leadup-super-prompt-builder — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited leadup-super-prompt-builder (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Convert a rough idea, one-liner, broken-English instruction, client requirement, or a vague "do recommended" into a complete, structured, copy-paste-ready prompt for the right AI agent (Claude Code, opencode, RuFlo, ChatGPT, or similar) — already loaded with LeadUp context, the build→test→ deploy loop, and the safety rules.
Use when the user wants a prompt produced, not the task itself done.
Trigger phrases: "make super prompt", "convert to prompt", "improve my prompt", "prompt this properly", "make master prompt", "turn this idea into prompt", "write prompt for Claude Code", "write prompt for RuFlo", "write prompt for opencode", "make this instruction better", "rewrite this as a proper prompt".
If the user actually wants the work done (build it, analyse it, research it), route to the matching skill instead: leadup-project-kickoff, leadup-existing-repo-analyzer, leadup-api-research-builder, leadup-deploy-checker, etc. This skill only produces the prompt.
not given — default Claude Code for build/fix, RuFlo for research/plan).
Ask at most 3 clarifying questions, and only if the intent is genuinely ambiguous (the user dislikes excessive questioning — infer sensibly).
references/prompt-frameworks.md (coreskeleton + agent variant).
references/leadup-prompt-templates.md or thematching file in assets/, injecting LeadUp context: stack, Docker → GitHub leadupofficial → Coolify → *.leadup.in, STATUS.md loop.
Docker, no push/deploy without approval, no secrets / __SET_ME__ only, premium international UI, update STATUS.md, definition of done.
tests) after the block.
Prompt type: <type> · Target: <agent>.ready to paste — no explanation interleaved.
Core skeleton (always): Role → Context → Source → Task → Constraints → Definition of done → Output expectation. Agent variants: Claude Code/ opencode (agentic, approval gates, small steps), RuFlo (research/plan/ memory, plan before build), ChatGPT/generic (more explicit pasted context). Full detail and the quality checklist are in references/prompt-frameworks.md.
Supported prompt types (each maps to a template):
Reusable templates: references/leadup-prompt-templates.md. Concrete fill-in assets: assets/claude-code-prompt.template.md, assets/ruflo-prompt.template.md, assets/api-research-prompt.template.md, assets/new-project-prompt.template.md.
See references/security-rules.md. Most relevant here:
.env values into agenerated prompt — use names / __SET_ME__ placeholders only.
without approval, and never print secrets or real .env values.
unknowns as [fill in].
should have been a research/plan prompt).
fire — re-invoke; suggest the trigger phrases.
matching leadup-* skill (kickoff / analyzer / api-research / deploy / …).
[fill in]placeholders and state the assumptions made.
agent to capture failures, not disable checks, and log them in STATUS.md.
single copy-paste block: a Claude Code prompt with role/context/task, LeadUp stack, and the premium-UI + no-secrets + test-in-Docker + ask-before-deploy + update-STATUS constraints.
output a RuFlo project-intelligence prompt of type "GitHub repo research" with license/stars/recency criteria and the LeadUp stack-fit constraint.
clause included where UI is involved.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.