build-and-report — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited build-and-report (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Post-implementation close for a forge run. Merges work-unit worktrees (if any), bumps the version per the consuming project's convention, runs the project's build, and emits the final report. Stack-agnostic: concrete commands live in the consuming project's own CLAUDE.md.
This skill handles two paths:
/forge:dispatch-implementation ran; one or more work-unit worktrees need merging into the active branch before build./forge:dispatch-implementation run (parallel path), ORParallel path: for each implementer report:
Tabulate:
| Unit | Status | Files changed | Tests | Notes |
|------|--------|---------------|-------|-------|
| W1 | Done | … | passed | … |
| W2 | Blocked | … | n/a | <blocker summary, link to implementer report> |If any unit is blocked, STOP. Surface the blocker to the user; do not merge worktrees with incomplete work.
In-session path: restate the orchestrator's edit summary with file:line for each change, mapped to the plan's steps. Confirm each step's done-when criterion was met before proceeding.
Skip this step on the in-session path — there are no worktrees to merge.
Each implementer ran in isolation: "worktree" and committed once. Aggregate by merging each unit branch back to the working branch in dependency order (the plan's contract clause numbering is a reasonable proxy when there is no explicit dependency graph).
MUST invoke Bash for each merge with a clear description:
Bash(
command: "git merge --no-ff <unit-branch>",
description: "Merge work unit W<N> back into the active branch"
)Resolve any merge conflict by reading both sides + the plan's contract clauses; never blindly accept either side. Conflicts usually signal that two units' "Files touched" sets overlapped — that's a planning gap to note in the final report's "what we'd improve" section.
The step's Done when criterion is the canonical verification step (preferred form: a verification command). Run it against the merged tree, regardless of which path you took.
For each step:
Bash. Record pass/fail + output snippet on fail.If a command-based criterion fails, STOP. The merge is complete but the feature does not satisfy the plan. Surface to the user before bumping versions or producing the final report.
Forge is stack-agnostic; the actual commands depend on the consuming project. Read the consuming project's CLAUDE.md "Build Commands" section (or the closest equivalent it carries) for:
plugin.xml + build.gradle.kts for IntelliJ plugins; package.json for Node; Cargo.toml for Rust; pyproject.toml for Python; .claude-plugin/plugin.json for Claude Code plugins../gradlew buildPlugin, npm run build, cargo build, etc.).Bump the version BEFORE running the build, so the build artifact carries the new version number.
If the consuming project's CLAUDE.md does not specify these, MUST invoke AskUserQuestion with the full schema below — populate the first 2–3 option labels with concrete commands you discovered from the project (Makefile target, package.json script, build tool config, etc.) and keep "Skip build" as the last option. Do NOT invent commands you did not see in the project.
AskUserQuestion(questions: [{
question: "The project's CLAUDE.md does not specify build commands. Which should I run?",
header: "Build",
multiSelect: false,
options: [
{ label: "<discovered command 1>", description: "<what this command does, with the file/script it came from>" },
{ label: "<discovered command 2>", description: "<what this command does, with the file/script it came from>" },
{ label: "Skip build", description: "Complete the workflow without building. The final report will note that build verification was skipped." }
]
}])For each command, MUST invoke Bash with a description:
Bash(
command: "<project's build command from CLAUDE.md>",
description: "Run project build to verify the merged change set compiles"
)If the build fails: STOP. Surface the failure to the user with the failing output; do not paper over with --no-verify or skip flags.
Append a single markdown report to the conversation, following the structure in references/final-report.md. The report MUST include these two sections, named exactly:
Pitch both sections at a developer who did NOT follow the implementation and will skim. Technical terms and concrete commands are fine — this reader is a dev; a tour of the change's internals is not — that depth trains readers to accept without reading.
npm run dev, the curl call, the test target), the inputs to try, what counts as success, and which edge cases to poke. Skip the change's internals — the reader is verifying behavior, not reviewing the diff.For the full report template, see references/final-report.md.
--no-verify or equivalent flags hide regressions; the build is the workflow's last safety net.Final step. The workflow is complete when this skill returns the report to the user.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.