Project Prospector — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Project Prospector (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
Aggregate score unchanged between these scans.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center">
A Claude Code plugin that catalogs and ranks everything you've built or sketched on a machine — half-finished repos, one-off scripts, dormant ideas, running services — into a tiered ranking by idea-novelty and leverage.
</div>
/plugin marketplace add 88plug/project-prospector
/plugin install project-prospector@project-prospectorAsk in plain language — no command to memorize:
What have I built on this laptop? Rank my projects by which ideas are most original.You get a tiered ranking, strongest idea first, with [idea]/[LIVE]/[dormant] tags and an evidence-anchored one-liner for each entry:
Tier S — genius
benchie [LIVE] — predicts engine latency without launching it
(perfmodel/roofline.py), 72 commits this week.
Tier A — elegant, high-leverage
searxng-mcp — token-efficient self-hosted search for agents; dual-IP failover.
Dormant
old-scraper — last real commit pre-cutoff; cosmetic touch since.Project Prospector surveys a whole machine for your own work and ranks it by the quality of the idea, not how finished it is. A half-built concept with a novel core can outrank a polished CRUD app. The name is the intent: you're prospecting a messy filesystem for the few strong ideas buried in it.
It runs a two-pass, parallel, read-only sweep, then synthesizes one ranking:
homelab, AI-tooling, not alphabetical) and gives each cluster its own read-only explorer agent that reads READMEs, runs git log since the cutoff, and judges non-git dirs by file mtimes.
file sweep structurally misses, so you don't confidently report "that's everything" and be wrong.
and produces an S–D tiered ranking with evidence-anchored rationale and alternative lenses.
One agent reading directories top to bottom misses most of the value. The strong ideas hide in places a plain ls never reaches, so the blind-spot pass covers:
~/.claude/projects/ slugs, grepped for idea and planlanguage. Finds ideas discussed but never turned into a folder.
~/.codex/, ~/.opencode/, ~/.config/ agent tools.Finds work done through other tools.
crontab -l,systemctl --user timers and units, docker ps -a, long-running processes. Reveals what is actually live versus abandoned.
~/Downloads, ~/Documents,~/Desktop, and browser bookmarks and history. Finds ideas you're circling but haven't built.
/opt, /srv, /mnt, /media, nested repos inside otherprojects, and system-wide recently-modified source. Confirms nothing hides outside the obvious tree.
The default axis is idea-novelty, non-obvious insight, and leverage — not lines of code, not polish. Output is structured as tiers, strongest first:
Each entry carries a tag that separates the idea from its execution state: [idea] (no codebase yet, can still rank at the top), [LIVE] (currently running), and [dormant] (untouched before the cutoff). Every cited path, commit count, or number is verified against disk before it goes in the report.
<details> <summary>Alternative lenses (ask for any of these instead)</summary>
clusters by coherence.
vendored, forked, or scaffolded.
commits, unpushed branches, scratch dirs, no backup).
</details>
Two inputs shape every run, both stated in plain language:
months"). Defaults to roughly 3 months if unspecified, and says so. Recency is judged by substantive activity (real commits, content of changes), not raw mtimes bumped by a generated file or a formatting-only commit.
projects"), a directory, or a non-home root, and exclude paths to skip ("ignore my work repo"). The exclusion is honored verbatim by every agent.
Examples:
Take stock of my half-finished repos from this week.
Catalog my side projects, but ignore my day-job monorepo.
What's the single most original thing I've built since I started benchie?
Audit /srv on this server and give me the kill list.The written deliverable scales to the ask: a top-3 question gets a short shortlist, "catalog everything" gets the full S–D census with the dormant tail.
[!NOTE] Project Prospector is strictly read-only. It inspects; it never edits, moves, deletes, commits, or starts and stops services. Everything read off disk is treated as untrusted data, not instructions (prompt-injection hardened). If a finding warrants action, that's a separate step you confirm explicitly.
One skill (project-prospector) plus reference agent-prompt templates and a trigger and task eval set. Read-only, general-purpose, no MCP, hooks, or scripts.
It complements total-recall (persistent operator memory) rather than duplicating it: prospector produces a one-shot ranked project census, not a memory profile.
You can also install from a local clone:
git clone https://github.com/88plug/project-prospector
/plugin marketplace add ./project-prospector
/plugin install project-prospector@project-prospectorIssues and pull requests are welcome at 88plug/project-prospector. The plugin-validate workflow checks the plugin manifest and skill structure on every push.
FSL-1.1-ALv2 © 2026 88plug — Functional Source License; converts to Apache 2.0 two years after each release.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.