Is standup-summary safe to install?

SaferSkills independently audited standup-summary (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

priv/skills/standup-summary/SKILL.md · 1 file

priv/skills/standup-summary/SKILL.md1.9 KB · Markdown

name: standup-summary

description: "Summarize work completed over a time period using git commits + CK session data. Trigger: 'what did I get done', 'standup', 'weekly summary', 'status update'."

when_to_use: "Activate ONLY when the user asks for a work summary over a time range. Do NOT auto-trigger during coding or review tasks."

argument-hint: "[time period: yesterday, last 3 days, last week]"

disable-model-invocation: true

license: Apache-2.0

compatibility:

- opencode-native

- claude-standalone

- cursor-native

- codex

metadata:

author: controlkeel

version: "1.1"

category: reporting

ck_mcp_tools: [ck_session_digest, ck_engineer_mirror, ck_memory_search]

related_skills: [proof-memory]

Standup Summary

Summarize work over a time period. Enriches git log with CK session data for richer context than git alone.

Do NOT use when

During coding, review, or planning tasks
The user wants code changes (not a summary)

Workflow

Resolve time window from user input. Default: yesterday.
Read git commits by current user in range:

   git log --author="$(git config user.email)" --since="<start>" --until="<end>" --no-merges --format="%h %s"

Enrich with CK data:

ck_session_digest (mode: generate) for session tasks, findings, budget
ck_engineer_mirror for daily reflection and approval patterns
ck_memory_search for active decisions in the time window

Synthesize: prioritize substantial changes, omit cosmetic-only.
Output format:

   ## Standup: <start> – <end>
   <one sentence summary>
   ### Shipped
   - <2-5 bullets, major changes only>
   ### In progress / Blocked
   - <if any>

Guardrails

Every bullet traces to a commit or CK record — no fabrication
Do not infer intent — describe changes functionally
If no activity in range, say so clearly

Output

Concise status update with real date range
2-5 major bullets for substantial changes

standup-summary— agent skill

Is standup-summary safe to install?

Standup Summary

Do NOT use when

Workflow

Guardrails

Output

Audit the pieces. Scan the whole. Decide.