exact-clone-intake — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited exact-clone-intake (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Treat requests like 그대로 가져와줘, 완전 똑같이, same, exact, as-is, and clone this as source-first clone requests.
Do not use this skill for generic URL summarization, data scraping, localhost debugging, original page design, package maintenance, or requests to bypass auth, paywalls, captcha, ownership, or license boundaries.
This skill is paired with the source-first-clone MCP server. It is meant for general AI coding workflows, not a single framework. The important behavior is: inspect first, capture evidence, reuse when allowed, rebuild only when needed, and verify the output instead of trusting prompt-only generation.
clone_reference_url when you want the full URL-to-clone workflow in one passdetect_runtime_capabilities when session-aware capture might be neededinspect_urldiscover_embed_candidatestrace_runtime_sources when static HTML is not enoughclassify_clone_modecapture_reference_bundle when exact reuse is unclear or blockedbuild_rebuild_scaffold when exact reuse is blocked and you need bounded reconstruction artifactsbuild_reproduction_bundle after capture when you need an exact reuse output packageplan_reproduction_pathgenerate_embed_snippet only when an actual embed path existsverify_fidelity_report when comparing a reproduced resulttrace_runtime_sources is especially useful for pages that hide the real scene URL behind client-side rendering. Use user_data_dir or storage_state_path when authentication matters.capture_reference_bundle persists DOM, runtime HTML, screenshots, computed styles, CSS analysis, assets, network metadata, interaction states, traces, accessibility data, and optional storage state.build_rebuild_scaffold is for frame-blocked or source-blocked references. Use it to output reusable frontend reconstruction artifacts plus a layout summary instead of pretending prompt-only output is exact.clone_reference_url is the fastest path when the user has pasted a link and wants the full source-first clone pipeline executed immediately.plan_reproduction_path is useful when the policy decision is clear but the build sequence is not.generate_embed_snippet is for fast HTML or component integration once the exact source URL is known.verify_fidelity_report should be used honestly: it is bounded to persisted artifacts and does not claim pixel-perfect equivalence.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.