grovs-setup-project — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited grovs-setup-project (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Instance (instance_id = hash_id string)
├── Production project (project_id = production.hash_id string)
│ └── links, campaigns, redirects, analytics
└── Test project (project_id = test.hash_id string)
└── links, campaigns, redirects, analyticscreate_project creates all of this in one call.
get_status — check for existing instances first. If a matching one exists, confirm with the user before creating a duplicate.create_project — returns instance.hash_id + production.hash_id + test.hash_id. Save all three.configure_sdk with the instance_id — platform identity (bundle ID, package name, etc.)configure_redirects with the production project_id — where users land (App Store URL, fallback website). Skip if user didn't provide URLs.`configure_sdk` takes instance_id. `configure_redirects` takes project_id. These are different strings. Mixing them up will fail silently or error.
Only what's not already in the conversation:
bundle_id + team_id. Android needs package_name + sha256_fingerprints.User: "Set up Grovs for my app Foodies, it's iOS only, bundle is com.foodies.app, team ID is ABC123"
1. get_status() → no existing instances
2. create_project(name: "Foodies") → instance_id: "x7k2", prod_id: "p_m9f", test_id: "t_q3r"
3. configure_sdk(instance_id: "x7k2", ios_bundle_id: "com.foodies.app", ios_team_id: "ABC123")
4. → Done. No redirects needed since user didn't provide URLs.Present the production project_id (p_m9f) — the user will need it for every other tool.
get_usage takes an instance_id and returns current MAU count, MAU limit, quota status, and subscription status. Use it when:
get_status shows a usage warning (quota exceeded) — get_usage gives the full pictureIf the quota is exceeded and there's no subscription, deep links stop working. Tell the user to subscribe.
create_project errors with "name taken" → the instance already exists. Run get_status and use the existing one.configure_sdk errors → most likely you passed project_id instead of instance_id. Check.Every Grovs tool returns human-readable formatted text (tables, summaries). Don't reformat — just present the response and add your own context around it.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.