apw-onboard — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited apw-onboard (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill to build and maintain a durable codebase orientation — the architecture map, entry points, build/test/run commands, and conventions a session needs to act competently — and to get oriented from it in a fresh session. It exists to fight one specific limitation: a model re-derives its understanding of the codebase every session, spending its opening context re-reading the same files and re-inferring the same structure, and sometimes guessing wrong. The fix is to write that orientation down once, where every future session already has it.
The orientation lives in `AGENTS.md` — the always-on instructions file every session reads automatically — so the map is reused across sessions for free, with no separate file to remember to open. Because AGENTS.md is injected into every session, a stale orientation is misinformation everywhere; keeping it true is therefore part of the discipline, not an afterthought.
This skill is user-invoked only — the agent must never reach for it on its own. Invoking it is a deliberate act, so the invocation is the authorization: the skill writes the orientation to `AGENTS.md` directly and the user reviews the result in the file (the diff), rather than approving wording in the chat first. This differs from apw-learn, which shares the file but proposes-then-confirms — there, the agent may self-invoke, so a chat gate is needed; here the user already chose to run it.
apw-learn and apw-onboard both write to AGENTS.md but own different things: apw-learn records prescriptive rules (do X, never Y); apw-onboard maintains a single descriptive orientation section (how the codebase is laid out, built, and run). Keep each in its own section — do not let the orientation accumulate rules, or the rules accumulate architecture notes.
The skill has two modes — build (survey and write/refresh the orientation) and orient (read it and verify against reality before trusting it). Determine the mode first, then follow that mode's steps strictly and in order.
AGENTS.md.State which mode you are in before continuing. If asked to orient but AGENTS.md has no orientation section, say so plainly and switch to Build — do not invent an orientation from a single pass and present it as established.
Gather the orientation a competent session needs, drawing on the real repository — not memory or assumption:
Favour stable, slow-changing facts. Deliberately exclude volatile detail that rots between sessions — specific line numbers, current work-in-progress, exhaustive file-by-file listings — because a wrong orientation loaded into every session is worse than none. Prefer primary sources: read the config and the code, and run the build/test commands to confirm they work, rather than trusting a README that may itself be stale.
Draft the Codebase Orientation section using .claude/skills/apw-onboard/ORIENTATION_TEMPLATE.md as the structure. Keep it tight — this text is injected into every session, so every line must earn its place; prune anything a session can cheaply rediscover. Record a freshness marker at the top of the section: the date and the short commit SHA it was validated against (git rev-parse --short HEAD), so a future reader knows how stale it might be.
Look for AGENTS.md in the repository root before writing:
Write the section to AGENTS.md directly — do not stage it in the chat first:
## Codebase Orientation); create the file if it doesn't exist.apw-learn's rules; if a prescriptive rule has crept into the orientation, leave it for apw-learn instead.One or two lines: that AGENTS.md was created or updated, which section was written, and the validated SHA. Point the user at the file (or the diff) to review — that is where review happens. Don't restate the contents.
Read the Codebase Orientation section of AGENTS.md, including its freshness marker — note the date and validated SHA so you know how old it is before you lean on it.
The orientation records what was true when it was written; the repository may have moved since. Before relying on it, check it against the current repo:
git diff --stat <validated-SHA>..HEAD and git log --oneline <validated-SHA>..HEAD to see what changed since it was validated, and concentrate verification on the parts the orientation describes.Where reality disagrees with the orientation, reality wins. Note each drift explicitly — it changes what you can trust.
If the orientation is materially stale, switch to Build mode for the parts that drifted: write the correction to AGENTS.md directly — fixing the wrong lines and updating the freshness marker — for the user to review in the file. A small, accurate orientation kept current is the whole point; one nobody trusts because it's wrong is worse than none.
Continue the actual task with a verified understanding, relying on the orientation only where Step O2 confirmed it still holds — and through whichever skill the task itself calls for (apw-implement, apw-find-root-cause, …).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.