tend — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited tend (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are an autonomous app improvement agent. Do NOT ask the user questions. Assess, prioritize, improve, and report — all in one pipeline.
This skill is designed to run FULLY UNATTENDED via cron. It consumes the analysis outputs from /recall, /metrics, and /evolve (which run on their own cron schedules) and acts on their findings by actually fixing code.
The automation chain: cron weekly: /recall + /metrics (diagnose each app) cron biweekly: /research + /recall + /metrics + /evolve + /promote (diagnose + improve skills) cron weekly: /tend (THIS SKILL — act on findings, fix code, push PRs)
TARGET: $ARGUMENTS
MODE DETECTION:
APP DISCOVERY: Auto-discover git repos in ~/personal/ (or wherever the user's apps live), excluding config/utility repos: Exclude: claude-config, dotfiles, starship-config, zshrc-config, playbooks, claude-skills, claude-memory
For each candidate directory:
============================================================ PHASE 1: CONSUME EXISTING ANALYSIS ============================================================
Before running any new analysis, check what /recall, /metrics, and /evolve have already produced. This avoids duplicating work the cron already did.
For EACH app:
docs/review-findings.md in the app repo (left by previous /sweep or /tend)Extract from these files:
============================================================ PHASE 2: HEALTH ASSESSMENT ============================================================
For EACH app, gather live signals:
git -C {app-path} log -1 --format="%ai" Score: 0-7 days = fresh, 8-30 = aging, 31-90 = stale, 90+ = dormant
Flutter: flutter analyze 2>&1 | tail -5 Node.js: npm run lint 2>&1 | tail -10 (or tsc --noEmit)
Flutter: flutter test 2>&1 | tail -5 Node.js: npm test 2>&1 | tail -10
grep -r "TODO\|FIXME\|HACK\|XXX" --include="*.dart" --include="*.ts" --include="*.js" -l | wc -lgit log --oneline -5git branch --no-merged main 2>/dev/null | head -5git status --short | head -10flutter pub outdated 2>&1 | grep -c "✗" (count outdated)npm outdated 2>&1 | tail -10Score each app on a 1-10 health scale:
============================================================ PHASE 3: PRIORITIZATION ============================================================
Rank apps by improvement priority using these weights:
If "--assess" mode: output the assessment table and stop here.
============================================================ PHASE 4: IMPROVEMENT PIPELINE (per app) ============================================================
For each app (in priority order), run the appropriate pipeline:
BEFORE TOUCHING ANY APP:
the user's in-progress work. Note it in the report.
git checkout main && git pull -qPIPELINE SELECTION (based on health + available analysis data):
A) CRITICAL (health 1-3): Stabilize first
B) HAS RECALL/METRICS FINDINGS: Data-driven fixes
C) HAS EXISTING FINDINGS: Continue previous sweep
docs/review-findings.mdD) MODERATE (health 4-6): Sweep and fix
E) HEALTHY (health 7-10): Polish
MAJOR DEPENDENCY BUMP SMOKE GATE (learned from pet-sitter recall 2026-05-22 — Google Sign-In 6→7 bump produced 4 cascading rework commits over multiple days):
Before merging ANY major-version bump (semver major, e.g. 6.x→7.x) of native- channel packages, run a platform smoke test:
Triggers — apply this gate when flutter pub outdated or npm outdated shows a major bump to any of:
flutter_local_notifications, flutter_secure_storage, in_app_purchase, permission_handler, image_picker
Smoke procedure:
flutter build ios --simulator --no-codesign(or RN/Expo equivalent). Must succeed.
flutter build apk --debug. Must succeed.flutter build web. Must succeed.
sign-in returns a credential, payment sheet opens, Firebase initializes.
it as a manual-attention item. Do NOT commit a partial migration.
Why: major bumps of these packages almost always change native plumbing (URL schemes, GIDClientID, Info.plist keys, AndroidManifest entries, Riverpod APIs). Catching the break before merge prevents the cascading fix chain.
PER-APP GUARDRAILS:
Flutter: dart format . Node.js: npm run format or npx prettier --write .
git push============================================================ PHASE 5: CROSS-APP ANALYSIS + EVOLVE TRIGGER ============================================================
After tending all apps, look for cross-cutting patterns:
(e.g., all apps missing error handling, all have outdated deps)
defined in ~/.claude/CLAUDE.md?
dependencies? (e.g., different Firebase versions across Flutter apps)
If shared issues are found across 2+ apps, this is a signal for /evolve:
============================================================ PHASE 6: WRITE TEND REPORT TO MEMORY ============================================================
Save the tend report to each app's memory directory for future reference: {memory-dir}/tend-{date}.md
Also update each app's MEMORY.md with:
## Last /tend Run ({date})
- Health: X/10
- Fixed: {N items}
- Pushed to: main
- Remaining: {items that need manual attention}============================================================ OUTPUT ============================================================
| App | Stack | Health | Last Commit | Tests | Lint | Recall Findings | Status |
|---|---|---|---|---|---|---|---|
| {app} | {stack} | X/10 | N days ago | P/F | P/F | N items | tended/skipped/assess-only |
For each tended app:
#### {app-name}
Prioritized list of follow-up actions the user should take:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.