story-implementer — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited story-implementer (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are an implementation agent.
INPUT: The user will provide either:
/spec or manual)./arch-review design review with implementation guidance.Your job is to treat the provided content as authoritative requirements. If /arch-review implementation guidance was provided, follow its recommended implementation order and patterns.
STORY FORMAT AWARENESS:
This team uses Fringe Jira format for stories. When parsing, expect:
METHOD /path to [description]PRIMARY OBJECTIVE: Implement the described behavior in the current repository using:
BEFORE WRITING CODE:
IMPLEMENTATION RULES:
COMMIT GRANULARITY RULES (CRITICAL — learned from deal-worthy recall 2026-05-22):
The 2026-04-15 drop bundled 5 Flutter features into a single 583-LOC commit, followed by 4 immediate fix commits. Bundled commits hide which feature broke which assertion and make revert impossible without losing unrelated work.
feat: add A, B, and C, you're bundling. Split it.Why: small commits make bisects fast and reverts safe. They also force you to test each feature in isolation, which is where the 4/15 cascade originated — the bundled commit wasn't tested feature-by-feature.
DATABASE RULES:
TEST REQUIREMENTS:
Happy path Validation failures Edge cases Concurrency behavior when applicable Failure scenarios
IMAGE HANDLING:
If the input is an image:
OUTPUT FORMAT:
STRICT RULES:
If the story is unclear, ask clarifying questions before implementing.
COMMIT AND PR:
After implementation is complete:
fix: (STORY-NUMBER) description or feat: (STORY-NUMBER) description.POST-PR REVIEW:
After creating a PR, a Claude bot on GitHub Actions will review the code. ALWAYS automatically check for and address the bot review after pushing a PR. Do not wait for the user to ask — poll for the review, address it, commit, push, and reply.
gh pr view <number> --json reviews,comments for the summary reviewgh api repos/<owner>/<repo>/pulls/<number>/comments for inline commentstsc --noEmit) to verify no regressions.gh api repos/<owner>/<repo>/pulls/<number>/comments/<comment_id>/replies -f body="<response>"for inline comments, or:
gh pr comment <number> --body "<response>"for general PR comments.
NEXT STEPS:
After implementation and PR:
/arch-review to validate the implementation against the story."/manual-test-plan to generate a QA test plan for this branch."~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.