deferred-refresh-flag-contract-c9798a — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited deferred-refresh-flag-contract-c9798a (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Domain: extensions-mcp Trigger: performBackgroundPluginInstallations completes reconcileMarketplaces and must decide whether to auto-refresh plugins or set plugins.needsRefresh via AppState. Source Pattern: Distilled from reviewed extension lifecycle and source-reconciliation patterns.
When new marketplaces are installed (result.installed.length > 0), treat the change as urgent: clear both marketplace and plugin caches, then call refreshActivePlugins(setAppState) so MCP connections re-establish with the freshly cloned sources. If that auto-refresh fails, log the error, clear the plugin cache with a reason string, and set plugins.needsRefresh = true so the UI prompts /reload-plugins. When only updates are available (result.updated.length > 0), do not auto-refresh; instead clear caches and set needsRefresh so the user opts into the reload. needsRefresh updates must be idempotent: the setter checks prev.plugins.needsRefresh and returns early if already true.
clearMarketplacesCache() before refreshing or flagging; it ensures the cached metadata is rebuilt before the next plugin load.refreshActivePlugins(setAppState) in a try/catch. On failure, call clearPluginCache('performBackgroundPluginInstallations: auto-refresh failed') and fall back to the needsRefresh guard that sets the flag to true only once.clearPluginCache('performBackgroundPluginInstallations: marketplaces reconciled') so stale plugin bundles are not re-used, but leave control in the user’s hands by setting needsRefresh instead of forcing a reload.needsRefresh setter uses setAppState(prev => { if (prev.plugins.needsRefresh) return prev; return { ...prev, plugins: { ...prev.plugins, needsRefresh: true } }; }) so the UI can show a single prompt and avoid redundant re-renders.After reconcileMarketplaces returns result.installed = [ ... ], the manager clears caches and calls refreshActivePlugins. If the refresh completes, caches stay clear and MCP reconnects automatically. If the refresh throws, the catch logs the failure, clears the plugin cache with a descriptive reason, and the guard flips plugins.needsRefresh so /reload-plugins shows up instead. When only result.updated is populated, the same cache-clearing and guard runs, but without trying to refresh automatically.
/reload-plugins.needsRefresh by overwriting the object blindly; always check the previous flag so a failed refresh path does not recreate the AppState slice on every error log.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.