kastell-scaffold — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited kastell-scaffold (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 2 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Generate boilerplate files for new Kastell components. Each template follows the post-P63/P64 architecture: commands are thin wrappers, business logic lives in core/, providers handle cloud API, adapters abstract platform ops.
/kastell:scaffold command server-migrate # creates command + core + test files
/kastell:scaffold check filesystem-perms # creates audit check + catalog update
/kastell:scaffold provider ovhcloud # creates provider + registry entry + test
/kastell:scaffold mcp-tool server_migrate # creates MCP tool + registration + test$ARGUMENTS[0] is the component type. $ARGUMENTS[1] is the component name.
These rules apply in every generated file. The forked subagent does not automatically have kastell-ops context — enforce these rules explicitly.
| Layer | Path | Rule |
|---|---|---|
| Commands | src/commands/ | Parse args + delegate. ZERO business logic. |
| Core | src/core/ | ALL business logic. No chalk/ora/UI imports. |
| Providers | src/providers/ | Cloud API per provider. Extends BaseProvider. |
| Adapters | src/adapters/ | Platform ops via PlatformAdapter. Access via getAdapter(). |
| MCP | src/mcp/tools/ | Zod schema + handler. Delegates to core. |
Critical: Never import CoolifyAdapter or DokployAdapter directly. Always use getAdapter(platform) from src/adapters/factory.ts.
ESM: "type": "module" — use import, not require. All imports use .js extension.
Commands: !node -e "import('fs').then(f=>console.log(f.readdirSync('src/commands').filter(x=>x.endsWith('.ts')).map(x=>x.replace('.ts','')).join(', '))).catch(()=>console.log('commands dir not found'))" Providers: !node -e "import('fs').then(f=>console.log(f.readdirSync('src/providers').filter(x=>x.endsWith('.ts')&&x!=='base.ts').map(x=>x.replace('.ts','')).join(', '))).catch(()=>console.log('providers dir not found'))" MCP tools: !node -e "import('fs').then(f=>console.log(f.readdirSync('src/mcp/tools').filter(x=>x.endsWith('.ts')).map(x=>x.replace('.ts','')).join(', '))).catch(()=>console.log('mcp/tools dir not found'))" Audit categories: !node -e "import('fs').then(f=>console.log(f.readdirSync('src/core/audit',{withFileTypes:true}).filter(d=>d.isDirectory()).map(d=>d.name).join(', '))).catch(()=>console.log('audit dir not found'))"
Run the scaffold script to generate boilerplate files:
bash scripts/scaffold.sh $ARGUMENTS[0] $ARGUMENTS[1]The script reads .tpl templates from templates/, replaces __NAME__/__NAME_PASCAL__/__NAME_CAMEL__/__NAME_UPPER__ placeholders, and creates files in the project. Add --dry-run to preview without writing.
Files generated per type:
command → 3 files: src/commands/, src/core/, src/__tests__/core/check → 2 files: src/core/audit/checks/, src/__tests__/core/audit/checks/provider → 2 files: src/providers/, src/__tests__/providers/mcp-tool → 2 files: src/mcp/tools/, src/__tests__/mcp/After running the script, read the matching reference for registration details:
| Type | Reference File |
|---|---|
command | references/template-command.md |
check | references/template-audit-check.md |
provider | references/template-provider.md |
mcp-tool | references/template-mcp-tool.md |
Perform these steps after creating the boilerplate files:
src/index.tsregisterTool() in src/mcp/server.tsPROVIDER_REGISTRY in src/constants.tssrc/core/audit/catalog.tsnpm run build && npm test && npm run lintYeni skill veya agent oluşturulurken aşağıdaki koşullar ZORUNLU:
effort + allowed-tools ekle (minimum zorunlu)disable-model-invocation: true eklemaxTurns belirle, memory scope tanımla~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.