self-improve-a90185 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited self-improve-a90185 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Review the current conversation, or the project's past sessions when asked, to extract durable lessons and route each one to the right knowledge layer.
Available destinations:
.claude/CLAUDE.md (may be a symlink to ../AGENTS.md — resolve it), plus any nested CLAUDE.md / AGENTS.md files in subdirectories. Claude Code loads a subdirectory's file on demand when files in that subtree are accessed, so a lesson scoped to one subtree belongs in the nearest enclosing file, with the root reserved for project-wide rules.autoMemoryDirectory setting overrides its location; otherwise it normally lives at <Claude config home>/projects/<encoded project root>/memory/, where the config home is CLAUDE_CONFIG_DIR when set and ~/.claude otherwise. The key replaces every character outside A-Za-z0-9 with -, and long keys may be truncated and hashed, so prefer the exact harness-provided path over recomputing it. List the directory and read MEMORY.md if it exists.skills/ or .claude/skills/ (resolve symlinks)Discover the project CLAUDE.md/AGENTS.md files (the root file and any nested ones in subdirectories) and read them, then read MEMORY.md. When those files point at a knowledge base the repo maintains, read its index too; it is a documentation source for Step 3 rather than a routing destination. List all skill directories with the description frontmatter of each SKILL.md, but do not read the bodies yet — Step 2 needs to run first so you know what to look for.
Classify every skill this session touched:
~/.turbo/repo/ exists, list directories in ~/.turbo/repo/claude/skills/; any skill in ~/.claude/skills/ with a matching directory there is a turbo skill~/.claude/skills/, read ~/.agents/.skill-lock.json. Its top-level skills object is keyed by skill name, and a skill listed there was installed from a source that replaces it wholesale on its next update. Match on the resolved path rather than the name alone, against the entry's skillPath, so a local fork that replaced the installed copy is not mistaken for it. A skill that matches is package-managed. The signal runs one way: absence from the file leaves ownership genuinely open, so carry an unlisted skill into Step 4 as ownership-unresolvedVerification rule (mandatory before routing in Step 4): For every candidate skill that is about to be routed as turbo, confirm with a fresh test -d ~/.turbo/repo/claude/skills/<name> check that the skill actually lives in the turbo repo. Do not rely on remembered listings from earlier in the session, filename hits in grep output, or assumptions based on where a SKILL.md was read from. A miss here mislabels a user/project skill as turbo, triggers the contribution flow unnecessarily, and can introduce session-specific content into a shared skill — so the check is not optional.
Exception: If the current project IS the turbo repo (i.e., the working directory contains this skill collection), route turbo skill lessons through the Existing user/project skill destination in Step 4 — edits go directly to claude/skills/<name>/ in the project, with no installed-copy indirection and no contribution flow.
Skip when the conversation is visible in full from the user's own first message.
When it starts from a summary of earlier work instead, recover the compacted turns from the on-disk transcript. Spawn a single subagent (model: "opus", no name). Wait for it to report before continuing; do not relaunch it if it has not yet reported. The subagent's prompt must include:
Treat the returned items as raw evidence for the scan below.
Run when asked to distill sessions beyond the current one. Skip otherwise.
Propose a cutoff first: take the newest modification time in the memory directory from Step 1, state it, then use AskUserQuestion to confirm sweeping from it or sweeping the whole history. A memory file's timestamp records a write rather than a completed sweep, so it bounds the work without settling what a previous run covered. When the directory is absent or empty, sweep the whole history without asking.
Spawn a single subagent (model: "opus", no name). Wait for it to report before continuing; do not relaunch it if it has not yet reported. The subagent's prompt must include:
Treat the returned items as raw evidence for the scan below.
Before scanning for lessons, identify which skills were loaded during this session:
~/.claude/skills/Scan the full conversation with this priority:
admin or maintain roles (determine via gh api repos/{owner}/{repo}/collaborators --jq '.[] | select(.role_name == "admin" or .role_name == "maintain") | .login'). Their feedback takes precedence over other reviewers and AI bots when there are contradictions.After scanning, read the SKILL.md of every skill a candidate lesson could touch: the session skills, plus any skill whose description from Step 1 covers a lesson's domain. This gives Step 3 and Step 4 the context for filtering and routing.
Keep only lessons that are:
references/ and other supporting files of the skills read in Step 2, or in the project's own knowledge stores already covers it, even as a special case. A lesson drawn from one incident is covered when an existing general rule, followed, would have prevented that incident; a workflow is covered only when an existing skill already encodes its steps. Search those sources for each candidate's keywords, then judge coverage by meaning, since a general rule rarely shares an incident's wording. When the covering rule was in context during the incident and still read past, because its wording, scope, or placement let the incident through, keep the lesson as a revision of that rule in place, adding no new rule; otherwise discard it. A lesson covered only in an unrelated subtree's CLAUDE.md/AGENTS.md still counts as uncovered for the subtree it actually applies to.Discard anything session-specific, speculative, one-off, or already resolved by code changes in this session (but not successful workflows — see exception above). If no lessons survive filtering, tell the user and stop.
Assign each surviving lesson to exactly one destination.
Revisions: A lesson Step 3 kept as a revision routes to the destination that holds the rule it revises, as an update-in-place, ahead of the skill-first rule and the table; only the package-managed skills rule outranks it. When the rule lives in a source that is not a routing destination, route the lesson by the rules below like any other.
Skill-first rule (mandatory): Before consulting the table below, check whether the lesson corrects, refines, or adds a guardrail to any existing skill's behavior — turbo or user/project. This includes lessons about skipping steps, wrong defaults, missing edge cases, or any "don't do X when running /skill-name" correction. If yes, route to that skill. Do not route skill corrections to auto memory or CLAUDE.md — they belong in the skill they correct. This rule is not a preference; it is a hard constraint that takes precedence over the table rows below.
Package-managed skills (mandatory): A skill Step 1 classified as package-managed from the lock file routes its lesson straight to Auto memory, recording the skill it applies to, with no question put to the user: the lock file has already settled ownership. A skill under ~/.claude/skills/ that Step 1 left ownership-unresolved may still be one a package manager replaces wholesale on its next update, discarding any edit made here. Before routing a lesson to such a skill, say plainly that an edit to it survives only while the user maintains it themselves. Then use AskUserQuestion to ask which is the case, with the options phrased as that effect: edits to this skill stick, or the next update overwrites them. Route the lesson to Auto memory when a package manager maintains the skill, recording the skill it applies to so the knowledge survives the next update. For those skills this rule outranks the skill-first rule, the routing table rows, and the tiebreakers below.
| Destination | Criteria |
|---|---|
| Project improvements | Actionable improvement to existing code: refactoring, performance, reliability, readability, testing, or DX. Not for documentation fixes — factual errors in CLAUDE.md belong in the Project CLAUDE.md / AGENTS.md row. Route to .turbo/improvements.md via the /note-improvement skill. |
| Auto memory | Discovered knowledge with no skill home: API quirks, debugging workarounds, compiler gotchas, tool pitfalls, user preferences. Must not overlap with any existing skill's domain — if it does, route to the skill instead (see skill-first rule above). A lesson the package-managed skills rule sends here stays here, whatever domain it overlaps. |
| Project CLAUDE.md / AGENTS.md | Intentional project decisions: conventions, architecture, stack choices, build setup, module boundaries. Also factual corrections to CLAUDE.md content (wrong commands, outdated paths, incorrect conventions) — fix these directly, do not defer to Project improvements. When the lesson applies only to one subtree, route it to the nearest enclosing CLAUDE.md/AGENTS.md; reserve the root file for project-wide decisions. |
| Existing user/project skill | Lesson would improve a skill's instructions, supporting files, or reference materials, add a missing edge case, correct its workflow, or refine its trigger conditions. Route to any skill whose domain covers the lesson — not just the skill worked on in this session. Changes go to the skill file directly. No contribution flow. |
| New skill | A cohesive body of knowledge emerged that deserves its own on-demand context. The test: would this knowledge be too large for a CLAUDE.md section, and should it only be loaded when relevant? See the skill categories table below. |
| Existing turbo skill | Same criteria as Existing user/project skill above, but for turbo skills. Before routing here, run `test -d ~/.turbo/repo/claude/skills/<name>`; if the directory does not exist, route to the Existing user/project skill destination instead, subject to the package-managed skills rule above. Changes go to the installed copy at ~/.claude/skills/, and are flagged for contribution (see Step 6). |
| No destination | Does not clearly fit any destination. Drop it. Routing a weak lesson is worse than losing it. |
Skill categories:
| Category | What it encodes | Example |
|---|---|---|
| Domain expertise | Best practices, patterns, API preferences | SwiftUI expert, Core Data guide |
| Tool/Service integration | API references, operations, ID formats | Paddle, Stripe, Keycloak |
| Decision framework | Judgment criteria, confidence levels, triage | Evaluate findings, performance audit |
| Content template | Writing conventions, tone, structure | Drafting, blog post, changelog |
| Knowledge/Research | Information discovery, schema definitions | Knowledge base, research process |
| Orchestrated workflow | Stateful multi-step procedures | Process ticket, process income |
Splitting heuristic: When a session creates scripts or multi-step procedures, split the lesson: a brief pointer goes to CLAUDE.md (script names, purpose), and the full workflow goes to a skill. Don't collapse them into a single CLAUDE.md entry.
Tiebreakers (in priority order):
Output a table as text before making any changes:
| # | Lesson | Destination | Action |
|---|--------|-------------|--------|
| 1 | Always use X for... | Project AGENTS.md | Append to ## Conventions |
| 2 | The /create-pr skill should... | ~/.claude/skills/create-pr | Update Step 2 |
| 3 | Multi-step deploy workflow | New project skill | Create new skill |
| 4 | User prefers short commit msgs | Auto memory | Update <resolved memory target> |For each lesson, show: concise summary, exact target file/skill, and whether it's an append, update-in-place, or new creation. For Auto memory, name the resolved project-memory target so the approval covers the durable write at that path.
Then use AskUserQuestion with these options: Approve or Reject.
Apply approved changes in order:
/note-improvement skill with the summary, location, and rationale for each./create-skill skill to apply changes to any file inside the skill directory (SKILL.md, references, scripts, assets)./create-skill skill for each new skill. Provide the trigger conditions and relevant context from the session.~/.turbo/repo/claude/SKILL-CONVENTIONS.md so turbo-specific conventions are in context before any editing./create-skill skill to update the installed copy at ~/.claude/skills/<name>/.Once every turbo skill edit is in place and reviewed, use AskUserQuestion to ask "These turbo skill improvements could benefit other users. Propose them upstream?" When the user confirms, run the /contribute-turbo skill once for all of them.
Then use the TaskList tool and proceed to any remaining task.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.