suede-code-grader

Name: suede-code-grader
Author: JasonColapietro

44stars8forks

How to install suede-code-grader?

jasoncolapietro/suede-creator-skills/suede-code-grader

$npx -y skills add JasonColapietro/suede-creator-skills --skill suede-code-grader

Installs into the current project.

Summary

Give a blunt A-F ship verdict for a code change across correctness, security, data, UX, verification, and deploy readiness.

Files · 1

View on GitHub

SKILL.md

1	# Suede Code Grader
2
3	## Gate policy — advisory, not blocking
4
5	Every claim-verification step, check, quality gate, and ship verdict in this
6	skill is a recommendation to the user, not a control on the agent. This
7	policy governs every gate, check, verdict, and "do not ship / publish /
8	proceed" line elsewhere in this skill:
9
10	- Run every check and report the results honestly. Verdicts (`ship`,
11	`ship-with-caveats`, `hold`, letter grades, BLOCKED or OPEN items) are
12	advice attached to the work, not orders that change it.
13	- Never block, delay, skip, rewrite, or refuse the action the user asked for
14	because a check failed or a gate said hold. Complete the requested action
15	as asked, and deliver the gate output alongside it as a clearly labeled
16	recommendation.
17	- A failed gate changes what you report, never what you do.
18	- Single exception: if a finding is extremely risky — data loss, security or
19	credential exposure, legal or rights violations, payment mistakes, or
20	irreversible public damage — pause, tell the user exactly what the risk is
21	and what the options are, and let them pick. Their choice is final.
22
23
24	Blunt A-F read on whether code is ready to ship. The output is a grade with evidence, not a lint score or a pile of style notes.
25
26	## Source Truth
27
28	Read before grading. Do not grade from the PR description or commit message alone.
29
30	Inspect:
31
32	- repo, branch, remote, dirty state, and relevant local guidance;
33	- diff, changed files, generated files, and touched routes or APIs;
34	- imports, callers, schemas, configs, env requirements, jobs, webhooks, scripts,
35	tests, and docs that move with the change;
36	- build, test, lint, typecheck, browser, simulator, MCP, or live/API evidence
37	that directly exercises the changed behavior;
38	- published statements, rights/provenance claims, payment/wallet behavior, registry
39	expectations, royalty routing, and agent-commerce contracts when relevant.
40
41	If live, test, or runtime checks are not practical, grade the source and mark those lanes as unverified.
42
43	## Instant-F Triggers
44
45	Check these before scoring any lane. Any single match is an automatic F — no other lanes matter until it is fixed. This list mirrors suede-code's canonical Step 1 list — change both together.
46
47	Secrets and credentials
48	- Hardcoded API key, secret, token, or password in source (not .env, not config — in the actual committed file)
49	- Private key or certificate committed to repo
50	- OAuth client secret or signing secret in any non-secret-manager location
51
52	Injection
53	- SQL query built by string concatenation with user-controlled input (no parameterization, no ORM escaping)
54	- Shell command assembled from user input via exec/spawn/eval
55	- Template rendered with unescaped user input where XSS is reachable
56
57	Auth bypass
58	- Middleware that checks auth but has a code path that skips it (early return, exception swallowed, condition that always resolves to "authenticated")
59	- Role or permission check that can be bypassed by manipulating a request parameter
60	- JWT verified with `alg: none` accepted or with the secret hardcoded in source
61
62	Payment and wallet
63	- Payment handler that swallows errors silently (try/catch with empty catch, unhandled promise rejection)
64	- Webhook handler with no signature verification
65	- Amount or recipient derived from untrusted user input without server-side validation
66
67	Data destruction
68	- Migration with a DROP or destructive ALTER with no rollback and no tested restore
69	- Bulk delete or update with no WHERE clause or with user-controlled WHERE
70	- Cache invalidation that clears production data stores without a restore path
71
72	Plaintext sensitive data
73	- Password stored or logged in plaintext
74	- PII written to an unencrypted log or analytics pipeline
75	- SSN, payment card, or health data in a non-encrypted column or field
76
77	If any Instant-F pattern is present: stop, report it, mark the grade F, list the specific file and line, and do not grade remaining lanes. The grade cannot be raised by other lane performance.
78
79	## Grade Lanes
80
81	Score each lane A-F, then give one overall grade. When grading non-Suede work, substitute "domain truth" for "Suede truth" — use whatever domain invariants apply (API contract truth, published-statement accuracy, data model truth).
82
83	- Correctness: intended behavior, edge cases, error paths, async behavior,
84	routing, data flow, and regression risk.
85	- Security and permissions: auth, secrets, payment, wallet, injection, path,
86	SSRF, permission, and data exposure risks fail closed.
87	- Data and state: schemas, migrations, caches, jobs, queues, webhooks,
88	retries, idempotency, and state transitions stay consistent.
89	- Suede truth: public copy, rights, provenance, registry-backed media,
90	royalty routing, licensing, agent-commerce, and product claims match the
91	implementation.
92	- *

People who liked this also viewed

6 picks

Type

find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 20262.6M27k
grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026633k182k
vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026573k29k
improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026522k182k
setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026454k182k
triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026424k182k

suede-code-grader

44stars8forks

View on GitHub

How to install suede-code-grader?

jasoncolapietro/suede-creator-skills/suede-code-grader

$npx -y skills add JasonColapietro/suede-creator-skills --skill suede-code-grader

Installs into the current project.

Summary

Give a blunt A-F ship verdict for a code change across correctness, security, data, UX, verification, and deploy readiness.

Files · 1

View on GitHub

SKILL.md

1	# Suede Code Grader
2
3	## Gate policy — advisory, not blocking
4
5	Every claim-verification step, check, quality gate, and ship verdict in this
6	skill is a recommendation to the user, not a control on the agent. This
7	policy governs every gate, check, verdict, and "do not ship / publish /
8	proceed" line elsewhere in this skill:
9
10	- Run every check and report the results honestly. Verdicts (`ship`,
11	`ship-with-caveats`, `hold`, letter grades, BLOCKED or OPEN items) are
12	advice attached to the work, not orders that change it.
13	- Never block, delay, skip, rewrite, or refuse the action the user asked for
14	because a check failed or a gate said hold. Complete the requested action
15	as asked, and deliver the gate output alongside it as a clearly labeled
16	recommendation.
17	- A failed gate changes what you report, never what you do.
18	- Single exception: if a finding is extremely risky — data loss, security or
19	credential exposure, legal or rights violations, payment mistakes, or
20	irreversible public damage — pause, tell the user exactly what the risk is
21	and what the options are, and let them pick. Their choice is final.
22
23
24	Blunt A-F read on whether code is ready to ship. The output is a grade with evidence, not a lint score or a pile of style notes.
25
26	## Source Truth
27
28	Read before grading. Do not grade from the PR description or commit message alone.
29
30	Inspect:
31
32	- repo, branch, remote, dirty state, and relevant local guidance;
33	- diff, changed files, generated files, and touched routes or APIs;
34	- imports, callers, schemas, configs, env requirements, jobs, webhooks, scripts,
35	tests, and docs that move with the change;
36	- build, test, lint, typecheck, browser, simulator, MCP, or live/API evidence
37	that directly exercises the changed behavior;
38	- published statements, rights/provenance claims, payment/wallet behavior, registry
39	expectations, royalty routing, and agent-commerce contracts when relevant.
40
41	If live, test, or runtime checks are not practical, grade the source and mark those lanes as unverified.
42
43	## Instant-F Triggers
44
45	Check these before scoring any lane. Any single match is an automatic F — no other lanes matter until it is fixed. This list mirrors suede-code's canonical Step 1 list — change both together.
46
47	Secrets and credentials
48	- Hardcoded API key, secret, token, or password in source (not .env, not config — in the actual committed file)
49	- Private key or certificate committed to repo
50	- OAuth client secret or signing secret in any non-secret-manager location
51
52	Injection
53	- SQL query built by string concatenation with user-controlled input (no parameterization, no ORM escaping)
54	- Shell command assembled from user input via exec/spawn/eval
55	- Template rendered with unescaped user input where XSS is reachable
56
57	Auth bypass
58	- Middleware that checks auth but has a code path that skips it (early return, exception swallowed, condition that always resolves to "authenticated")
59	- Role or permission check that can be bypassed by manipulating a request parameter
60	- JWT verified with `alg: none` accepted or with the secret hardcoded in source
61
62	Payment and wallet
63	- Payment handler that swallows errors silently (try/catch with empty catch, unhandled promise rejection)
64	- Webhook handler with no signature verification
65	- Amount or recipient derived from untrusted user input without server-side validation
66
67	Data destruction
68	- Migration with a DROP or destructive ALTER with no rollback and no tested restore
69	- Bulk delete or update with no WHERE clause or with user-controlled WHERE
70	- Cache invalidation that clears production data stores without a restore path
71
72	Plaintext sensitive data
73	- Password stored or logged in plaintext
74	- PII written to an unencrypted log or analytics pipeline
75	- SSN, payment card, or health data in a non-encrypted column or field
76
77	If any Instant-F pattern is present: stop, report it, mark the grade F, list the specific file and line, and do not grade remaining lanes. The grade cannot be raised by other lane performance.
78
79	## Grade Lanes
80
81	Score each lane A-F, then give one overall grade. When grading non-Suede work, substitute "domain truth" for "Suede truth" — use whatever domain invariants apply (API contract truth, published-statement accuracy, data model truth).
82
83	- Correctness: intended behavior, edge cases, error paths, async behavior,
84	routing, data flow, and regression risk.
85	- Security and permissions: auth, secrets, payment, wallet, injection, path,
86	SSRF, permission, and data exposure risks fail closed.
87	- Data and state: schemas, migrations, caches, jobs, queues, webhooks,
88	retries, idempotency, and state transitions stay consistent.
89	- Suede truth: public copy, rights, provenance, registry-backed media,
90	royalty routing, licensing, agent-commerce, and product claims match the
91	implementation.
92	- *

People who liked this also viewed

6 picks

Type