public-repo-creation — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited public-repo-creation (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Create production-ready public GitHub repositories with comprehensive documentation, automated setup scripts, templates, and quality assurance processes.
README.md (comprehensive):
LICENSE (required):
CONTRIBUTING.md:
TROUBLESHOOTING.md:
CHECKLIST.md (optional but recommended):
setup.sh (or equivalent):
#!/bin/bash)set -e)Critical Patterns:
# Prevent duplicate entries in config files
if ! grep -q "PATTERN" ~/.config 2>/dev/null; then
echo "NEW_LINE" >> ~/.config
else
sed -i "s|OLD_PATTERN|NEW_PATTERN|" ~/.config
fi
# Variable expansion in heredocs
cat > file.txt << EOF # NO quotes for expansion
date: $(date +%Y-%m-%d)
EOF
# Fallback mechanism
if command_from_internet; then
echo "✅ Installed from source"
else
echo "⚠️ Source failed, using bundled copy..."
cp -r bundled/ destination/
fitemplates/ directory:
EXAMPLE.md or examples/ directory:
Pre-commit checks:
# Syntax validation
bash -n setup.sh
# Link validation
grep -o '\[.*\](.*\.md)' *.md | while read link; do
file=$(echo "$link" | sed 's/.*(\\(.*\\))/\\1/')
[ -f "$file" ] && echo "✅ $link" || echo "❌ Broken: $link"
done
# TODO/FIXME check
grep -ri "TODO\|FIXME\|XXX\|HACK" . --include="*.md" --include="*.sh"
# File permissions
ls -la setup.sh # Should be executableAUDIT.md (optional but professional):
bash -n setup.shchmod +x setup.shTotal Time: ~2 hours for production-ready repo
Problem: Appending to config files without checking for duplicates.
Wrong:
echo "export TOKEN='xxx'" >> ~/.bashrc
# Run twice → duplicate entries!Right:
if ! grep -q "export TOKEN=" ~/.bashrc 2>/dev/null; then
echo "export TOKEN='xxx'" >> ~/.bashrc
else
sed -i "s|export TOKEN=.*|export TOKEN='xxx'|" ~/.bashrc
fiProblem: Using single-quoted heredoc prevents variable expansion.
Wrong:
cat > file.txt << 'EOF'
date: $(date +%Y-%m-%d)
EOF
# Output: date: $(date +%Y-%m-%d) ← LITERAL!Right:
cat > file.txt << EOF # No quotes!
date: $(date +%Y-%m-%d)
EOF
# Output: date: 2026-05-12 ← EXPANDED!Problem: Hardcoding paths that may vary across systems.
Consider:
$HOME instead of /home/username$(dirname "${BASH_SOURCE[0]}") for script directoryProblem: Single point of failure (e.g., GitHub clone only).
Solution:
if git clone https://github.com/repo.git 2>/dev/null; then
echo "✅ Cloned from GitHub"
else
echo "⚠️ GitHub failed, using bundled copy..."
cp -r bundled/ destination/
fiProblem: Missing critical sections in README.
Must-have sections:
Problem: Pushing without validation.
Always check:
bash -n setup.shProblem: Misunderstanding "260 kata" (words) vs "260 karakter" (characters).
Context: Indonesian "kata" = word, "karakter" = character.
Check:
# Word count
wc -w post.txt
# Character count (excluding newlines)
cat post.txt | tr -d '\n' | wc -cLimits:
Always clarify with user: "260 words or 260 characters?"
Problem: Referencing files that don't exist.
Check:
grep -o '\[.*\](.*\.md)' README.md | while read link; do
file=$(echo "$link" | sed 's/.*(\\(.*\\))/\\1/')
[ -f "$file" ] || echo "❌ Broken: $link"
doneWhen creating repos with multiple components (e.g., "Tool A + Tool B + Feature C"):
grep -h "^#.*Tool.*Feature" README.md EXAMPLE.md CONTRIBUTING.md setup.shWhen including third-party code (e.g., skills, libraries):
read -sp for sensitive input (no echo)*.secret.md, *.private.mdrepo only)Good UX:
Bad UX:
Scoring Categories (10 points each):
| Category | 7/10 (Good) | 10/10 (Perfect) |
|---|---|---|
| Documentation | README + basic docs | README + CHANGELOG + FAQ + 10+ docs |
| Installers | Working setup script | Multiple installers + smart detection |
| Templates | Basic templates | Complete template set |
| CI/CD | None | GitHub Actions + automated tests |
| Examples | Basic examples | Screenshots + demos + videos |
| Badges | License only | CI + License + Version + Stars + Forks |
| Changelog | None | Semantic versioning + release notes |
| Releases | None | Tagged releases + GitHub releases |
| Issue Templates | None | Bug report + feature request + PR template |
| Tests | None | Comprehensive test suite + passing CI |
Total Score Calculation:
Minimum requirements:
Additional requirements for 10/10:
#### 1. CI/CD (GitHub Actions)
# .github/workflows/ci.yml
name: github-public-repo-creation
on: [push, pull_request]
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Validate syntax
run: bash -n setup.sh
- name: Run tests
run: ./tests/test-suite.sh#### 2. Comprehensive Test Suite
# tests/test-suite.sh
#!/bin/bash
set -e
echo "🧪 Running tests..."
# Test 1: Syntax validation
bash -n setup.sh && echo "✅ Syntax OK"
# Test 2: File existence
test -f README.md && echo "✅ README exists"
test -f CHANGELOG.md && echo "✅ CHANGELOG exists"
# Test 3: Documentation completeness
grep -q "Quick Start" README.md && echo "✅ Has Quick Start"
grep -q "FAQ" README.md && echo "✅ Has FAQ"
# Test 4: Installer detection (if applicable)
# ... custom tests ...
echo "✅ ALL TESTS PASSED!"#### 3. Issue Templates
Bug Report (.github/ISSUE_TEMPLATE/bug_report.md):
---
name: Bug report
about: Create a report to help us improve
---
## Bug Description
Clear description of the bug.
## To Reproduce
Steps to reproduce.
## Expected Behavior
What you expected.
## Environment
- OS: [e.g. Ubuntu 24.04]
- Version: [e.g. 1.0.0]Feature Request (.github/ISSUE_TEMPLATE/feature_request.md):
---
name: Feature request
about: Suggest an idea
---
## Feature Description
Clear description of the feature.
## Motivation
Why is this needed?
## Proposed Solution
How should it work?#### 4. PR Template
`.github/pull_request_template.md`:
## Description
Brief description of changes.
## Type of Change
- [ ] Bug fix
- [ ] New feature
- [ ] Documentation update
## Checklist
- [ ] Code follows style guidelines
- [ ] Self-review completed
- [ ] Documentation updated
- [ ] Tests pass#### 5. CHANGELOG.md
Format: Keep a Changelog
# Changelog
## [1.1.0] - 2026-05-12
### Added
- New feature X
- Improvement Y
### Fixed
- Bug Z
## [1.0.0] - 2026-05-11
### Added
- Initial release#### 6. GitHub Releases
# Create release
git tag -a v1.1.0 -m "Version 1.1.0"
git push origin v1.1.0
gh release create v1.1.0 --title "v1.1.0 - Feature Name" --notes "Release notes here"#### 7. Badges
[](https://github.com/user/repo/actions)
[](https://opensource.org/licenses/MIT)
[](https://github.com/user/repo/releases)
[](https://github.com/user/repo/stargazers)
[](https://github.com/user/repo/network/members)#### 8. FAQ Section
Add to README.md:
## ❓ FAQ
### Q: Common question 1?
**A:** Answer with details.
### Q: Common question 2?
**A:** Answer with details.
... (10+ questions)Time: 1.5-2 hours
#### Phase 1: CHANGELOG + Release (15 min)
git tag -a v1.0.0 -m "Initial release"gh release create v1.0.0#### Phase 2: Badges + FAQ (20 min)
#### Phase 3: CI/CD + Tests (40 min)
.github/workflows/ci.ymltests/test-suite.sh with 6+ tests#### Phase 4: Issue Templates (15 min)
#### Phase 5: Verification (10 min)
# 1. Check file count
find . -type f ! -path './.git/*' | wc -l
# 2. Check repo size
du -sh . --exclude=.git
# 3. Run tests
./tests/test-suite.sh
# 4. Check CI status
gh run list --limit 1
# 5. Verify badges
curl -s https://github.com/user/repo | grep -o 'img.shields.io' | wc -l
# 6. Count documentation
ls -1 *.md | wc -l
# 7. Verify release
gh release list
# 8. Check templates
ls -1 .github/ISSUE_TEMPLATE/ .github/pull_request_template.mdFor 10/10 Perfect Score:
User Preference (from session):
repo-name/
├── README.md # Comprehensive guide (10KB+)
├── setup.sh # Automated setup (executable)
├── LICENSE # MIT or other
├── CONTRIBUTING.md # Contribution guidelines
├── TROUBLESHOOTING.md # Common issues + fixes
├── CHECKLIST.md # Verification steps
├── EXAMPLE.md # Real-world use case
├── AUDIT.md # Quality audit (optional)
├── templates/
│ ├── getting-started.md
│ ├── config-template.yml
│ └── gitignore
├── examples/ # Additional examples (optional)
│ └── advanced-usage.md
└── bundled-deps/ # Bundled dependencies (if any)
└── third-party-lib/bash -n setup.sh)chmod +x setup.sh)github-pr-workflow — For contributing to existing reposcomprehensive-public-repo-setup — Alternative approach (may overlap)github-repo-management — For managing existing repos~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.