ralph-specum-implement — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ralph-specum-implement (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are a coordinator, not an executor -- delegate each task to a spec-executor sub-agent.
.current-spectasks.md.ralph-state.json only when all tasks are complete, verified, and activePrototypes is emptytasks.md. Read .progress.md, current state, and current task markers.tasks.md once into ordered top-level task rows. Include only unindented checkboxes outside fenced example blocks whose next token is a concrete numeric task ID, V<number>, VE<number>, or VF; exclude nested and example checkboxes, completion criteria, and placeholder IDs. From that one list derive total, the completed count across all rows, and next_index as the zero-based position of the first incomplete row or total when none remains. Do not derive next_index from the completed count; non-prefix completion cases resume at the earliest incomplete row.next_index. For a prototype return, require a validated non-negative returnTaskIndex and verify that it identifies the first eligible incomplete task. Merge state once with:phase: "execution"awaitingApproval: falsetotalTasks: totalnext_index for fresh execution, or the validated returnTaskIndex for a prototype returntaskIteration, maxTaskIterations, globalIteration, maxGlobalIterations, commitSpec, and relatedSpecsprototype_records.py reconcile whenever state exists and run select-downstream whenever activePrototypes is nonempty or prototype history exists. Request --target execution, --target "task:$TASK_INDEX", and --path for every declared current-task path. Stop when an active blocker or stale input targets the work, or when any matching targetDecisions entry is not both proofAvailable: true and eligible: true. Missing dependency or approved-transfer proof blocks conservatively. Report the prototype ID and resume active work through $ralph-specum-prototype --resume <id>; route terminal staleness to its earliest affected phase or task.taskIndex still equals the validated returnTaskIndex and identifies the first eligible incomplete task before dispatch.spec-executor sub-agent. Pass the task description, file targets, success criteria, and context from .progress.md. The sub-agent implements the task and outputs TASK_COMPLETE. Do NOT implement tasks yourself. Execute tasks in order until complete or blocked.[P] tasks may batch only when file sets do not overlap and verification is independent.[VERIFY] tasks stay in the same run and must produce explicit verification evidence.tasks.md. If markers are absent, treat tasks as non-batchable by default..progress.mdCommit line unless commits were explicitly disabled../../references/workflow.md. Normal mode may ask at that boundary for separate explicit authorization naming every outbound **/prototypes/*.md record. Quick mode asks no question and skips every push. A skipped or denied push ends the dependent remote lifecycle path: do not run gh pr create, gh pr merge, gh pr checks, gh pr view, gh api, gh run, gh issue, remote review polling, issue writes, or later remote steps that depend on that push. Quick mode continues or finishes locally and reports Remote lifecycle skipped: prototype evidence stayed local. Preserve the existing normal remote lifecycle only after the gate completes the push. Never push an isolated prototype source branch. commitSpec authorizes local commits only.activePrototypes remains nonempty, preserve .ralph-state.json and stop with its IDs. Otherwise remove state and report completion.tasks.md for completion and repair state to match.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.