spinup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited spinup (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Get up to speed on a project without starting any new work. Read persistent memory in priority order, summarise, then stop and wait for user direction.
MEMORY.md's descriptions decide which files bear on the current question; read those and skip the rest.MEMORY.md directlyAuto-memory lives in the directory Claude Code names in its system prompt; use that path. Without one, derive it as /mf:dump Step 1 does: ~/.claude/projects/<slug>/memory/, where <slug> is the repository root ($PWD outside git) with every non-alphanumeric character replaced by -. On the happy path, go straight to Read ~/.claude/projects/<slug>/memory/MEMORY.md. If that read succeeds, you've simultaneously located the dir and loaded the index — skip the rest of this step.
Only fall back to diagnostics if the read fails:
ls ~/.claude/projects/ | grep <project_name_fragment> to find the actual dir; if multiple matches exist, prefer the one with the most recent MEMORY.md.Memory-dir existence under ~/.claude/projects/<slug>/memory/ is the authoritative "has this session been worked on before" signal. AGENTS.md and PROJECT.md in the project root are the secondary "is this project wired up for mindfunnel" signal.
Confirm AGENTS.md and PROJECT.md exist in the project root (a regular file or a symlink both count). If either is missing:
/mf:prime from the project root.If the memory dir doesn't exist, is empty, or only contains MEMORY.md with no referenced files, say so and stop. The project is either fresh or the memory was wiped. Invite the user to describe the task — don't fabricate context.
Read these files in order. Stop once you have enough signal to act on the user's current question (or the next action implied by the memory).
MEMORY.md's descriptions) — almost always second. The canonical "where we are + pending actions" file in the standard auto-memory layout.** — only if project_state.md` points at it or the user's question is about results.If the index doesn't make clear what bears on the question, summarise what you have and ask the user where to focus.
If ledger.jsonl exists in the memory dir, replay it for trust-ranked, provenance-checked assertions. Schema and full semantics: ${CLAUDE_PLUGIN_ROOT}/references/ledger.md.
id is named in a later entry's supersedes, and within each key keep only the newest ts.guaranteed > observed > given > user-inferred > agent-inferred. Treat opinion entries as preferences, not facts. A low-trust (agent-inferred) claim is a hypothesis to re-check, not a settled fact — say so if you cite it.path@<sha>, run git diff --quiet <sha> -- <path> (non-zero exit: the file changed since <sha>, committed or not); if it changed, the entry is possibly-stale. For a plain path that no longer exists, the entry is orphaned. Do not cite a stale or orphaned entry as current — flag it for re-verification in the brief.Budget this like any other read: skip entirely if the ledger is absent or empty; otherwise skim to the entries relevant to the user's question.
If <project root>/.mf/park/*/MANIFEST.md exists, /mf:park saved scratchpads that are still parked: never restored, or restored with --keep. List each (session id, parked date, file count) under Pending / next action, with /mf:unpark as the way back. Report only: restoring is unpark's job.
For each specific claim you plan to put in the summary:
| Claim type | Verification |
|---|---|
| File path | ls or Read to confirm it exists |
| Function / symbol / flag name | grep for it |
| Git / branch / commit state | git status, git log -1, git branch --show-current |
| Remote-host run results | Do not verify. Flag as "according to memory" |
| User preferences / collaboration style | Trust (not time-sensitive) |
| Closed-hypothesis histories | Trust (not time-sensitive) |
Ledger claim with a path@sha source | Re-check the source; stale/orphaned → don't cite (Step 3b) |
If verification fails, don't cite the claim. Flag the drift in the brief with the proposed correction; it is applied on the user's go-ahead or by the next /mf:dump.
Emit a tight summary in this shape. Adapt section headings to the project's reality — omit sections with no content rather than padding:
## Where we are
<1–3 sentences: current state, most recent decision, what just happened.>
## Pending / next action
<The one concrete next step: a command to run, a decision to make, or an
experiment waiting for a result. If more than one, list them and flag
which is primary.>
## Open threads
- <thread 1, one line>
- <thread 2, one line>
## Load-bearing reminders
- <feedback memory directly relevant to the current task, one line>
- <a possibly-stale or low-trust ledger claim needing re-verification, if any>Stop after the brief and wait for direction. The memory's "next action" is something to report, not to start; new experiments and analysis come after the user responds.
User says: "Spin up."
Actions:
MEMORY.md directly at the conventional path. It exists — no dir-probing needed.project_state.md — finds current-state + pending action.user_*.md files — short, read them.MEMORY.md descriptions for feedback entries that look relevant to the pending action; read the one that matches.git status to confirm the branch and working-tree state match what memory says.Result: a short summary, one concrete next action, user responds with "OK, go" or a redirect.
User says: "Catch up."
Actions:
User says: "Spin up — I want to work on the data pipeline."
Actions:
MEMORY.md, project_state.md.MEMORY.md descriptions to find memory files relevant to "data pipeline" specifically. Read those.Symptom: The computed path under ~/.claude/projects/ has no files, but the project has been worked on before.
Cause: An autoMemoryDirectory setting or CLAUDE_CODE_PROJECT_DIR_NAME moved the directory, or the project was worked on from outside its repository.
Solution: Run ls ~/.claude/projects/ | grep <project_name_fragment> to find the actual dir. If multiple matches exist (e.g. a project outside git opened from both /work/foo and /work/foo/src), prefer the one with the most recent MEMORY.md.
Symptom: project_state.md says "see src/old_module.py" but the file isn't there.
Cause: Code moved / was renamed / was deleted since the memory was written.
Solution: Don't cite the dead reference. Find the likely replacement with grep and flag the drift in the brief with the proposed correction, or ask the user to clarify. Don't guess.
feedback_*.md entrySymptom: You quote a feedback memory that is several sessions old and no longer reflects the user's current stance.
Cause: Treating memory as ground truth without verification.
Solution: When citing feedback, preface with "according to memory: ..." and invite correction if the user's stance has shifted. The user's live feedback always overrides stored memory.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.