Is config-audit-checklist safe to install?

SaferSkills independently audited config-audit-checklist (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/config-audit-checklist/SKILL.md · 1 file

skills/config-audit-checklist/SKILL.md1.9 KB · Markdown

name: config-audit-checklist

description: "Audit a project for config drift before a backtest or deploy - compare the documented config snapshot against .env and README defaults, flag mismatches, and check the snapshot last-verified date. Use for config audit, params drift, pre-deploy checklist, or production config check."

Config Audit Checklist

Use this skill before validating or deploying a project whose behavior depends on documented parameters. It forces the user to reconcile the live environment, the snapshot document, and README defaults before trusting results.

When to invoke

User says: "config audit" / "params drift" / "pre-deploy checklist" / "production config check"
Code in the conversation uses: .env, README defaults, or a config snapshot document.

When NOT to invoke

The project has no config snapshot document yet; recommend creating one first.
The project has no externally configurable parameters.

Concrete example

User input:

Audit this strategy config before I run the validation job.

Output:

Auditing strategy config...
  ENTRY_COOLDOWN_HOURS:  README=12   .env=6    CONFIG.md=8     warn: 3-way drift
  STOP_LOSS_PCT:         README=-10  .env=-10  CONFIG.md=-10   ok
  CONFIG.md "Last verified": 2026-03-01 (89 days ago)         warn: stale (>30d)
Verdict: DO NOT backtest against README defaults. Reconcile the live config first.

Pattern to apply

Find the config snapshot document, usually PRODUCTION_CONFIG.md or CONFIG.md.
Read the last verified date and flag stale snapshots.
Extract values from the snapshot, .env, and README defaults.
Report mismatches row by row and name the source of truth.
Refuse to proceed with validation until drift is reconciled.

Reference: assets/checklist.md.

Source

Distilled from production use across the author's automation projects. v0.1.0. See also: [[walk-forward-runner]].

config-audit-checklist— agent skill

Is config-audit-checklist safe to install?

Config Audit Checklist

When to invoke

When NOT to invoke

Concrete example

Pattern to apply

Source

Audit the pieces. Scan the whole. Decide.