publish-mock-server — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited publish-mock-server (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Build and publish the mock-server Docker image to ghcr.io/vfarcic/dot-ai-mock-server:latest.
sudo docker if your user is not in the docker group)gh token (needs write:packages scope): gh auth token | docker login ghcr.io -u vfarcic --password-stdinRun all commands from the repository root. The build context is the mock-server/ directory (relative — do NOT hardcode an absolute path).The default docker driver cannot push a multi-platform manifest, and building arm64 on an amd64 host needs QEMU. Register the emulator and create a container-driver builder:
docker run --privileged --rm tonistiigi/binfmt --install arm64
docker buildx create --name mockbuilder --driver docker-container --use --bootstrapTag both latest and the current dot-ai release version (so downstream repos can pin to a contract version instead of a digest). Derive the version from the root package.json:
VERSION=$(node -p "require('./package.json').version")
docker buildx build --builder mockbuilder \
--platform linux/amd64,linux/arm64 \
-t ghcr.io/vfarcic/dot-ai-mock-server:latest \
-t ghcr.io/vfarcic/dot-ai-mock-server:$VERSION \
--push mock-serverConfirm both tags resolve to the same digest and carry both platforms:
docker buildx imagetools inspect ghcr.io/vfarcic/dot-ai-mock-server:latestNote the manifest-list digest (sha256:…) — downstream repos pin to it.
After publishing, consumers (like dot-ai-ui) can use:
services:
mock-api:
image: ghcr.io/vfarcic/dot-ai-mock-server:latest
ports:
- "3001:3001"Run this skill when:
mock-server/fixtures/server.ts, routes.ts)latest plus an immutable version tag matching the dot-ai release(e.g. 1.22.0). latest is mutable; downstream repos should pin to the version tag or the digest for reproducible tests.
merging any change that affects the mock contract** — cutting a dot-ai release does NOT rebuild the image.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.