smoke-test-f156b3 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited smoke-test-f156b3 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Launch the app and hands-on verify that it works by interacting with it. Every smoke test is a concrete interaction with the running app: navigating a screen, clicking a control, filling a form, running a CLI command, and observing the result.
Resolve scope using the first match:
Always check for project-specific testing skills or MCP tools first. Use the fallbacks below when nothing project-specific is available:
browser-use@openai-bundled plugincomputer-use@openai-bundled plugin$test-run-rules SkillRun the $test-run-rules skill to load the rules for launching and driving the app.
Before drafting tests, check whether there is something to exercise:
Otherwise, design targeted smoke tests. Each test should:
Confirm any control, command, or other affordance a test names exists in the code before writing the test: search for the API that would implement it rather than inferring it from what the feature does. Where it cannot be confirmed, write the test against the outcome to verify and leave the affordance to be found during execution.
Confirm as well that the surface accepts a test's action in the state the test sets up. When the code refuses or swallows that action there, drive a state or entry point where the action goes through, or make the refusal itself the observation. When a scenario claims an affordance is available in a state, drive each such affordance in that state to its first observable effect and make that effect the pass condition; a refusal or swallowed action there fails the scenario. For an affordance whose effect is not cleanly undoable, stop at its confirmation step and cancel it. When the affordance has no confirmation step, act on a record this run created, record it in Owned cleanup, and carry any write to a shared external system through the test run rules' write sequence; plan the scenario as unverified when no such record can be created.
Output the plan as text:
Smoke Test Plan:
1. [Interaction with the running app] — what the interaction verifies
2. [Interaction with the running app] — what the interaction verifies
3. [Interaction with the running app] — what the interaction verifies
Approach: [browser-use@openai-bundled / computer-use@openai-bundled / terminal]
Dev server command: [command]When another agent will execute this plan, append a Setup contract capturing what the executor needs and cannot safely rediscover:
Include an item when the executor would otherwise derive it from application source, or when it is state this run generated that the executor cannot rediscover safely; omit anything the running app makes self-evident. Require these details when the chosen testing approach prohibits reading application source as setup documentation.
Write each precondition as an observation the executor makes rather than a fact it can rely on, and say what to do when it does not hold: name the substitute setup, or direct the executor to report the precondition as wrong rather than the scenario as failed.
When the scope's happy path writes to a shared external system and those writes are not cleanly undoable, scope the plan to a path that provably cannot write: choose fixture data with nothing to act on, as the test run rules direct. State that scoping choice in the plan so the executor does not widen it back. When the writing path must run, work through the test run rules' write sequence.
When a scenario's pass condition is that nothing happens — no write, no call, no state change — pair it with a control that differs only in the dimension under test and whose expected outcome is that the effect does occur. A lone negative scenario cannot distinguish the behavior under test from a harness that never reached it. Pair each guard separately.
When the scenario drives one of the inputs below, establish while writing the plan that it reaches the code under test. An input refused before it gets there produces the expected absence for the wrong reason, and the control does not distinguish that from the behavior under test:
Run the control through a stub that intercepts the mechanism, introducing one when the negative scenario was scoped by fixture data alone, so observing the effect there establishes that the interception point is reached:
If a project-specific testing skill or MCP tool was identified in Step 2, use that. The paths below are fallbacks.
Start or reuse a dev server under the test run rules. Use the browser-use@openai-bundled plugin to interact with the app.
Core verification loop per test:
Close the browser session and stop the dev server when done.
Launch the app. Use the computer-use@openai-bundled plugin to interact with the UI.
Core verification loop per test:
Run commands directly.
Core verification loop per test:
Fallback when Step 4 routed here because nothing was interactive. Run multiple integration targets sequentially when they reset or mutate a shared test database, even when the checks are otherwise independent. Tail output in a background shell for long-running suites so failures surface as they happen.
Core verification loop per run:
Do not invent a target if none was found in Step 4 — that gate already stopped.
Record a test the test run rules leave blocked as UNVERIFIED and one they leave inconclusive as INCONCLUSIVE.
Before reporting a planned test as unverified, retry its setup under the test run rules for unavailable infrastructure and for privileged state, unless Step 4 already tried them and they failed. When the setup succeeds, run the test and record its result. Report a test as unverified only after that attempt, naming what was tried and what blocked it. Treat an existing unit test over the same behavior as no substitute: it leaves the interactive path unexercised.
Report a negative test and its control together: the negative reads as passed only when its control produced the effect, and as inconclusive otherwise.
Present a summary:
Smoke Test Results:
- [PASS] Test 1: description — [substitution, when one was driven]
- [FAIL] Test 2: description — [what went wrong]
- [UNVERIFIED] Test 3: description — [what was tried, what blocked it]
- [INCONCLUSIVE] Test 4: description — [why the result cannot be read]
Overall: X/Y passed, Z unverified, W inconclusiveIf any test failed, include the relevant snapshot, screenshot, or output showing the failure.
Then call update_plan to mark this step completed and continue with the next step of the active workflow.
$investigate skill on the smoke test report.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.