propose-automation-5fa09a — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited propose-automation-5fa09a (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Project-agnostic, global skill. It scans the current repo, infers how work actually flows through it, and proposes a SHORT, ranked, high-ROI plan of skills, agents, and hooks tailored to it - then scaffolds only what the user approves. Bias to restraint: a few high-confidence proposals beat a long list.
It pairs with /init: /init documents a repo (CLAUDE.md); this proposes the automation layer on top, and should read CLAUDE.md/README first to ground itself.
(/name); runs in the main thread with project knowledge.
search). Usually spawned inside a skill as a step, not as the top-level interface. Only define a custom agent (.claude/agents/) when you need a named, reusable role with a restricted toolset.
formatting) via settings.json or a git hook. Prefer a hook over a skill when no judgment is needed and it must not be forgotten.
./.claude/...) when coupled to this repo's conventions/paths;travels and is versioned with the repo. This is the default.
~/.claude/...) only when genuinely project-agnostic.references the repo's single sources of truth (CLAUDE.md, README, config, style guides). It must not duplicate them, or the two copies drift.
build + ongoing maintenance + cognitive overhead. Propose only when value clearly beats cost. Something run a couple of times is not worth a skill.
skills are maintenance.
integrity/firewall constraints in CLAUDE.md). Never fabricate repo facts.
CLAUDE.md (root and nested), README*, and any existing .claude/skillsand .claude/agents (so you do not duplicate what exists).
package.json,pyproject.toml, Makefile/justfile, CI workflows, lint/format config, etc.
git log to see what kinds of changes happenand how often (frequency feeds the ROI model).
Explore (orgeneral-purpose) agent and work from its summary, to keep your context clean.
Static analysis cannot see habits, and the highest-ROI automation comes from what the user does repeatedly and dislikes. Ask 2-3 targeted questions, e.g.:
Treat your scan-based ideas as hypotheses to confirm, not conclusions.
Present a SHORT ranked list - aim for the 2-4 highest-ROI items. For each:
Then a "Deferred / not worth it (yet)" section naming what you intentionally left out and why. Building nothing in this step is correct.
For each approved item:
.claude/skills/<name>/SKILL.md,.claude/agents/<name>.md, or a hook (settings.json entry and/or a git hook plus a small script).
guardrails identified in step 3.
report/output firewalls).
needed before the new /command autocompletes.
Offer to save the full ranked plan (including the deferred items) to a file in the repo (e.g. AUTOMATION-PLAN.md) so the deferred ideas are not lost.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.