create-project — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited create-project (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A repeatable scaffold for spinning up a new project in a WorkOS-style workspace. Run this when the user wants to add a new area of work and have it integrated into the routing correctly the first time.
Three things, and only three things:
CLAUDE.md and MEMORY.md following the standard structure.CLAUDE.md if it lives inside a domain) so future sessions auto-load it.That's it. No automated content migration, no inferred workflows, no pre-populated rules. Just the scaffold the user can grow.
Find the WorkOS root dynamically. Look for a CLAUDE.md in the mounted workspace folder that has a "Routing Map" section. That's the root.
Then determine where the new project should live:
CLAUDE.md), the project will be created inside that domain.clients/), confirm the group folder exists and the project will live at <domain>/<group>/<project>/.Ask the user explicitly if the placement is ambiguous. Don't guess.
If you can't find a workspace root, stop and tell the user. Don't invent a structure.
Ask the user three questions, one at a time. Don't ask all three in one breath — it's easier to think clearly one at a time.
If any answer is vague, propose a sharpened version and confirm before proceeding.
Create:
[Project Name]/CLAUDE.mdWith these sections in this exact order:
[path to root voice file, typically ~/workOS/MEMORY.md or resources/voice-principles.md]." Then add any project-specific rules the user named in Step 2 or Step 3. If none, leave the section with the voice-principles line only.[Project Name]/MEMORY.mdWith this structure:
# [Project Name] MemoryARCHIVE.md (or root ARCHIVE.md if the project is closed out entirely)."If the project lives at the workspace root, open the root CLAUDE.md and find the Routing Map section.
If the project lives inside a domain, open <domain>/CLAUDE.md and find its Routing Map section. (Create the Routing Map section in the domain CLAUDE.md if it doesn't exist yet — this is the first project being added there.)
Add a row using the path that's correct for the scope (relative to the file you're editing):
| `[Project Path]/` | [routing condition from Step 2] |Match existing style — don't change table column headers or structure.
Show the user:
CLAUDE.md it landed in.resources/ folder when one exists, or write your first workflow step the next time you work in this area."If anything was ambiguous during creation, surface that and ask the user to clarify before declaring done.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.