new-project — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited new-project (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Guide the user from a natural-language requirement to a generated, opinionated Java/Spring Boot project.
mcp__trabuco__get_version to confirm the CLI is reachable. If it errors, tell the user to install trabuco (https://github.com/arianlopezc/Trabuco/releases) and stop. Call mcp__trabuco__check_docker — Trabuco needs Docker for Testcontainers. If Docker isn't running, warn but continue (user can start it later).mcp__trabuco__suggest_architecture with the requirements. It returns matched patterns + a recommendedConfig. Present the recommendation with rationale grounded in the returned data — never invent modules that weren't in the response. If confidence is low or the top two patterns score close, surface the ambiguity and ask the user to pick.order-service)com.company.project)claude, cursor, codex, copilot — default all four since the plugin is Claude-focused but the user may pair-tool)mcp__trabuco__init_project with the confirmed parameters. Include skip_build: true on the first pass so the user sees the tree before Maven runs. Report the output directory when done.cd <project> and run mvn clean install to verify buildmvn spring-boot:run -pl AIAgent starts the agent with MCP + A2A surfacestrabuco.auth.enabled is set explicitly to true or false (SecurityConfig#validateAuthDecisionMade enforces this) — a deliberate guardrail so no project ever ships with neither filter chain wired. To turn auth on, set all three: trabuco.auth.enabled=true, OIDC_ISSUER_URI=<your IdP discovery endpoint>, OIDC_AUDIENCE=<your service's API identifier> — the validator requires audience to close the silent-empty-default token-confusion class of bugs. To run locally without an IdP, set trabuco.auth.enabled=false; for AIAgent, that mode also operates on the legacy API-key path. See docs/auth.md in the generated project for per-provider recipes./add-entity, /add-endpoint, /add-test are now available inside the generated project's .claude/skills//audit (in-project) or /trabuco:audit (plugin form, also works) runs the full 173-check security review — orchestrator + 5 domain specialists in parallel, writes .ai/security-audit/findings.md with PASS/FAIL verdict. Trigger before merging a PR that touches a security boundary or as a periodic deep sweep. Per-turn /review covers OWASP basics inline; /audit is the deliberate deep sweep./add-module or direct MCP tool calls)suggest_architecture returned or what list_modules confirms exists.init_project.trabuco://limitations resource before suggesting something that might be out of scope (e.g., GraphQL, gRPC, frontend UI)./trabuco:add-module or /trabuco:extend./trabuco:design-system instead (calls design_system, not init_project).~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.