establishing-project-context — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited establishing-project-context (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 2 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Maintain a CONTEXT.md file at the project root that defines the project's domain language — a single source of truth for terminology shared between the agent and the human. Borrowed from Domain-Driven Design's "ubiquitous language" principle.
CONTEXT.md is about the user's project domain, NOT about Aegis governance. For Aegis governance docs, see docs/current/ and docs/adr/.
<project_root>/CONTEXT.md<project_root>/CONTEXT-MAP.md maps context names to their locations: ordering → src/ordering/CONTEXT.md
billing → src/billing/CONTEXT.mdSystem-wide terms still go in root CONTEXT.md.
Create files lazily — only when you have something to write.
On first entering a project:
CONTEXT.md (or CONTEXT-MAP.md) existsDuring brainstorming / planning / debugging:
See CONTEXT-FORMAT.md in this directory for the canonical template.
Key rules:
CONTEXT.md and docs/aegis/baseline/ serve different purposes:
| CONTEXT.md | baseline/ | |
|---|---|---|
| What | Domain language, ubiquitous terminology | Technical architecture snapshot |
| Audience | Domain experts + agents | Agents + developers |
| Content | Terms, definitions, resolved ambiguities | Ownership, contracts, dependencies, anti-patterns |
| Updates | Immediately on term resolution | After architecture review or material change |
| Trigger | establishing-project-context skill | brainstorming, writing-plans, code-review, systematic-debugging |
Do NOT put implementation details in CONTEXT.md. Do NOT put domain glossary terms in baseline/.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.