init-workspace — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited init-workspace (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Turn an empty or existing repo into one that works with the agentic workflow: copy the generic scaffold, then tailor it to this project instead of leaving raw placeholders.
(CLAUDE.md + docs/ map + templates) adapted to the project, not just copied.
npx degit gtrabanco/agentic-workflow/template when youwant the gate commands, architecture, and doc domains filled in by interview.
Inspect the target dir ([target-dir], default cwd) before touching anything:
CLAUDE.md / AGENTS.md / docs/ / .github/? If so, **do notclobber** — ask whether to merge, adapt in place, or abort.
package.json, pyproject.toml, go.mod,Cargo.toml, Gemfile, …) to propose gate commands and naming conventions.
URL → forge**: github.com → GitHub/gh, gitlab → GitLab/glab, else ask).
files already exist, get an explicit decision before overwriting.
npx degit gtrabanco/agentic-workflow/template <dir>(into the target if empty, else a temp dir to merge from). `degit` can't read a private repo — it fails, or in `--mode=git` silently leaves an empty dir; for a private source, `git clone` via SSH and copy the `template/` subtree instead.
drawn from Step 0; skip whatever discovery already answers:
from the detected stack; confirm).
→ recorded in the Workflow conventions Forge line.
(stay architecture-agnostic; record the user's choice in ARCHITECTURE.md).
infrastructure/ legal/ frontend/ apply. **Delete the folders that don't** (e.g. frontend/` for a non-UI project).
CLAUDE.md placeholders (commands,the documentation map rows, architecture); keep AGENTS.md, the features/_TEMPLATE + ROADMAP, the fix/_TEMPLATE + README, and the .github/ templates; prune unused doc folders and map rows. Leave honest placeholders where the user hasn't decided — never invent values.
npx skills add gtrabanco/agentic-workflow (note the SSH/local-path variant if the source is private). Don't install without a yes.
internally — only the ones the detected platform needs (from Step 0 + the doc domains chosen in step 3):
code-review, security-review, verify, tech-debt.design-review, accessibility-review,brand-review.
web-perf and an SEO skill.project. Record the expected set in CLAUDE.md (a short "Companion review skills" note) so review-change and product-audit know what to compose — and so a missing one is a noted gap rather than a silent skip. Don't install without a yes.
the companion skills recorded/installed, and the next step: plan-feature → execute-phase.
don't work on its default branch and never commit/push unless asked.
npx degit gtrabanco/agentic-workflow/template — the static copy this skilladapts. Use that when you want the raw scaffold and will fill it yourself.
docs/workflow/PORTABLE_PROMPT.md — regenerates the skills adapted to aproject (behavior). This skill adapts the substrate (docs). Complementary.
plan-feature →execute-phase; run audit-docs to confirm the scaffold is coherent.
CLAUDE.md + docs/ scaffold + .github/ templates exist in thetarget, unused folders pruned, residual placeholders flagged, the platform's companion review skills are recorded (and offered).
plan-feature → execute-phase, plus the offer toinstall the skills).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.