comprehensive-public-repo-setup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited comprehensive-public-repo-setup (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Pattern for creating production-ready public repositories that others can clone and use immediately.
Creating a public repo that needs:
repo-name/
├── README.md (10-15KB, comprehensive)
├── setup.sh (automated installation)
├── LICENSE (MIT recommended)
├── CONTRIBUTING.md
├── TROUBLESHOOTING.md (20+ solutions)
├── CHECKLIST.md (20+ verification steps)
├── EXAMPLE.md (real-world workflow)
├── templates/
│ ├── template1.md
│ └── template2.md
└── bundled-dependencies/ (if applicable)
└── external-tool/Essential sections (in order):
Example template:
# 🧠 Project Name
**One-line description highlighting key benefits.**
[](LICENSE)
## 🎯 What is This?
Brief overview (2-3 sentences).
## ✨ Features
- ⚡ **Feature 1** — description
- 🧠 **Feature 2** — description
## 🚀 Quick Start
\`\`\`bash
git clone https://github.com/user/repo.git
cd repo
./setup.sh
\`\`\`
## 📖 Manual Setup
Step-by-step instructions...Structure:
#!/bin/bash
set -e # Exit on error
# Header
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo "🎯 Project Setup"
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo ""
# 1. Check prerequisites
echo "🔍 Checking prerequisites..."
if ! command -v tool &> /dev/null; then
echo "❌ Tool not found. Installing..."
# Install command
fi
echo "✅ Prerequisites OK"
echo ""
# 2. Get user input (interactive)
echo "📋 Configuration:"
read -p "Username: " USERNAME
read -sp "Token: " TOKEN
echo ""
echo ""
# 3. Install dependencies with fallback
echo "📦 Installing dependencies..."
if git clone --depth 1 https://github.com/external/dep.git 2>/dev/null; then
echo "✅ Installed from GitHub (latest)"
else
echo "⚠️ GitHub clone failed, using bundled copy..."
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
cp -r "$SCRIPT_DIR/bundled-dep" "$INSTALL_DIR/"
echo "✅ Installed from bundle"
fi
echo ""
# 4. Configure
echo "⚙️ Configuring..."
# Configuration steps
echo "✅ Configuration complete"
echo ""
# 5. Summary
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo "✅ SETUP COMPLETE!"
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo ""
echo "📊 Summary:"
echo " • Component 1: ✅"
echo " • Component 2: ✅"
echo ""
echo "🎯 Next Steps:"
echo " 1. Step one"
echo " 2. Step two"
echo ""Key principles:
set -e (exit on error)Problem: External repos can disappear, change, or be rate-limited.
Solution: Bundle critical dependencies with GitHub fallback.
Pattern:
# Try GitHub first (latest version)
if git clone --depth 1 https://github.com/external/tool.git 2>/dev/null; then
echo "✅ Installed from GitHub (latest)"
else
# Fallback: use bundled copy
echo "⚠️ GitHub clone failed, using bundled copy..."
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
cp -r "$SCRIPT_DIR/bundled-tool" "$INSTALL_DIR/"
echo "✅ Installed from bundle"
fiWhen to bundle:
When NOT to bundle:
Sections:
Format:
### **"Error message"**
**Problem:** Brief description.
**Solution:**
\`\`\`bash
# Fix command
\`\`\`Aim for 20-30 solutions covering common issues.
Structure:
Format:
### **1. Component Installed**
\`\`\`bash
command --version
# Expected: version x.y.z
\`\`\`
- [ ] Command works
- [ ] Version displayedAim for 20-30 total verification steps.
Initial commit:
git add .
git commit -m "Initial commit: README, setup script, examples, license"
git push origin mainSubsequent commits:
Good commit messages:
Problem: Setup script clones from GitHub, but external repo is deleted/unavailable.
Solution: Bundle critical dependencies in repo with fallback logic.
Real example: User caught missing bundled dependency: "Woi lu lupa masukin obsidian skill?"
Problem: Script asks for confirmation at every step, slowing down installation.
User feedback: "Lo langsung buat token aja, kerjain semuannya sendiri jngn kbanyakan nanya"
Solution:
--yes flags where applicableProblem: README doesn't cover edge cases, troubleshooting, or verification.
Solution: Include:
Problem: Setup depends on external service being available.
Solution:
Problem: User doesn't know if installation succeeded.
Solution:
Problem: Appending token to ~/.bashrc without checking if it already exists → multiple runs create duplicates.
Bad:
echo "export GH_TOKEN='$GITHUB_TOKEN'" >> ~/.bashrc
# Run setup.sh 10x → 10 duplicate tokens!Good:
# Only add if not already present
if ! grep -q "export GH_TOKEN=" ~/.bashrc 2>/dev/null; then
echo "export GH_TOKEN='$GITHUB_TOKEN'" >> ~/.bashrc
echo "✅ Token saved to ~/.bashrc"
else
# Update existing token
sed -i "s|export GH_TOKEN=.*|export GH_TOKEN='$GITHUB_TOKEN'|" ~/.bashrc
echo "✅ Token updated in ~/.bashrc"
fiReal impact: Found in mnemosyne-obsidian repo (commit 9cfbf55).
Problem: Single-quoted heredoc (<< 'EOF') prevents variable expansion.
Bad:
cat > file.md << 'EOF'
date: $(date +%Y-%m-%d)
EOF
# Output: date: $(date +%Y-%m-%d) ← LITERAL STRING!Good:
cat > file.md << EOF # Remove quotes!
date: $(date +%Y-%m-%d)
EOF
# Output: date: 2026-05-12 ← ACTUAL DATE!Note: Escape backticks in content: ` \command\ `
Real impact: Found in mnemosyne-obsidian repo (commit 9cfbf55).
Repo: https://github.com/kevinnft/mnemosyne-obsidian
Structure:
Key features:
./setup.sh)Installation flow:
git clone https://github.com/kevinnft/mnemosyne-obsidian.git
cd mnemosyne-obsidian
./setup.sh
# Enter username + token
# Wait 5 minutes
# Done!Before pushing to GitHub:
CRITICAL: Social media platforms use CHARACTER limits, not word limits.
Common mistake: "260 kata" (260 words) vs "260 karakter" (260 characters)
Platform limits:
Verification:
# Count characters (excluding newlines)
cat post.txt | tr -d '\n' | wc -cFormat (under 260 chars):
🧠 [Hook: problem + solution]
[Key feature 1]
[Key feature 2]
[Key feature 3]
Built on @mention1 by @mention2
[Repo URL]
#Tag1 #Tag2Example (258 chars):
🧠 AI memory: 500x faster recall + rich notes + auto backup
Mnemosyne + Obsidian + GitHub = best of all worlds
✅ 1-cmd setup
✅ Works offline
✅ MIT license
Built on @nousresearch Hermes by @teknium
https://github.com/user/repo
#AI #ObsidianStructure (5 threads):
Each thread: 1-2 paragraphs, code blocks where helpful, end with hashtags.
Files to create:
SOCIAL_POST_SHORT.md — Main post (under 260 chars)COMMENT_THREAD_EN.md — English explanation (5 threads)COMMENT_THREAD.md — Indonesian version (if applicable)Communication style:
Workflow preferences:
Red flags:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.