seed — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited seed (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Populate the distill MCP knowledge base from the current repo's git history. Extracts decisions, patterns, failures, and context from commits and stores them with correct metadata.
distill MCP server running with search_memory and update_memory tools availableREPO_NAME=$(basename $(git rev-parse --toplevel))
COMMIT_COUNT=$(git rev-list --count HEAD)
echo "$REPO_NAME: $COMMIT_COUNT commits"
git log --oneline --reverse | head -20
git log --oneline --reverse | tail -20Report the repo name and commit count to the user. Ask if they want to seed all commits or a date range.
git log --reverse --format="%H %aI %s" [--since="YYYY-MM-DD"]For each commit:
Extract the timestamp — use the commit's author date (%aI), NEVER the current time.
Classify the commit:
| Type | What to extract | Example |
|---|---|---|
decision | Chose X over Y because Z | "Replaced SQLite with asyncpg for stateless GKE deployment" |
pattern | Recurring convention | "All services use structlog with JSON output to stderr" |
failure | Tried X, abandoned because Y | "Tried Redis for persistence, reverted — too complex for single-node" |
dependency | Service A depends on B | "Parser requires pgvector extension >= 0.5" |
context | Migration/state at a point in time | "Auth middleware rewrite started, driven by compliance requirements" |
Skip these:
chore: formatting, linting, dep bumps without rationalefix: typos, whitespace, trivial CI tweaksShort commit messages (1-2 lines): Read the diff — the real decision is in the code.
git show <hash> --stat
git show <hash> -- <relevant files>Long/AI-generated messages: The message IS the knowledge. Skim code only if unclear.
For each extracted commit, POST to the local ingest endpoint:
curl -s -X POST http://127.0.0.1:${DISTILL_INGEST_PORT:-21746}/observe \
-H 'Content-Type: application/json' \
-d '{"tool_name": "seed", "input": "<commit hash>", "output": "<distilled knowledge>"}'The background worker will distill, embed, and store each observation.
Every observation MUST include:
When a later commit revises an earlier decision, reference the evolution:
"Initially chose SQLite for storage (2024-01). Switched to PostgreSQL + pgvector
(2024-03) to enable stateless deployment on GKE."
When multiple commits build toward a pattern, synthesize into one entry with the date of the latest commit.
After every 10 commits processed, verify the last 3 entries:
list_recent(top_k=3)
get_memories(ids=[...])Check that:
repos is set correctlytype is appropriateIf any check fails, fix the entry with update_memory before continuing.
After all commits are processed:
search_memory("architecture")
search_memory("decisions")
search_memory("patterns")
list_recent(top_k=20)Report to the user:
useless. "Chose PostgreSQL over SQLite for stateless pod deployment" is valuable.
or surrounding commits for context.
each other.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.