skill-software-engineer-daily — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-software-engineer-daily (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Three flows an individual-contributor software engineer actually runs in a working day: prep a code review on a specific PR or file using whatever the graph remembers about it, plan a deep-work block of explicit length by decomposing the open work into a few atomic tasks, and write the three-line async standup from yesterday's recorded facts. The trigger phrases are deliberately narrow so the skill will not steal activation from adhd-daily-planner, the eng-manager-1on1 decomposition flow, or any general-purpose planning skill.
This skill respects the work. It does not push throughput, does not coach the user to "ship faster", and does not treat fewer-but-deeper sessions as a problem to solve. Many ND engineers do their best work in a small number of focused hours; the skill supports that pattern rather than working against it.
This skill is also not a planning tool for the next sprint, not a code reviewer, not a status reporter to anyone but the user, and not a productivity dashboard. It produces three small artifacts: a review-focus brief, a deep-work plan, and a three-line standup. When the artifact is ready, the skill stops.
Activate when the user's message contains one of the trigger phrases verbatim. The trigger phrase determines which of the three flows runs:
prep my code review on <PR or file> / prep my review on <PR or file> / prep my code-review on <PR or file> → Flow A: code-review prep.plan my deep-work block, I have <N> hours / plan a deep-work block, I have <N> hours (or <N>h, or <N> hour) → Flow B: deep-work block.async standup writeup / async stand-up writeup / async standup write-up → Flow C: async standup.Do not activate on partial matches (I'll review this later, I need a deep-work block sometime, the standup was useful), past tense (I prepped a review yesterday), or third-person references (Alex's standup). Do not activate if a separate skill — for example adhd-daily-planner, audhd-context-recovery, or skill-eng-manager-1on1 — is already running its flow in this turn; let the more general skill finish.
The user says some variant of prep my code review on PR #482 or prep my code review on src/auth/session.ts. Goal: a short brief that surfaces the prior reviewer comments and decisions already in the graph for that PR or file, so the user knows what to focus on. The skill does not read the diff and does not invent reviewer comments — the brief is bounded to what recall_entity returns.
on is the target (a PR identifier like PR #482, or a file path like src/auth/session.ts, or a feature name like the new login flow). Trim. Treat the parsed string verbatim — do not normalise capitalisation, do not expand #, do not strip the PR prefix.recall_entity({ "name_or_alias": "<parsed target>" }).resolution.method is alias, fuzzy, or embedding, surface the resolved entity name and the resolution score before continuing. Ask one question: I read "<parsed target>" as the entity "<resolved>" (<method> match, score <score>). Continue? Wait for confirmation. Do not assume.No entity in the graph matches "<parsed target>". I can still help — what do you want to focus on in this review? Stop and wait for the user.facts[] filtered to predicates mentioned_in and blocked_by — these become prior reviewer comments. Quote the object.literal text verbatim. Do not paraphrase.facts[] filtered to predicate decided_in — these become prior decisions on the target. Quote the object.literal text verbatim.neighbours[] filtered to entity type decision and relationship belongs_to — these are linked design decisions. If recall_decisions is available, you MAY make a follow-up call recall_decisions({ "subject_name": "<parsed target>" }) to get richer decision context; this is optional and only when the user explicitly asks pull the decisions too.now go review the code. Do not invent comments. The brief is the deliverable.The user says plan my deep-work block, I have 2 hours (or 3h, or 4 hours). Goal: 3–5 atomic engineering tasks that fit the stated time budget, with explicit acceptance criteria, and a one-line verdict on which to tackle FIRST.
h, h, hour, hours. Range: 1 to 8 inclusive. If the number is missing or out of range, abort with one line: I could not parse a 1–8 hour budget. Try: "plan my deep-work block, I have 2 hours". Stop.<N>-hour budget MUST be passed to decompose as the literal ISO 8601 duration string "PT<N>H" — for example "PT2H" for two hours, "PT4H" for four hours. Do NOT pass natural-language strings like "2 hours" or "2h"; the task-fractionator's contract requires ISO 8601.What's the open work? Paste a brief description, a ticket title, or a sentence about what you want to make progress on. Wait for the response. Do not invent open work. {
"goal": "<the user's pasted description, verbatim>",
"time_budget": "PT<N>H"
}Trimmed to first 5; <K> additional tasks were generated.The work is broader than fits in <N> hours. Try a smaller scope, or pass a longer budget. Stop.dependencies == [] and is the lowest-sequence task with no dependencies, that is FIRST.sequence value.neurodock-chronometric is available AND the user says start the session (or similar opt-in), call mark_session_start({ "context": "deep-work block — <user's pasted description, truncated to 60 chars>" }). If the server is unavailable, skip silently — do not surface a warning, do not propose enabling it.want me to plan tomorrow's block?. Do not propose breaking the work down further if the user did not ask.The user says async standup writeup. Goal: the three-line Yesterday / Today / Blockers format, populated from yesterday's recorded facts and open sessions. The skill never invents activity, never invents blockers, never adds praise language.
weekly_rollup({ "window": "yesterday" }). The graph returns recent facts and any open sessions."yesterday" window value, fall back to weekly_rollup({}) and filter the response to facts with recorded_at within the most recent 24-hour window in the user's local timezone. (The skill does not need to surface this fallback to the user.)recorded_at falls within the yesterday window. Quote the object.literal text verbatim. Use the shortest available rendering — one fact per line, no decoration.open_sessions[] (if the rollup returns them) or facts[] with predicate blocked_by with recorded_at within the last 24 hours. Up to three lines. If no open_sessions and no recent blockers, render Today with a single line: <no recorded plan — what will you focus on?> and stop expecting the user to fill it in themselves.blocked_by. Quote verbatim. If zero, render Blockers as: None. Do not invent.nice work yesterday, tough day yesterday, you got a lot done, or anything similar. Do not propose to share the standup anywhere.Strict "Answer First". First sentence ≤ 100 characters.
Review prep — <target>. <N> prior comments, <M> prior decisions on file.
### Prior reviewer comments
- <fact 1, one line, with date>
- <fact 2, one line, with date>
### Prior decisions
- <decision 1, one line, with date>
### What to focus on
<one short line drawn from the most recent prior comment, no invention beyond that comment>
This brief is bounded to what the graph remembers. I did not read the diff.Rules:
recall_entity — no paraphrasing. Review prep — <target>. No prior context in the graph for this target.
I can still help — what do you want to focus on? Paste the diff or describe the change and I'll work from that.This brief is bounded to what the graph remembers. I did not read the diff. is mandatory in the non-empty case.Deep-work plan — <N> hours, <K> atomic tasks.
- <task title> (<estimated_minutes> min)
Acceptance: <first acceptance criterion>
- <task title> (<estimated_minutes> min)
Acceptance: <first acceptance criterion>
- ...
FIRST: <task title from step 6>.
These tasks fit the budget you gave me. I did not invent scope.Rules:
estimated_minutes values appear verbatim from the decompose result. Do not round, do not restate.FIRST: line is mandatory. The picked task's title is the only thing on that line — no rationale, no editorialising.Trimmed to first 5; <K> additional tasks were generated. appears immediately above the FIRST: line.**Yesterday**
- <fact 1, verbatim>
- <fact 2, verbatim>
- <fact 3, verbatim>
**Today**
- <open session or planned focus, verbatim>
- <open session or planned focus, verbatim>
**Blockers**
- <blocker 1, verbatim>
This is built from your recorded facts. I did not invent activity or blockers.Rules:
None. on its own line under that section heading.recall_entity or weekly_rollup — quote the literal text.decompose. The contract is ISO 8601 — "PT2H", not "2 hours".decompose in Flow A or Flow C. It is a Flow B tool.recall_entity in Flow B (deep-work) or Flow C (standup) unless the user explicitly asks for graph context — the standup is weekly_rollup-only.weekly_rollup in Flow A or Flow B.record_fact in any flow without explicit user opt-in. The cognitive graph is the user's notebook, not the skill's logbook.10x, ship faster, crush it, power through, grind, hustle, rockstar, ninja, synergy, growth mindset, stretch goal.nice work, great work yesterday, you got a lot done, solid day.share this with your manager, no post this in the team channel.See tests/:
tests/01-prep-code-review.md — Flow A on a PR with two prior reviewer comments mocked in the graph.tests/02-deep-work-block.md — Flow B with a 2-hour budget, asserting decompose is called with "PT2H" not "2 hours".tests/03-async-standup.md — Flow C asserting no praise language and no invented blockers.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.