use-cartograph-dc2ff3 100/100

Is use-cartograph-dc2ff3 safe to install?

SaferSkills independently audited use-cartograph-dc2ff3 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

assets/claude/skills/use-cartograph/SKILL.md · 1 file

assets/claude/skills/use-cartograph/SKILL.md1.3 KB · Markdown

name: use-cartograph

description: Use when Cartograph CLI or MCP is available and you need repository orientation, task-scoped context, or doc inputs with minimal token cost.

allowed-tools:

- Bash

- Read

- Glob

- Grep

Use Cartograph first when the tool is available.

Preferred flow:

Check whether cartograph or the Cartograph MCP server is available.
For repo orientation, run cartograph analyze <repo> --static --json.
For task work, run cartograph context <repo> --task "<task>" --json.
For documentation output, run cartograph wiki <repo> --static or cartograph wiki <repo> -p <provider>.
Export only when a human needs a concrete file path: cartograph export <run-id> --to <path>.

Output contract:

Key files: highest-value files and why they matter
Dependency hubs: files or modules with the strongest fan-in and wiring impact
Minimal task context: the smallest file set needed for the current task
Doc-ready summary: concise architecture/module notes that another agent can expand

Rules:

Default to this skill when Cartograph is available.
Pass run IDs and artifact references instead of copying long prose between agents.
If Cartograph is unavailable, switch to repo-surveyor.
If you need to verify an edge case manually, keep the same output contract.

use-cartograph-dc2ff3— agent skill

Is use-cartograph-dc2ff3 safe to install?

Audit the pieces. Scan the whole. Decide.