spinup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited spinup (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Get up to speed on a project without starting any new work. Read persistent memory in priority order, summarise, then stop and wait for user direction.
MEMORY.md directlyAuto-memory lives at ~/.claude/projects/<slug>/memory/ where <slug> is $PWD with every / replaced by - (deterministic — form the path inline, no shell call needed). On the happy path, go straight to Read ~/.claude/projects/<slug>/memory/MEMORY.md. If that read succeeds, you've simultaneously located the dir and loaded the index — skip the rest of this step.
Only fall back to diagnostics if the read fails:
ls ~/.claude/projects/ | grep <project_name_fragment> to find the actual dir; if multiple matches exist, prefer the one with the most recent MEMORY.md.Memory-dir existence under ~/.claude/projects/<slug>/memory/ is the authoritative "has this session been worked on before" signal. AGENTS.md and PROJECT.md in the project root are the secondary "is this project wired up for mindfunnel" signal.
Confirm AGENTS.md and PROJECT.md exist in the project root (real files under the 0.3.0 split model; for projects primed by older versions they may still be symlinks — either works for this check). If either is missing:
/mf:prime from the project root.If the memory dir doesn't exist, is empty, or only contains MEMORY.md with no referenced files, say so and stop. The project is either fresh or the memory was wiped. Invite the user to describe the task — don't fabricate context.
Read these files in order. Stop once you have enough signal to act on the user's current question (or the next action implied by the memory). Budget: 3–6 files typically.
MEMORY.md's descriptions) — almost always second. The canonical "where we are + pending actions" file in the standard auto-memory layout.** — only if project_state.md` points at it or the user's question is about results.If you've read 6 files and still feel you need more, you're over-reading. Stop, summarise what you have, and ask the user where to focus.
For each specific claim you plan to put in the summary:
| Claim type | Verification |
|---|---|
| File path | ls or Read to confirm it exists |
| Function / symbol / flag name | grep for it |
| Git / branch / commit state | git status, git log -1, git branch --show-current |
| Remote-host run results | Do not verify. Flag as "according to memory" |
| User preferences / collaboration style | Trust (not time-sensitive) |
| Closed-hypothesis histories | Trust (not time-sensitive) |
If verification fails, don't cite the claim. If the correction is unambiguous (e.g. file renamed, commit rolled back), update the memory file to reflect current reality. Otherwise flag the drift and ask the user.
Emit a tight summary, ≤ 20 lines, in this shape. Adapt section headings to the project's reality — omit sections with no content rather than padding:
## Where we are
<1–3 sentences: current state, most recent decision, what just happened.>
## Pending / next action
<The one concrete next step: a command to run, a decision to make, or an
experiment waiting for a result. If more than one, list max 3 and flag
which is primary.>
## Open threads
- <thread 1, one line>
- <thread 2, one line>
## Load-bearing reminders
- <feedback memory directly relevant to the current task, one line>Do not start work. Do not propose new experiments. Do not offer unsolicited analysis. Wait for the user to direct.
User says: "Spin up."
Actions:
MEMORY.md directly at the conventional path. It exists — no dir-probing needed.project_state.md — finds current-state + pending action.user_prefs.md and collaboration_style.md — short, read both.MEMORY.md descriptions for feedback entries that look relevant to the pending action; read the one that matches.git status to confirm the branch and working-tree state match what memory says.Result: ~15-line summary, one concrete next action, user responds with "OK, go" or a redirect.
User says: "Catch up."
Actions:
User says: "Spin up — I want to work on the data pipeline."
Actions:
MEMORY.md, project_state.md.MEMORY.md descriptions to find memory files relevant to "data pipeline" specifically. Read those.Symptom: The computed path under ~/.claude/projects/ has no files, but the project has been worked on before.
Cause: The slug transformation differs from Claude Code's internal convention on this host, or the project was worked on from a different CWD.
Solution: Run ls ~/.claude/projects/ | grep <project_name_fragment> to find the actual dir. If multiple matches exist (e.g. the project was opened from both /repos/foo and /repos/foo/src), prefer the one with the most recent MEMORY.md.
Symptom: project_state.md says "see src/old_module.py" but the file isn't there.
Cause: Code moved / was renamed / was deleted since the memory was written.
Solution: Don't cite the dead reference. Either (a) find the replacement with grep and update the memory file to match, or (b) flag the drift in the brief and ask the user to clarify. Don't guess.
Symptom: You've read 10+ files and you're still "gathering context".
Cause: Trying to understand everything before acting, instead of trusting the index.
Solution: Stop reading. MEMORY.md descriptions exist precisely so you don't have to read every file. If the descriptions don't clearly point at what you need, ask the user to scope the spinup.
Symptom: After producing the brief, you immediately propose a next experiment, edit, or command.
Cause: Misreading "the next action is X" in memory as a directive.
Solution: Stop. Emit the brief. Wait for the user to say "go" or to redirect. The memory's "next action" is a report, not a command.
feedback_*.md entrySymptom: You quote a feedback memory that is several sessions old and no longer reflects the user's current stance.
Cause: Treating memory as ground truth without verification.
Solution: When citing feedback, preface with "according to memory: ..." and invite correction if the user's stance has shifted. The user's live feedback always overrides stored memory.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.