skip-skill-discovery-on-skill-expansion-cd89ad — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skip-skill-discovery-on-skill-expansion-cd89ad (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Domain: command-surfaces Trigger: Apply when generated or expanded skill text must pass through the attachment pipeline for parsing, but it is not fresh user intent and must not trigger discovery queries. Source Pattern: Distilled from reviewed command-surface and listing-control patterns.
Separate "text being inspected" from "text expressing user intent." When a pipeline reuses the attachment extractor on expanded SKILL.md content or other generated prompts, pass an explicit skip flag so the discovery subsystem stays off while the rest of the attachment logic still runs. This preserves useful secondary parsing such as @-mentions without paying for recursive or misleading skill-discovery calls on machine-generated text. The guard should live exactly where discovery would otherwise be attached so the expensive path is impossible to trigger accidentally.
If a slash command loads a 100 KB skill specification and then reuses the normal attachment extractor to resolve @-mentions inside it, pass skipSkillDiscovery: true. The extractor still parses mentions, but it does not launch another round of skill-discovery queries against the generated document body.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.