grovs-configure-platform — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited grovs-configure-platform (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
| Tool | ID type | Purpose |
|---|---|---|
configure_sdk | instance_id (string) | Platform identity: bundle IDs, team IDs, package names, fingerprints |
configure_redirects | project_id (string) | Where users land: App Store URL, Play Store URL, fallback website |
These are different strings. Both come from `get_status`. Passing the wrong one is the #1 mistake.
Call get_status and show the user what's currently configured before making changes. Prevents accidental overwrites.
Pass "https://apps.apple.com/app/id123456" — not symbolic names like "app_store". The schema validates with z.url().
iOS Universal Links require both:
ios_bundle_id (e.g., com.company.app)ios_team_id (Apple Developer Team ID)Missing either → deep links won't open the app on iOS. ios_app_store_id is optional (only for App Store redirects).
Android App Links require both:
android_package_name (e.g., com.company.app)android_sha256_fingerprints (array of strings from keytool -list -v or Play Console)Missing either → deep links won't open the app on Android.
Only send fields the user wants to change. Omitted fields stay unchanged.
User: "Add Android support, package is com.foodies.android, here's the fingerprint: AB:CD:EF:..."
configure_sdk(
instance_id: "x7k2",
android_package_name: "com.foodies.android",
android_sha256_fingerprints: ["AB:CD:EF:..."]
)Don't resend the iOS fields — they stay as-is.
configure_sdk → most likely you passed a project_id instead of instance_idconfigure_redirects → check you passed a valid URL (not a bare domain like "example.com", must be "https://example.com")custom_redirects on create_link/update_link, not these toolsEvery Grovs tool returns human-readable formatted text. Don't reformat — just present and add context.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.