user-ryzen-preferences — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited user-ryzen-preferences (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Workflow preferences and communication style for user ryzen (kevinnft GitHub account).
File/Asset Review Pattern: Don't send actual files immediately for review. Create analysis document or issue list first, wait for approval, then create/send files. See references/review-workflow.md for detailed pattern.
Response expectations:
❌ WRONG:
User: "Gas hapus"
Agent: "Are you sure? This will delete X. Type YES to confirm."✅ CORRECT:
User: "Gas hapus"
Agent: [executes immediately]Rule: When user says "gas" or gives explicit instruction, execute immediately. The initial command IS the confirmation.
Only ask for confirmation when:
Format for high-risk confirmation:
Agent: "⚠️ This will permanently delete 13 repos. Type 'GAS HAPUS' to confirm."
User: "Gas hapus"
Agent: [executes]User expectation: "Lo langsung buat token aja, kerjain semuannya sendiri jngn kbanyakan nanya"
Translation: Automate as much as possible. Don't ask for manual steps when automation is feasible.
❌ WRONG:
Agent: "Generate token at this URL, then paste it here"✅ CORRECT:
Agent: "I can't generate the token (requires your GitHub login), but here's the direct link with pre-filled scopes: [URL]"
Agent: "After you generate it, paste here and I'll handle the rest automatically"Preference: Permanent tokens over session-based auth
Pattern:
# Save to bashrc
echo "export GH_TOKEN='TOKEN'" >> ~/.bashrc
# Store in Mnemosyne
mnemosyne_remember(
content="GitHub permanent token: TOKEN (scopes: repo, delete_repo, ...)",
importance=0.9,
source="credential"
)Critical: User has ZERO tolerance for heavy tools on VPS
Preferred tools:
gh) when availablecurl) as fallbackScope awareness:
repo scope ≠ delete_repo scopeDiscovery: delete_repo scope is separate from repo scope
repo tokendelete_repo scope grantUser frustration: "Lo kan udh login github masa gak bisa" — Expected authenticated session to have all permissions
Lesson: Always check scope requirements before GitHub operations. Pre-emptively request all needed scopes.
Scope reference:
repo = read, write, create reposdelete_repo = delete repos (separate permission)admin:org = manage org reposworkflow = manage GitHub Actionsgist = manage gistsRecommended for full access: repo,delete_repo,admin:org,workflow,gist
Token generation workflow:
Discovery: Working Copy requires $19.99 for push to private repos
User frustration: "Bayar anjir working copy untuk push, ngapa lo saranin ini lol"
Lesson: Always present free alternatives FIRST
Anti-pattern: Recommending paid tools without mentioning free alternatives upfront
User preference: Automate bulk operations
Strong signal: "Lo langsung buat token aja, kerjain semuannya sendiri jngn kbanyakan nanya"
Translation: User expects maximum autonomy with minimum questions
Rules:
Pattern:
❌ WRONG:
User: "Setup X"
Agent: "Should I install Y? Should I configure Z? Should I..."
✅ CORRECT:
User: "Setup X"
Agent: [Installs Y, configures Z, creates files, commits, pushes]
Agent: "✅ Done. Installed Y, configured Z, created 5 files, pushed to GitHub."Exception handling:
User request pattern: "Buat repo public dan buat repo menarik tentang X"
Expected deliverables:
Quality bar:
Iteration pattern:
File structure for public repos:
repo/
├── README.md (comprehensive, with emojis/badges)
├── setup.sh (automated installation)
├── LICENSE (MIT preferred)
├── EXAMPLE.md (real-world workflow)
├── CONTRIBUTING.md (contribution guidelines)
├── TROUBLESHOOTING.md (common issues)
├── CHECKLIST.md (verification steps)
└── templates/ (starter files)Commit message style:
User caught missing component: "Woi lu lupa masukin obsidian skill?"
Context: Setup script cloned obsidian-skills from GitHub, but didn't bundle it in repo
Problem: Single point of failure — if external repo unavailable, setup fails
Solution pattern:
Code pattern:
# Try GitHub first (latest version)
if git clone --depth 1 https://github.com/external/tool.git 2>/dev/null; then
echo "✅ Installed from GitHub (latest)"
else
# Fallback: use bundled copy
echo "⚠️ GitHub clone failed, using bundled copy..."
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
cp -r "$SCRIPT_DIR/bundled-tool" "$INSTALL_DIR/"
echo "✅ Installed from bundle"
fiWhen to bundle:
User request: \"Analisa repo ini gunanya apa\" → \"Ya gas kita contribusi skrng\" → \"Langsung gas dan maksimalkan bantu dia jadi terbaik didunia\"
Translation: User wants COMPREHENSIVE, WORLD-CLASS contributions, not minimal PRs
Workflow:
Quality bar:
npx tsc --noEmit) before every pushPR organization:
Commit pattern:
User frustration signals:
Lesson: When user says "maksimalkan" or "bantu dia jadi terbaik", analyze competitors, identify ALL missing features, build world-class solutions with multiple PRs.
User pattern: "Yang rekomend apa dan buat dia makin perfect?" or "Apalagi yang bisa kita kontibusikan biar lebih maksimal"
CRITICAL: User expects gap analysis FIRST before recommendations.
User correction signal: "cek fitur skrng dulu apa semua itu blm ada?"
Translation: Check existing codebase before recommending features. Don't assume features are missing.
Gap analysis workflow:
# Check existing components
ls -la src/components/
find src -name "*.tsx" | grep -E "(StatusBar|QuickOpen|Terminal)"
# Check existing stores
ls -la src/stores/
# Search for feature keywords
grep -r "StatusBar\|QuickOpen\|Debugger" src/
# Check layout components
cat src/components/layout/AppFooter.tsx # Often has status info
cat src/components/layout/RightSidebar.tsx # Check sidebar tabsExpected response format:
## ANALISA FITUR EXISTING
### Yang Sudah Ada:
- ✅ AI Chat Interface
- ✅ Settings Modal (Providers, Agents tabs)
- ✅ Left/Right Sidebar system
### Yang Belum Ada:
- ❌ File Tree
- ❌ Code Editor
- ❌ Terminal
### Verdict:
SEMUA 9 PRs yang gue bikin itu BELUM ADA! ✅Then provide recommendations:
Quality bar:
Example structure:
## TOP 3 RECOMMENDATIONS
### 1. Feature X (PRIORITY #1)
Why: [competitive gap]
Impact: 10/10 — ESSENTIAL
Effort: 4-5 hours
Features: [bullet list]
### 2. Feature Y (PRIORITY #2)
Why: [productivity boost]
Impact: 10/10 — ESSENTIAL
Effort: 3-4 hours
Features: [bullet list]
### 3. Feature Z (PRIORITY #3)
Why: [unique differentiator]
Impact: 10/10 — GAME CHANGER
Effort: 5-6 hours
Features: [bullet list]
## RECOMMENDATION
Mau gue gas ketiga-tiganya sekarang? (12-15 hours total)User approval signal: "Gas maksimalkan" = execute all recommendations immediately
Lesson: Always check existing codebase FIRST before recommending features. User will explicitly ask "cek fitur skrng dulu" if you skip this step.
User pattern: "Gas maksimalkan dan langsung test pastikan lancar" or "Pastikan gak ada eror dan bekerja maksimal"
Expected workflow:
Testing checklist per PR:
npx tsc --noEmit)Final report format:
## FINAL QUALITY ASSURANCE REPORT
| PR | Feature | TypeScript | Rust | Status |
|----|---------|-----------|------|--------|
| #6 | Feature | ✅ PASS | N/A | READY |
| #7 | Feature | ✅ PASS | ✅ | READY |
Quality Score: 10/10
Production Ready: 100%Lesson: "Pastikan lancar" means comprehensive testing with detailed pass/fail report, not just "looks good".
⚠️ ZERO TOLERANCE RULE: Session notes and personal memori MUST ONLY be saved to PRIVATE repo. This rule CANNOT be violated under ANY circumstances.
User correction: "jangan ke repo public, ke repo private dong yg khusus memori" → "pastikan kalo simpan memori ke private jngn ke public ingat itu jngn sampai dilanggar"
Repos:
kevinnft/obsidian-vault — Session notes, personal memori, sensitive data ✅kevinnft/mnemosyne-obsidian — Documentation, setup scripts, templates ONLY ✅Backup workflow:
# ✅ CORRECT: Save to private repo
cd ~/obsidian-vault
mkdir -p "02 Projects/AI Sessions"
# Create session note with date: YYYY-MM-DD-Topic.md
git add .
git commit -m "docs: session summary (PRIVATE)"
git push origin master❌ NEVER DO THIS:
# ❌ WRONG: Save to public repo
cd ~/mnemosyne-obsidian
mkdir -p sessions/
# Create session note ← FORBIDDEN — WILL VIOLATE ZERO TOLERANCE RULEMandatory verification before push:
# ALWAYS check repo privacy before pushing session notes
gh repo view kevinnft/obsidian-vault --json isPrivate
# Expected: {"isPrivate": true} ✅
gh repo view kevinnft/mnemosyne-obsidian --json isPrivate
# Expected: {"isPrivate": false} ✅Rule enforcement:
~/obsidian-vault/02 Projects/AI Sessions/YYYY-MM-DD-Topic.md~/obsidian-vault/ (any directory)~/obsidian-vault/ (any directory)~/mnemosyne-obsidian/ (public repo)~/mnemosyne-obsidian/ (public repo)~/mnemosyne-obsidian/ (public repo)~/mnemosyne-obsidian/ ← FORBIDDEN~/mnemosyne-obsidian/ ← FORBIDDENUser emphasis: "jngn sampai dilanggar" = ZERO TOLERANCE for violations
Consequence: Violating this rule breaks user trust and exposes private data. This is a CRITICAL security preference.
Lesson: Security rules are FIRST-CLASS preferences. When user says "jangan sampai dilanggar", embed in skill with 🔴 CRITICAL marker and zero-tolerance enforcement.
Memory vs Skill distinction:
Enforcement in code:
gh repo view REPO --json isPrivate to checkreferences/github-contribution-mastery.md — Comprehensive GitHub PR workflow from enowX-Coder session (15 PRs, multi-PR strategy, TypeScript error patterns, quality checklist)references/github-pr-workflow-mastery.md — Detailed GitHub PR workflow mastery (phased rollout, verification commands, success metrics)references/ecosystem-skill-installation.md — Hermes ecosystem skill installation workflow (Python venv, Playwright, directory structure, troubleshooting)references/chinese-ip-skills-installation.md — Patent disclosure + software copyright skills installation (venv setup, CNIPA integration, usage patterns, value proposition)references/custom-installer-pattern.md — Smart installer pattern with detection logic (idempotent, auto-detect, comparison table, mnemosyne-obsidian example)Note: For systematic bug fixing workflow (verification, prioritization, testing, release), see the systematic-debugging skill which covers root-cause analysis and fix verification patterns.
Installed skills:
patent-disclosure-skill — Auto-generate Chinese patent disclosure documentssoftware-copyright — Auto-generate Chinese software copyright application materialsInstallation pattern:
Value: ¥5,500-11,000 saved per project (~Rp11-22 juta)
Pattern: Transform documentation repo → smart installer tool
Key improvements:
Example: mnemosyne-obsidian repo → install-custom.sh (6.6KB)
Time saved: 30-60 minutes manual setup → 1 minute automated
User preference: "jngn langsung push ke gituhubnya" — Review visual assets before pushing to GitHub
Pattern: Generate → Review → Approve → Push
Workflow:
Why: Visual assets represent project branding. User must approve design before it goes public.
❌ WRONG:
Agent: [generates HTML]
Agent: [converts to PNG]
Agent: [adds to README]
Agent: [commits and pushes]✅ CORRECT:
Agent: [generates HTML]
Agent: "Files created in assets/. Open in browser to review."
Agent: [sends files via MEDIA:]
User: [reviews in browser]
User: "approve" or "ubah X jadi Y"
Agent: [converts to PNG and pushes] OR [updates and re-sends]Applies to:
Lesson: Visual/branding assets require explicit approval before going public. Don't assume user will like the design.
User correction: "Jngn send file hanya buatkan list yg perlu diperbaiki"
Context: Agent was about to send 6 files via MEDIA: for review. User wanted issues list FIRST, not files.
Pattern: Issues list → Review → Fix → Send files (if needed)
Workflow:
❌ WRONG:
Agent: [analyzes code]
Agent: [sends 6 files via MEDIA:]
Agent: "Review these files!"✅ CORRECT:
Agent: [analyzes code]
Agent: [creates issues list with priorities]
Agent: "Found 7 bugs (3 critical, 2 medium, 2 minor). Want me to fix all?"
User: "Fix all" or "Fix critical only"
Agent: [fixes issues]
Agent: [sends files if requested]Applies to:
Why: User wants to see WHAT needs fixing before seeing HOW it's fixed. Issues list gives context and allows prioritization.
Format for issues list:
## 🔴 Critical Issues (Must Fix)
1. Bug #1 — Description, impact, fix
2. Bug #2 — Description, impact, fix
## 🟡 Medium Issues (Should Fix)
3. Bug #3 — Description, impact, fix
## 🟢 Minor Issues (Nice to Have)
4. Bug #4 — Description, impact, fix
## Recommendation
Fix all 7 bugs? Or critical only?Lesson: When reviewing code/assets, provide issues list FIRST. Let user decide scope before sending files or making changes.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.