debug-backend — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited debug-backend (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Stop. Do not edit any file yet. Work through these 5 steps in order.
Run these greps to find where the bug lives. Check one layer at a time.
# Is it a routing problem? (wrong status code, missing auth, bad request parsing)
grep -n "HTTPException\|status_code\|Depends(" app/routers/<file>.py
# Is it a service logic problem? (wrong calculation, wrong state transition)
grep -n "def \|raise \|return " app/services/<file>.py
# Is it a repository problem? (wrong query, missing user_id scope, transaction issue)
grep -n "SELECT\|filter\|where\|FOR UPDATE" app/repositories/<file>.py
# Is it a provider problem? (timeout, wrong response shape, missing error handling)
grep -n "httpx\|raise\|return\|except" app/providers/<file>.pyDecision: fix only in the layer where the bug lives. Never fix a service bug in the router.
These cause 80% of production bugs in AI-coded backends. Grep for each:
# Antipattern 1: SQLAlchemy Session leaked into services
grep -rn "AsyncSession\|Session\|from sqlalchemy" app/services/
# Antipattern 2: Provider returning raw dict instead of domain type
grep -rn "return {" app/providers/
# Antipattern 3: Business logic in router (calculation, state change, external call)
grep -c "await.*service\|await.*repo\|if.*balance\|FOR UPDATE" app/routers/*.py| Result | Root cause | Principle |
|---|---|---|
| Session in services | Hexagonal boundary broken | B1 |
return {} from provider | Missing ACL | B3 |
| Logic in router | Layer violation | A3 / code-standards |
No user_id filter in query | Multi-tenancy gap | security-rules |
Before changing any production code, write a failing test that captures the exact bug.
# Template: place in tests/unit/ or tests/integration/
async def test_<bug_description>():
# Arrange: minimal setup that triggers the bug
repo = FakeCreditsRepo()
repo.seed_balance("user-1", Decimal("5.00"))
service = CreditsUserService(repo=repo)
# Act: call the exact code path that fails
with pytest.raises(ValueError, match="Insufficient balance"):
await service.charge("user-1", Decimal("10.00"), idempotency_key="idem-1")
# Assert: prove the invariant that was violated
assert await repo.get_balance("user-1") == Decimal("5.00") # not negativeRun it: pytest tests/unit/test_<file>.py::test_<bug_description> -v It must be RED before you fix anything.
Minimum change. No opportunistic refactoring. No unrelated cleanup.
Router bug → fix only app/routers/
Service bug → fix only app/services/
Repo bug → fix only app/repositories/
Provider bug → fix only app/providers/After fixing: run the reproducing test. It must turn GREEN.
pytest tests/unit/test_<file>.py::test_<bug_description> -v
# Expected: PASSEDbash scripts/lint-architecture.shMust exit 0. If a check fails, the fix introduced a new architecture violation — revert and fix properly.
| Error | Where to look first | Likely cause |
|---|---|---|
422 Unprocessable Entity | Router — Pydantic schema | Wrong field type or missing required field |
500 Internal Server Error | Service — exception not caught | Provider returned unexpected shape (dict not JobResult) |
KeyError: 'url' | Provider — ACL missing | Provider response changed, parser not updated |
InsufficientFunds on correct balance | Repo — concurrent hold | Two requests raced, no FOR UPDATE lock |
401 on authenticated route | Router — Depends(get_current_user_id) missing | Auth dependency not wired |
| Test passes, prod fails | Repo — fake vs real diverged | FakeCreditsRepo doesn't match CreditsRepoProtocol |
| Logs silent on error | Service — bare except: | Exception swallowed, add logger.exception(...) |
The skill was applied correctly when:
bash scripts/lint-architecture.sh exits 0~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.