setup-analysis-delivery — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited setup-analysis-delivery (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
paths/knowledge-path.md、paths/compliance-path.md、paths/tech-stack-path.md、paths/doc-naming-path.md;可选 decisions.md ADRpaths/*.md 文件存在且非空(legacy 项目根 *-path.md 可接受但产生 warning);knowledge-path.md 至少含 1 个真实路径后才进入下游字段工作context-pointerknowledge-path, compliance-path, tech-stack-path, doc-naming-path/grill-taskgit rev-parse --show-toplevel).git → 提示用户先 git init读项目根文件,推断技术栈:
pom.xml / build.gradle → Java/Maven/Gradlepackage.json → Node/前端pyproject.toml / requirements.txt → Pythongo.mod → Go默认:在项目根的 paths/ 目录下生成 4 个空模板(用户填写后提交到 git)。 这 4 个文件是唯一项目级配置加载输入:
| Canonical 文件 | 作用 | 模板来源 |
|---|---|---|
paths/knowledge-path.md | 列项目涉及的外部知识库(领域表结构、合规法规等)路径 | paths/knowledge-path.md |
paths/compliance-path.md | 列项目适用的合规规则文件路径 + 启用开关 | paths/compliance-path.md |
paths/tech-stack-path.md | 列后端/前端/数据库/中间件 + 团队规范路径 | paths/tech-stack-path.md |
paths/doc-naming-path.md | 文档编号、命名前缀、存放目录 | paths/doc-naming-path.md |
Legacy 兼容:既有 v1.1 项目可能用项目根 *.md(knowledge-path.md 等)。setup-check.py 会把它们识别为 warning 并继续通过。生成时加 --legacy 切换到兼容输出位置(仅 v1.1 旧项目)。
config-used.md 不是配置文件,不参与配置加载,不属于 4 个项目级配置templates/CONFIG_USED.md 复制生成config-used.md 应作为阶段 1 交付产物提交,用于审计和交接python3 scripts/setup-check.py --strict <project> 确认通过(legacy 项目根文件会产生 warning 但仍通过)python3 scripts/field-alignment-check.py --help 确认脚本可用rules/context-pointer — 三层配置加载规则paths/*.md 全部生成在项目根(或兼容的 legacy 项目根 *.md)paths/knowledge-path.md 必须至少 1 个真实路径)config-used.md,已明确标注为配置使用记录 / ADR,而非配置输入setup-check.py --strict <project> 通过(warning 可接受)setup-check.py --strict 必过mode — 必须 mode=gsp / mode=hipaa / mode=none 选一oracle / postgresql / mysql / firestore 等,否则 SQL 方言检查失据config-used.md 写成配置文件 — 实际是 ADR / 配置使用记录,不参与加载,严禁误用paths/*.md 复制到 skill 内 — skill 级是 fallback,项目级才是真实配置,优先级不同~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.