go-bootstrap — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited go-bootstrap (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You scaffold a complete Go project from scratch following hexagonal architecture, ready for feature development with the full skill/agent pipeline.
Ask the user:
github.com/org/service)server, identity, billing)Read patterns.md for the full project structure and all code patterns. Use each section as a template when creating the corresponding file.
For each pattern below, read the corresponding section in patterns.md and adapt to the user's answers:
domainerror.New(code, message) in domain/errors/type ProjectID string with UUID in domain/types/domain/services/<entity>/ (inbound ports)domain/repositories/<entity>/ (outbound ports)pkg/<context>/events/*app.AppSetup() + ListenAndServe*slog.Logger dependencywriteErrorJSON() for structured JSON errorsGET /health returning {"status":"ok"}TestMain with testcontainers boilerplate.go-arch-lint.yml enforcing hexagonal layer dependencies.claude/skills/doc-project/SKILL.md (minimal table of contents with the first context) and .claude/skills/doc-project/conventions.md (patterns established during bootstrap). Context docs in .claude/skills/doc-project/contexts/ are created by go-finish as features arrive.Key principles:
domain/services/, not *app.Appmain.go has zero business logic — E2E tests call Setup() directlyCopy all 17 agent files to .claude/agents/:
go-brainstorm.md — Problem exploration (approach validation, scope check)go-pm.md — Product manager (spec interrogation, aggregate identification)go-architect.md — Architecture design (TASKS.md generation)go-api-designer.md — HTTP API design (routes, types, validation)go-scaffolder.md — Scaffolding (stubs, interfaces, mocks, skipped tests)go-test-writer.md — Red phase TDD (failing tests)go-dev.md — Green phase TDD (implementation + observability)go-reviewer.md — Review (architecture, security, data, performance, compatibility)go-migrator.md — Data migrations (backfill, transform, split)go-fixer.md — Circuit breaker recovery (fresh-perspective fixes)go-debugger.md — Systematic root cause investigation (escalation from fixer)go-runner.md — Task execution (dispatch, validate, report)go-finish.md — Feature closure (verification, acceptance criteria, integration)go-refactor.md — Safe refactoring (document, lock, rewrite)go-product-manager.md — Product decomposition (spec → ordered features → sequential execution)go-retrospective.md — Feedback analysis (interactive questionnaire, skill improvement proposals)go-bootstrap.md — This fileAfter bootstrapping:
go build ./... — passesgo test -race ./... -short — health check test passesdocker-compose up -d — infrastructure startscurl localhost:<port>/health — returns {"status":"ok"}.claude/agents/ has 17 agent filesgo-arch-lint check — zero violations (architectural boundaries enforced)make lint-pipeline — all skills and agents referenced in the pipeline existdomain/services/ directory exists (inbound port interfaces)domain/repositories/ directory exists (outbound port interfaces)pkg/<context>/events/ directory exists (event contracts).claude/skills/doc-project/SKILL.md exists (project map skeleton)Tell the user: "Project is ready. Describe your first feature and I'll plan and implement it using the full skill pipeline."
The go-pm skill takes over from here for feature development.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.