hotfix — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited hotfix (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are in EMERGENCY MODE. Fix the bug and ship. Do NOT ask the user questions. Infer everything from the error, stack trace, and codebase.
Maximum 2 iterations. Do NOT refactor surrounding code. Do NOT improve anything beyond the bug. Apply the minimal correct fix.
============================================================ TARGET: $ARGUMENTS ============================================================
$ARGUMENTS contains the bug description, error message, stack trace, or area that is broken.
If $ARGUMENTS is empty:
/qa to find issues.============================================================ PHASE 1: BRANCH SAFETY ============================================================
Before making any changes:
git branch --show-currentgit checkout -b hotfix/{short-description} Use a slugified version of the bug description (e.g., hotfix/null-pointer-user-login).
============================================================ PHASE 2: DIAGNOSE AND FIX (Iteration 1) ============================================================
Auto-detect the project type and run the appropriate test suite:
ENVIRONMENT=test sbt "testOnly *AffectedSpec*"If no specific test identified: ENVIRONMENT=test sbt test
flutter testnpx vitest run or npm test============================================================ PHASE 3: REFINE (Iteration 2 — only if iteration 1 tests failed) ============================================================
============================================================ PHASE 4: SHIP ============================================================
fix: {brief description of what was broken and fixed}Do NOT include Co-Authored-By lines.
gh pr create:fix: {brief description} (under 70 chars) ## Summary
- **Bug:** {what was broken}
- **Cause:** {root cause}
- **Fix:** {what was changed}
## Test Plan
- [ ] {relevant test verification}
- [ ] All existing tests pass============================================================ SELF-HEALING VALIDATION (max 2 iterations) ============================================================
After completing deployment/infrastructure changes, validate:
IF STILL FAILING after 2 iterations:
============================================================ OUTPUT ============================================================
| Section | Detail |
|---|---|
| Bug | {what was broken} |
| Cause | {root cause} |
| Fix | {file:line — what changed} |
| Tests | {pass/fail, count} |
| PR | {URL} |
| Iterations | {1 or 2}/2 |
============================================================ NEXT STEPS ============================================================
After the hotfix is shipped:
/qa to verify the fix in context of the full application."/arch-review to validate the fix does not introduce architectural issues."/analyze to check for domain consistency after the change."/manual-test-plan to generate a targeted QA plan for the affected area."/ship if additional work is needed beyond the hotfix scope."============================================================ SELF-EVOLUTION TELEMETRY ============================================================
After producing output, record execution metadata for the /evolve pipeline.
Check if a project memory directory exists:
~/.claude/projects/skill-telemetry.md in that memory directoryEntry format:
### /hotfix — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.
============================================================ DO NOT ============================================================
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.