leadup-project-kickoff — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited leadup-project-kickoff (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Turn a new idea, spec, PDF, screenshot, or client requirement into a clean, resumable LeadUp project foundation: the project memory files, a recommended stack, a database plan, an MVP roadmap, and a deployment plan — before any feature code is written. Follows the LeadUp loop in references/leadup-workflow.md.
Use when starting something new and there is no existing project memory yet.
Trigger phrases: "start new project", "new SaaS idea", "build new app", "create project", "project kickoff", "new LeadUp project", "spin up a new client site", "scaffold a new app", "begin a new build".
Do not use for an existing repo that already has code/STATUS.md — use leadup-existing-repo-analyzer instead.
notes, or client requirement message. Ask for it if missing.
(deadline, must-use stack, budget).
If the source is thin, ask 3–5 sharp scoping questions before planning.
the one core value flow. Restate it back for confirmation.
and risks. Identify integrations (Razorpay, WhatsApp, Gemini/DeepSeek, SMTP).
to LeadUp norms: Next.js / Node-TS / Postgres / Docker / Coolify; Flutter for mobile; Laravel/Bagisto for ecommerce when it fits.
(shared schema + tenant_id vs schema-per-tenant), key indexes.
billing/admin → polish/launch), each with a definition of done.
*.leadup.in subdomain, env keys needed (names only), rollback note.
references/project-docs-template.mdand this skill's assets/: PROJECT.md, CLAUDE.md, STATUS.md, DEPLOY.md, SECURITY.md, README.md, .env.example (placeholders only).
create a GitHub repo, push, or deploy without approval.
start coding / create repo".
See references/security-rules.md. Most relevant here:
.env.example uses placeholders only (KEY=__SET_ME__); never real values..env with realistic-looking fake keys instead of __SET_ME__.CLAUDE.md, so future sessions lose project context.explicitly; suggest the trigger phrases above.
leadup-existing-repo-analyzer; do not overwrite existing memory files.
assumptions, mark research gaps, recommend revisiting before build.
"verify before integration".
fabricate scope.
to scaffold runnable code, keep it minimal and verify it builds in Docker.
table, multi-tenant DB decision, and a 4-milestone MVP — and write no feature code.
producing the plan (does not fabricate scope).
.env.example contains only __SET_ME__-style placeholders.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.