init-workspace-context-d4f874 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited init-workspace-context-d4f874 (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<init_workspace_context>
<role> Workspace initialization classifier — fast, precise, zero-waste. </role>
<when_to_use_skill> Initialization must behave differently for fresh, existing, or plugin workspaces. Misclassifying the mode overwrites config, skips setup, or duplicates work. First skill in the init flow — runs before all others. Also generates or updates gain.json with SDLC tooling configuration collected from the user. </when_to_use_skill>
<core_concepts>
bootstrap_rosetta_files), upgrade (some files per bootstrap_rosetta_files exist), plugin (LLM context already contains "RUNNING AS A PLUGIN")gain.json is the single source of truth for SDLC tooling; it wins in conflicts with other files</core_concepts>
<process>
bootstrap_rosetta_fileslarge-workspace-handling skillbootstrap_rosetta_filesgain.json — follow the gain_json_generation section below</process>
<gain_json_generation>
versions.rosetta — read from Rosetta plugin path in current LLM context, e.g. "2.0.43"; versions is for GAIN suite tools only (rosetta, specflow, etc.), not the projectgain.json already exists: read it, ask only about gaps and placeholders; never overwrite confirmed valuesgain_json_draft (template with auto-detected values filled in, all other fields left as template placeholders) to orchestrator; instruct orchestrator to ask user to fill in each placeholder field, and leave any unanswered fields exactly as the placeholder in the template</gain_json_generation>
<templates>
{
"description": "[PROJECT_DESCRIPTION - one sentence: what this project/product is and does]",
"servicesDescription": {
"[SERVICE_NAME]": "[SERVICE_DESCRIPTION - what this service does]"
},
"codingAgents": [
"[CODING_AGENTS - e.g. cursor, claude-code, codex, copilot]"
],
"sdlc": {
"issue_tracker": "[ISSUE_TRACKER - e.g. Jira, GitHub Issues, Linear]",
"issue_tracker_project": "[ISSUE_TRACKER_URL - e.g. https://myorg.atlassian.net/jira/...]",
"wiki": "[WIKI - e.g. Confluence, Notion, GitHub Wiki]",
"wiki_project": "[WIKI_URL - e.g. https://myorg.atlassian.net/wiki/...]",
"test_management": "[TEST_MANAGEMENT - e.g. TestRail, Zephyr; omit if not used]",
"test_management_project": "[TEST_MANAGEMENT_PROJECT - project key or URL]",
"scm": "[SCM - e.g. GitHub, GitLab, Bitbucket]",
"scm_project": "[SCM_URL - e.g. https://github.com/org/repo]",
"build_management": "[BUILD_MANAGEMENT - e.g. GitHub Actions, Jenkins, CircleCI]",
"build_management_project": "[BUILD_MANAGEMENT_URL - e.g. https://github.com/org/repo/actions]",
"ux": "[UX_TOOL - e.g. Figma, Sketch; omit if not applicable]",
"ux_project": "[UX_PROJECT - project name or URL]",
"infrastructure": "[INFRASTRUCTURE - e.g. Kubernetes, ECS, serverless]",
"infrastructure_project": "[INFRASTRUCTURE_PROJECT - project name or cluster name]",
"iac": "[IAC_TOOL - e.g. Terraform, Pulumi, CDK; omit if not applicable]",
"iac_project": "[IAC_PROJECT - project or workspace name]",
"hosting": "[HOSTING - e.g. AWS, GCP, Azure, on-prem]",
"hosting_project": "[HOSTING_PROJECT - project or account name]",
"monitoring": "[MONITORING - e.g. Prometheus, Datadog, New Relic]",
"monitoring_project": "[MONITORING_PROJECT - dashboard URL or project name]",
"logging": "[LOGGING - e.g. Grafana, Splunk, ELK]",
"logging_project": "[LOGGING_PROJECT - dashboard URL or project name]",
"security": "[SECURITY_TOOL - e.g. Vault, AWS Secrets Manager; omit if not applicable]",
"security_project": "[SECURITY_PROJECT - project or namespace]",
"collaboration_project": "[COLLABORATION_PROJECT - team or community name]",
"unit_tests": "[UNIT_TESTS_LOCATION - e.g. in-repository, separate repo]",
"integration_tests": "[INTEGRATION_TESTS_LOCATION - e.g. in-repository]",
"e2e_tests": "[E2E_TESTS_LOCATION - e.g. in-repository, separate repo]",
"performance_tests": "[PERFORMANCE_TESTS_LOCATION - omit if none]",
"testing_harness": "[TESTING_HARNESS - main test entry point or script name; omit if standard]",
"code_graph": "[CODE_GRAPH_TOOL - e.g. GitNexus, CodeScene; omit if not used]"
},
"vocabulary": {
"[TERM]": "[DEFINITION - domain-specific term AI should know; add more entries as needed]"
},
"versions": {
"rosetta": "[ROSETTA_VERSION]"
}
}</templates>
</init_workspace_context>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.