cto-advisor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited cto-advisor (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Technical leadership frameworks for startup CTOs. Balance engineering excellence with business reality. Simple > clever. Boring technology wins.
CTO, chief technology officer, architecture, tech stack, build vs buy, tech debt, team scaling, system design, microservices, monolith, database, API design, scaling, DevOps, CI/CD, engineering hiring, infrastructure, security, code quality, SRE, incident response, performance, reliability
Architecture decision process:
Monolith vs Microservices decision tree:
Database selection:
| Need | Recommendation |
|---|---|
| General purpose, relational data | PostgreSQL |
| Document store, flexible schema | MongoDB |
| High-speed caching | Redis |
| Full-text search | Elasticsearch / Meilisearch |
| Time-series data | TimescaleDB / InfluxDB |
| Graph relationships | Neo4j |
| Simple key-value at scale | DynamoDB |
| Analytics/OLAP | ClickHouse / BigQuery |
The default stack for startups:
Evaluation criteria:
| Factor | Weight | Questions |
|---|---|---|
| Team capability | 30% | Can the team build and maintain this? |
| Hiring pool | 20% | Can we hire for this technology? |
| Maturity | 15% | Is this battle-tested or bleeding edge? |
| Performance | 15% | Does it meet our scale requirements? |
| Cost | 10% | Total cost of ownership? |
| Lock-in risk | 10% | How hard is it to switch later? |
The "boring technology" rule: Choose technology that's proven, well-documented, and has a large community. Save your innovation tokens for your product, not your infrastructure.
Decision framework:
| Factor | Build | Buy |
|---|---|---|
| Core to your product? | Build if core differentiator | Buy if commodity |
| Team expertise? | Build if you have the skills | Buy if it's outside your domain |
| Time to market? | Build if no time pressure | Buy if speed matters |
| Customization needs? | Build if highly custom | Buy if standard works |
| Long-term cost? | Build if high volume makes it cheaper | Buy if low volume |
| Maintenance burden? | Build only if you can maintain it | Buy to offload maintenance |
Rule of thumb: If it's not your core product and someone else does it well, buy it. Your engineering time is your most expensive resource.
Tech debt categories:
Tech debt prioritization matrix:
| Impact | High Frequency | Low Frequency |
|---|---|---|
| High Impact | Fix NOW | Fix this quarter |
| Low Impact | Fix when touching that code | Probably never |
The 20% rule: Allocate 20% of engineering capacity to tech debt reduction. Non-negotiable. It compounds.
Engineering team structure (by stage):
| Stage | Team Size | Structure |
|---|---|---|
| Pre-seed | 1-3 | Everyone does everything |
| Seed | 3-8 | Full-stack generalists + 1 specialist |
| Series A | 8-20 | 2-3 squads, tech lead per squad |
| Series B | 20-50 | Engineering manager layer, platform team |
| Growth | 50+ | Multiple orgs, principal engineers, architects |
Hiring priorities by stage:
Engineering culture essentials:
Security by stage:
| Stage | Must Have | Nice to Have |
|---|---|---|
| Pre-seed | HTTPS, auth, input validation | Pen test |
| Seed | + secrets management, RBAC, backups | SOC 2 prep |
| Series A | + SOC 2, dependency scanning, incident response | Bug bounty |
| Series B+ | + SIEM, WAF, security team | ISO 27001 |
| Category | Metric | Target | Frequency |
|---|---|---|---|
| Velocity | Deployment frequency | Daily+ | Weekly |
| Velocity | Lead time for changes | <1 day | Weekly |
| Quality | Change failure rate | <5% | Weekly |
| Quality | Mean time to recovery | <1 hour | Per incident |
| Health | Tech debt ratio | <20% of sprint | Monthly |
| Health | Test coverage | >80% critical paths | Monthly |
| Team | Engineering satisfaction | >7/10 | Quarterly |
| Cost | Infrastructure cost / ARR | <15% | Monthly |
references/architecture.md — System design patterns, ADRs, scaling strategiesreferences/tech-debt.md — Tech debt categorization, prioritization, reduction strategiesreferences/team-scaling.md — Hiring, team structure, engineering culturereferences/stack-selection.md — Technology evaluation frameworks, default stacks~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.