qa — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited qa (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Run an interactive QA session. The user describes problems they have encountered. You ask clarifying questions, explore the codebase for context, and file GitHub issues that are durable, user-focused, and use the project's domain language.
Let the user describe the problem in their own words. Ask at most 2-3 short clarifying questions, focused on:
Do NOT interrogate. If the description is enough to file an issue, move on.
While talking with the user, launch an agent (subagent_type=Explore) in the background to investigate the relevant area. The goal is NOT to find a fix, but to:
This context helps write a higher-quality issue, but the issue itself MUST NOT reference specific files, line numbers, or internal implementation details.
Before filing, decide: is this one issue or should it be broken down into several?
Break down when:
Keep it as one issue when:
Create issues via gh issue create. Do NOT ask the user to review first — just file and share the URL.
Issues should be durable — they should remain meaningful after major refactors. Write from the user's point of view.
#### For a single issue
Use this template:
## What happened
[Describe the actual behavior the user experienced, in plain language]
## What I expected
[Describe the expected behavior]
## Steps to reproduce
1. [Concrete, numbered steps a developer can follow]
2. [Use domain terms from the codebase, not internal module names]
3. [Include relevant inputs, flags, or configuration]
## Additional context
[Any extra observations from the user or from codebase exploration that help frame the issue — e.g. "this only happens when using the Docker layer, not the filesystem layer" — use domain language but don't cite files]#### For a breakdown (multiple issues)
Create issues in dependency order (blockers first), so you can reference real issue numbers.
Use this template for each sub-issue:
## Parent issue
#<parent-issue-number> (if you created a tracking issue) or "Reported during QA session"
## What's wrong
[Describe this specific behavior problem — just this slice, not the whole report]
## What I expected
[Expected behavior for this specific slice]
## Steps to reproduce
1. [Steps specific to THIS issue]
## Blocked by
- #<issue-number> (if this issue can't be fixed until another is resolved)
Or "None — can start immediately" if no blockers.
## Additional context
[Any extra observations relevant to this slice]When breaking down:
#### Rules for all issue bodies
After filing, print all issue URLs (with a brief summary of blocking relationships) and ask: "Next issue, or are we done?"
Continue until the user says they are done. Each issue is independent — do not batch them.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.