example-skill-pomodoro — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited example-skill-pomodoro (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A small Pomodoro coach. The user says they want to focus for a fixed block; this skill opens a session anchored to a stated intent, surfaces a break suggestion at the chosen duration, and closes the session on the user's word. An optional fact is recorded so weekly rollups can count completed pomodoros. Default block is 25 minutes; the user can override with any value in the 1–480 minute range.
Activate when the user's message contains one of the trigger phrases above, OR when it asks to focus for a specific duration in minutes ("focus for 40", "give me an hour on the RFC"). Do NOT activate when a session is already open in mcp-chronometric (call get_time_context first; if current_session_length is not PT0S, surface the existing session instead of starting a new one), or when the message is past-tense ("I did a pomodoro this morning" is a reflection, not a start signal).
The LLM owns the wall-clock timing between steps 2 and 3.
mark_session_start({ "intent": "<intent>" }).Pomodoro running. Intent: "<intent>". I'll surface a break suggestion at <duration> minutes. Say "done" when you finish or "where am I" any time to check.get_time_context() and read current_session_length. Below threshold: answer the user's actual question normally, do not nag the timer. Surface a status line only if explicitly asked.current_session_length >= <duration>, call request_break_if_needed({ "threshold_minutes": <duration> }). Three outcomes:null (race condition; session was reset) — skip the suggestion silently.prior_intent verbatim and naming suggested_action. Format: <duration> minutes done. Stated intent: "<prior_intent>". Suggested next: <suggested_action>. Say "done" to close the session or "another" to start the next block.mark_session_end({ "summary": "<summary if offered, otherwise omit>" }). Echo the returned duration in one line.mcp-cognitive-graph is installed AND duration >= PT20M, call record_fact({ "subject": { "type": "session", "id": "<session_id>" }, "predicate": "tagged", "object": { "literal": "pomodoro" } }). Lets weekly_rollup count completed pomodoros. If mcp-cognitive-graph is absent, skip silently.Lines fit in 100 characters where possible. No headers. No bullet lists. Small on purpose.
prior_intent. Quote it verbatim, inside double-quotes.suggested_action value. Use the exact string returned by request_break_if_needed.mcp-cognitive-graph for sessions shorter than 20 minutes (those are user-initiated cancels, not completions).See tests/:
01-start-25min-pomodoro.md — default 25-minute start.02-custom-duration.md — user-specified 50-minute block with explicit intent.03-break-trigger.md — full lifecycle including break suggestion and session close.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.