leadup-existing-repo-analyzer — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited leadup-existing-repo-analyzer (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Pick up an existing LeadUp project cold and produce an accurate picture of where it is: stack, how to run/test it, what's done, what's broken, what's missing, and the single best next task. Restores project memory so work can resume without re-discovery.
Use on a repo that already has code. Trigger phrases: "analyze this repo", "what is left", "what still needs doing", "continue this project", "check existing project", "where did we leave off", "resume this build", "audit the codebase state".
Not for brand-new ideas with no code → use leadup-project-kickoff. Not for only rewriting STATUS.md after a task → use leadup-status-updater.
.env values — names only).node_modules, .git, build dirs).package.json, pubspec.yaml,composer.json, requirements.txt, Dockerfile, docker-compose.yml, framework configs (Next.js, Bagisto, Supabase).
CLAUDE.md, STATUS.md, DEPLOY.md,PROJECT.md, SECURITY.md, CHANGELOG.md, TODO.md.
+ Docker). State the exact command to run locally.
FIXME markers, failing or absent tests, missing memory files.
STATUS.md (hand to leadup-status-updater or do it inline if asked).
See references/security-rules.md. Most relevant here:
when it's Bagisto/Laravel).
.env to "understand config" — use .env.example and key names.the trigger phrases.
leadup-project-kickoff.
manifest dump and paste it (no secrets).
freshness checks as deferred.
leadup-status-updater / leadup-project-kickoff assets.
(deps / env / code), and put it in Bugs & blockers — do not "fix by disabling" tests or checks.
commands and a state summary consistent with STATUS.md.
"Missing files" and recommends creating them.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.