Go), Cargo.toml (Rust), pubspec.yaml (Flutter/Dart), Gemfile (Ruby)package-lock.json (npm), yarn.lock (yarn), pnpm-lock.yaml (pnpm), bun.lockb (bun)turbo.json, nx.json, pnpm-workspace.yaml, lerna.json, root workspaces in package.json.github/workflows/, .gitlab-ci.yml, .circleci/config.yml, Jenkinsfile, bitbucket-pipelines.ymlRecord the detected stack — it drives all subsequent scoring.
============================================================ PHASE 2 — AUDIT SIX DX AREAS ============================================================
Scan the project root and score each area on a 0-10 scale:
2.1 — Dev Container (0-10)
Check for:
.devcontainer/devcontainer.json exists (+3)Dockerfile or image specified in devcontainer config (+2)features or postCreateCommand configured (+2)extensions list present and matches detected stack (+1)forwardPorts configured for detected services (+1)Score 0 if .devcontainer/ directory does not exist.
2.2 — Git Hooks (0-10)
Check for:
.husky/ directory OR .lefthook.yml OR .pre-commit-config.yaml exists (+3)Score 0 if no hook tooling is detected.
2.3 — Linting & Formatting (0-10)
Check for:
.eslintrc.* / eslint.config.* / biome.json / ruff.toml / .golangci.yml / .rubocop.yml (+3).prettierrc* / biome.json / pyproject.toml [tool.black] (+2).editorconfig (+1).vscode/settings.json with format-on-save (+1).eslintrc.json) (+1)2.4 — Build Tooling & Caching (0-10)
Check for:
turbo.json or nx.json with task pipeline configured (+3)tsconfig.json project references (TypeScript composite builds) (+1)Score N/A if project is not a monorepo and has no build step.
2.5 — Environment Setup (0-10)
Check for:
.env.example or .env.template exists with documented variables (+3)docker-compose.yml for local services (database, cache, etc.) (+2)Makefile, scripts/setup.sh, or just / task taskfile (+2).tool-versions or .nvmrc or .python-version for runtime pinning (+1)2.6 — Release Pipeline (0-10)
Check for:
0.0.0 placeholder (+1)============================================================ PHASE 3 — CALCULATE DX HEALTH SCORE ============================================================
Compute the overall DX health score:
Classify each area:
============================================================ PHASE 4 — GENERATE RECOMMENDATIONS ============================================================
For each area scored below 8, generate specific recommendations:
quick (< 5 min), medium (15-30 min), involved (1+ hr)/devcontainer, /git-hooks, /linter, /env-setup, /monorepo, /releasecritical (score 0-2), high (3-5), medium (6-7)Sort recommendations by priority (critical first), then by effort (quick first).
If --fix was passed, automatically invoke the sub-skill for every critical and high priority area. Run them in sequence since some depend on others (e.g., /linter before /git-hooks).
============================================================ SELF-HEALING VALIDATION (max 2 iterations) ============================================================
After completing, validate the output was produced correctly:
IF VALIDATION FAILS:
============================================================ OUTPUT ============================================================
Print the DX Health Report:
## DX Health Report
### Project: {name}
### Stack: {language} / {framework} / {package-manager}
### Overall: {score}/10 ({grade})
| Area | Score | Status |
|------------------|-------|---------|
| Dev Container | X/10 | {status}|
| Git Hooks | X/10 | {status}|
| Lint & Format | X/10 | {status}|
| Build & Cache | X/10 | {status}|
| Environment | X/10 | {status}|
| Release Pipeline | X/10 | {status}|
### Recommendations (by priority)
1. {area} — {what's missing} — run `/sub-skill` ({effort})
2. ...
### Quick Wins (under 5 minutes)
- {actionable items that can be done immediately}============================================================ NEXT STEPS ============================================================
/devcontainer — generate dev container configuration/git-hooks — set up pre-commit and commit-msg hooks/linter — configure linting and formatting/env-setup — automate local environment bootstrap/monorepo — set up monorepo tooling and caching/release — configure automated release pipeline/dx after fixes to verify score improvement/dx --fix to auto-apply all critical and high priority fixes============================================================ SELF-EVOLUTION TELEMETRY ============================================================
After producing output, record execution metadata for the /evolve pipeline.
Check if a project memory directory exists:
~/.claude/projects/skill-telemetry.md in that memory directoryEntry format:
### /dx — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.
============================================================ DO NOT ============================================================
--fix was explicitly passed~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.