skill-name — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-name (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
One-paragraph overview: what this skill achieves and the core approach (e.g. "the bundled script collects X as JSON; the agent writes the narrative").
SCRIPT = this skill's scripts/Your-Script.ps1. Document the exact invocation, a table of the parameters that matter, and 2-3 copy-paste examples.
What the script prints (JSON shape, exit codes), and what goes to a file vs stdout.
REQUIRED (validator-enforced; may live here or in REFERENCE.md). The real, mechanism-level pitfalls of this domain — the traps that produce confident-but-wrong conclusions. For each: the trap → why it happens → the correct check/fix. Cover measurement traps (a tool/command that reports a misleading value), errors that point at the wrong cause, environment foot-guns, and known misattributions. Keep it honest and specific — a few verifiable gotchas beat a padded list. Add to it when a real run uncovers a new pitfall. Committed gotchas must be generic — no company-specific data.
Environment-specific gotchas (local). At the start of a run, read gotchas.local.md in this skill's folder if it exists — it holds traps learned in this environment (real server/DB names, local quirks). When you discover a new environment-specific pitfall, append it there, not to this file. gotchas.local.md is gitignored and is preserved across skill updates, so the skill gets more useful every time it's used here.
REQUIRED (validator-enforced; may live here or in REFERENCE.md). Document two things:
a health-check, or (for read-only skills) how to confirm ground truth and coverage before recommending anything. Never propose a change without a before-check.
effect landed, and fail loud if it can't be confirmed. Never report "done" unverified.
Known failure modes → what to tell the user.
<!-- Checklist before opening a PR (see CONTRIBUTING.md):
npm run validate passes-->
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.