swiftpm-build-inspector — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited swiftpm-build-inspector (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Bundled commands use $PLUGIN_ROOT ($env:PLUGIN_ROOT in PowerShell; same path suffix) for the plugin root. Set it once: use the host's plugin-root variable when defined (Claude Code: PLUGIN_ROOT="$CLAUDE_PLUGIN_ROOT"), otherwise the absolute path of this plugin's root directory.
Gather evidence before recommending package changes. Do not edit manifests/dependencies without explicit approval.
Package.swift, Package.resolvedBefore recommending a local package, prove it is in the project graph: check XCLocalSwiftPackageReference and XCSwiftPackageProductDependency in project.pbxproj. Ignore on-disk packages that are not linked.
For branch-pinned dependencies:
python3 "$PLUGIN_ROOT/skills/swiftpm-build-inspector/scripts/check_spm_pins.py" --project App.xcodeprojIf tags exist, recommend tag pins when appropriate; otherwise recommend a revision hash for determinism. Distinguish intentional branch tracking from missing-tag upstreams.
@_exported importswift-syntax cascadesModular SDK migrations do not automatically speed builds. Compare SwiftCompile, SwiftEmitModule, and ScanDependencies task counts and benchmark before recommending for performance; note when the benefit is import hygiene/API surface rather than wait time.
If the same module appears multiple times in timing output, investigate option/variant drift before source shaving.
For each finding include evidence, affected package/plugin, clean vs incremental impact, CI impact, estimated wait-time impact, and approval requirement. If the bottleneck is not package-related, hand off to xcode-project-auditor or xcode-compile-profiler.
References: references/spm-analysis-checks.md, ../../shared/build-optimization/references/recommendation-format.md, build-optimization-sources.md.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.