intelligence-update — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited intelligence-update (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are the intelligent driver of an update. The bash engine is deterministic and fail-closed — it never guesses; on any state it cannot resolve it prints IS_STATUS=<code> and stops. Your job: discover the engine, understand what is changing (read the CHANGELOG across the version gap), run the migration chain, branch on the status, and verify afterward. Ask the user only when genuinely ambiguous.
Trigger: the user says something like "update / migrate intelligence-sync". They never run shell commands by hand — you do.
config.yaml (intelligence/,Intelligence/, …). Never assume the name — find it.
the umbrella whose scripts/sync.sh and scripts/VERSION both exist (conventionally sync/, but never assume the folder name).
sync_version in config.yaml (a permanent top-level scalar; absent ⇒ pre-0.3.1). Engine version is <module>/scripts/VERSION. The gap between them is the set of breaking changes to apply.
<umbrella>/scripts/ and nosync_version key. Their frozen update.sh fails closed against the modular upstream (changes nothing) — you bootstrap the first hop.
intelligence- skill prefix is reserved for upstream meta-skills.Find the dir containing config.yaml → <umbrella>. Then find the engine by role: search <umbrella> (one level deep) for a directory <M> with both <M>/scripts/sync.sh and <M>/scripts/VERSION.
scripts/VERSION.<umbrella>/scripts/ even if present (that's stale legacy).
<umbrella>/scripts/ (or nothing) → this is apre-0.3.1 / un-bootstrapped project; go to step 2's bootstrap.
config.yaml at all → not bootstrapped; point the user at upstreamINIT.md and stop.
Clone upstream into a temp dir (default https://github.com/ainova-systems/intelligence-sync, or the user's REPO_URL/fork). The upstream module is always intelligence/sync/.
git clone --depth=1 <repo> <tmp>Make no changes to the project before step 3's confirmation. In particular do not copy anything into <umbrella>/sync yet — that would modify (and could downgrade) an already-modular project even if the user then declines. The temp clone is only for reading the CHANGELOG and as the source for the eventual write.
Determine the project's current version = the sync_version value in config.yaml, or 0.0.0 if the key is absent (pre-0.3.1). The engine version = <tmp>/intelligence/sync/scripts/VERSION.
Read <tmp>/CHANGELOG.md. For every release in the range `current < release <= engine` (inclusive of the target release — its entry holds the destination's breaking post-conditions), read its entry. Pay special attention to any `### Breaking` subsection (the machine-distinguishable marker). Build a short list of breaking items, new migrations, and anything to verify afterward. Surface it to the user; without --yes, let them confirm before any write.
update.sh — at the discovered module dir, whatever its name. update.sh re-clones upstream internally, shows the diff, and is authoritative; do not hand-copy over the module.
the module from the temp clone, and only after confirmation:
mkdir -p <umbrella>/sync
cp -r <tmp>/intelligence/sync/. <umbrella>/sync/then run <umbrella>/sync/scripts/update.sh.
Run the update.sh of the engine determined in 3a — the discovered module dir for a modular project (whatever its name), or the just-created <umbrella>/sync for the legacy bootstrap path:
bash <engine-module>/scripts/update.sh --yes # omit --yes to confirm the diffCapture stdout; find the last IS_STATUS=<code> [IS_DETAIL=...] line.
IS_STATUS| Code | Meaning | Action |
|---|---|---|
ok | Already current | Go to step 6. |
migrated | Migration chain applied | Go to step 6; note the relocation/changes. |
aborted-incomplete | Staged module incomplete; legacy intact (safe) | Re-run step 2–4 once (clone hiccup). Persists → show output, stop, don't hand-fix. |
ahead-of-engine | Project schema newer than this engine | Do not downgrade. Point REPO_URL at the correct/newer upstream, or accept it's already ahead. Stop. |
needs-update | Pending breaking changes (sync refused) | Expected pre-migration; proceed — update.sh is the migrator. If it persists after update, investigate. |
config-missing | No config.yaml | Not bootstrapped — direct user to <umbrella>/sync/INIT.md. Stop. |
error | Engine couldn't proceed | Show message; check REPO_URL. Stop. |
| (no status) | Engine crashed before contract | Show full output; don't modify the tree. Stop. |
On any failure code, first re-read the upstream CHANGELOG.md entries for current < release <= engine (esp. ### Breaking) — the breaking change usually explains the error and what the user must do — before retrying or escalating.
Genuinely ambiguous tree (e.g. both a legacy flat <umbrella>/scripts/ and a populated module, no clear sync_version): inspect both, summarize the difference, ask the user which is authoritative, apply their choice. Never guess.
ok/migrated)Structural — always:
intelligence-* directory directly under <umbrella>/skills/(meta-skills live only in the module's skills/).
<umbrella>/{rules,agents}/ and anynon-intelligence- skills untouched.
config.yaml has sync_version equal to the enginescripts/VERSION, and sources.skills includes the module skills path exactly once.
Changelog-driven — per release crossed:
post-condition actually holds (e.g. a removed/renamed file is gone, a config-schema change is reflected). If a breaking item has no verifiable post-condition, state that you could not auto-verify it.
Then regenerate IDE outputs:
bash <umbrella>/sync/scripts/sync.shRelay any model-drift report. Finally summarize: versions before→after, the breaking changes applied, verification result, anything the user must act on. Clean up the temp clone.
no-op (IS_STATUS=ok).
on the version stamp — a missing/wrong sync_version cannot cause a needed migration to be skipped; it only weakens the ahead-of-engine guard until re-stamped.
config.yaml beyond what the engine does (the idempotentsources.skills line and the sync_version key). Never move/delete project skills, rules, or agents.
the discovered engine module.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.