Is extend safe to install?

SaferSkills independently audited extend (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

plugin/skills/extend/SKILL.md · 1 file

plugin/skills/extend/SKILL.md2.5 KB · Markdown

name: extend

description: Propose what to add next to an existing Trabuco project based on its current state and what the user wants to achieve. Different from /trabuco:add-module — that adds a specific module; this one ADVISES on what to add. Use when the user has a project and asks "what's next?" or "how would you extend this?"

user-invocable: true

allowed-tools: [mcp__trabuco__get_project_info, mcp__trabuco__suggest_architecture, mcp__trabuco__list_modules]

argument-hint: "[goal description]"

Advise on extending an existing Trabuco project

Flow

Load context:

mcp__trabuco__get_project_info for the current project
If ambiguous, use Read/Glob/Grep on the project root (pom.xml, */pom.xml, source layout) to fill in missing details
Read trabuco://modules resource to know the full catalog

Load expertise: request the extend_project MCP prompt (argument: project path). This loads Trabuco's extension philosophy — the reasoning framework the advice should follow.

Understand the goal: if the user's argument is vague, ask specifically what they want to enable. "Make it faster" is too vague; "handle 10k concurrent requests" is actionable.

Match against patterns: call mcp__trabuco__suggest_architecture with the extended requirements (current + goal). Compare the recommended config against what's currently installed. The delta is the extension proposal.

Present as a plan, not a wall of text: for each proposed addition, say:

What (specific module or pattern)
Why (how it addresses the goal)
Trade-off (what complexity it adds)
Effort (rough)

Offer to execute: if the user approves, delegate to /trabuco:add-module for each addition. If the proposal involves creating new entities/endpoints/events, mention that the project's own .claude/skills/ already has /add-entity, /add-endpoint, etc. for the implementation work.

Rules

Don't over-prescribe. If the current project already does what the user wants and the bottleneck is elsewhere, say that. "You don't need to change the architecture — you need to fix the query in FooRepository.findAll()" is a valid answer.
Respect limitations. Read trabuco://limitations before proposing something Trabuco can't help with (e.g., adding GraphQL, adding a React frontend).
Prefer conservative additions. Adding a module is cheap to propose but expensive to maintain. Default to "fewer modules, clearer boundaries."

extend— agent skill

Is extend safe to install?

Advise on extending an existing Trabuco project

Flow

Rules

Audit the pieces. Scan the whole. Decide.