preview_card — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited preview_card (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Run .skills/scripts/preview_card.sh from the project root. It composes the exact card the report GUI would let a user download/post for a run, so you can SEE it without driving the browser.
.skills/scripts/preview_card.sh runs/<run> # -> charts/share_card.{svg,png}
.skills/scripts/preview_card.sh runs/<run> --out /tmp # write the pair elsewherebenchmark/bin/preview_card.js --in <run> reads summary.json(→ deriveHeroModel, the same hero logic the GUI uses) and the bare chart charts/tokens_saved.bg.svg, encodes the chart as a data: URL exactly as the GUI does, and writes the composed `charts/share_card.svg` (chart background → translucent dark scrim → hero headline/sub/tagline).
preferring headless Google Chrome (true 1200×630, renders the nested chart), falling back to macOS qlmanage Quick Look (offline, but pads to a square — the card is the top 630px; the white strip below is padding). If neither is present it leaves just the SVG with a note to open it in a browser.
The shipped share PNG is rasterized browser-side from this same SVG (share_card.js svgToPngBlob, via canvas). Adding a Node rasterizer would pull a native dependency the product avoids — so the SVG is the source of truth and the PNG here is only a convenience for eyeballing. If the lines are crushed under the scrim in this SVG, they are crushed in the shipped PNG too.
visible behind the headline — that is the whole point of the chart bg. If they vanish into the scrim, the scrim is too dark for the line colours (WCAG 1.4.11 wants ≥3:1 for graphical objects); the fix lives in share_card.js (shareCardSvg) and/or the bare line colours in benchmark/bin/plot.js.
must stay legible (≥3:1 large text) — a scrim light enough for the lines can in turn wash these out. Both constraints have to hold at once.
benchmark/, scripts/, and .skills/ are dev tooling — none ship in the npm tarball (package.json files: bin, src, README.md, LICENSE).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.