bootstrap-project-3f73bb — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited bootstrap-project-3f73bb (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Project-agnostic, global skill. It runs the whole new-repo setup workflow in one pass, chaining the focused tools the user already has into a single guided sequence. It is a thin orchestrator: it owns the order and the hand-offs, and delegates the real work to each step's existing skill. It never duplicates their logic.
The sequence: /init (root docs) -> /where-claude (nested CLAUDE.md placement) -> /setup-permissions (scoped allowlist) -> propose-automation (skills/agents/hooks) -> /setup-ci (GitHub Actions pipeline, optional) -> /obsidian-vault (knowledge base, optional) -> seed durable memories.
sequences them and carries context forward. If a step's skill is missing, say so and offer to do that step's essence inline rather than silently skipping.
before moving on. The user can skip any step. Never run the whole chain unattended.
CLAUDE.md,existing .claude/settings*.json permissions, existing .claude/skills) and offer to skip or update rather than redo. Safe to run on a partially-set-up repo.
override that by pushing the user to accept everything.
submodules/monorepos - ask which package/submodule to bootstrap if ambiguous).
CLAUDE.md, .claude/settings.json /settings.local.json permissions, .claude/skills, .claude/agents. Summarize what already exists so the run adapts instead of redoing it.
Explore agent./initCLAUDE.md, run /init to create one. If one exists, offer to review/updateit instead of regenerating. Pause for approval.
/where-claudewhere-claude skill to get the ranked list of subdirectories worth their ownCLAUDE.md. Present it; for each one the user approves, run /init in that directory. (where-claude reports only; the user//init create the files.) Pause for approval.
/setup-permissionssetup-permissions skill to scan the stack and propose narrowly-scopedpermission rules for per-rule authorization, writing approved rules to the chosen settings file (default .claude/settings.local.json). Pause for approval.
propose-automationpropose-automation skill to propose a short ranked plan of project skills,agents, and hooks, and scaffold only what the user approves. Pause for approval.
/setup-ci (optional)setup-ci skill to scan the stack and propose a GitHub Actions CI setupwith separate jobs per concern. Present the proposed jobs; scaffold only what the user approves.
from day one"), but do not push if the user declines. Skip if the repo is not on GitHub or if gh is unavailable.
/obsidian-vault (optional)architecture, ADRs, execution plans, and session logs. Present the vault layout before creating anything; scaffold only after explicit approval.
knowledge base anchored to this repo." Skip without ceremony if the user declines.
project): the repo'spurpose/goal, key constraints, and any conventions surfaced during setup. Keep it to a few genuinely durable facts; do not record what the code or CLAUDE.md already states.
MEMORY.md with one-line pointers, per the memory format.restart is needed before new /commands autocomplete.
the user to accept them. A "no" is a complete and valid answer.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.