using-powerups-15a003 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited using-powerups-15a003 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Find and apply installed Agent Powerups before improvising. A powerup is useful only after you discover likely matches, inspect the actual asset, follow its instructions, and verify the user task with task-specific evidence.
Use at the start of non-trivial work, and again when the task changes shape.
Use when the user asks for debugging, planning, review, setup, file intake, cleanup, PR triage, second opinions, MCP config, hooks, commands, or AGENTS.md templates.
Do not force a powerup when none fits. Say no matching powerup applies and proceed normally.
agent-powerups location, usually agent-powerups/ under the agent root or the package repo.apx for discovery only.apx discover "<user task>" --target <codex|claude-code|gemini|generic>
apx inventory --target <codex|claude-code|gemini|generic> --json
apx list --json --verbose
apx plugins listIf apx is unavailable, inspect local folders: skills/, commands/, mcp/, agents-md/, hooks/, workflows/.
Prefer the narrowest high-ranked asset whose description matches the current task. Treat apx discover output as a shortlist, not as proof that a powerup has been used.
Examples:
| Task signal | Asset type to inspect |
|---|---|
| bug, failing test, regression | debugging skill |
| implementation spec | planning skill |
| file or URL intake | file-intake skill |
| pre-handoff validation | command |
| local MCP setup | MCP config |
| repo instruction baseline | AGENTS.md template |
For a candidate asset:
apx info <name>Then read the asset file. Do not rely only on the catalog summary.
Most powerups do not require step 4. Only use apx check when the asset declares external requirements or its own instructions say a dependency check is needed. Do not run apx check for every asset by default.
If apx check reports a missing command or package, stop and say exactly what is missing. Use apx check <asset> --install-missing --dry-run to preview supported installers. Ask before running --install-missing --yes. Do not pretend conversion, fetch, review, or CLI delegation happened when the tool was unavailable.
Follow the asset instructions. Keep scope local to the user task. For GitHub MCP, use apx mcp check github-local, apx mcp smoke github-local, then apx mcp install github-local --target <agent> --dry-run before any --yes install. For hooks, treat recipes as review-before-use; do not enable them automatically.
Final response should name:
not neededWhen a powerup applies:
Used: <asset-name>
Why: <task signal>
Requirements: <OK / missing / not needed>
Result: <how it changed the work>
Validation: <real task-specific checks, not apx check>When none applies:
No matching Agent Powerup found. Proceeded with normal repo inspection.Before claiming setup or use succeeded:
apx check output was not presented as proof that the skill was used or the task succeeded.apx catalog discovery failed.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.