cities2-modding-2dfaa3 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited cities2-modding-2dfaa3 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill for Cities: Skylines II modding and local mod-project work through Cities2-MCP. Keep documentation retrieval separate from write/build actions.
Trigger this skill for asset/mod workflows, toolchain questions, project analysis, file edits, scaffolding, build/package/install work, or local playtesting handoffs, even when the user does not mention this plugin.
Use this skill as the general entry point, then load the focused skill when the task calls for it:
cities2-mod-review for review, audit, quality, readiness, maintainability, safety, user-value, or "what should I improve?" requests.cities2-mod-debugging for build failures, package failures, runtime errors, game logs, UI debugger issues, or in-game mod behavior that does not work.cities2-mod-release for public package, publish, upload, distribute, release, Paradox Mods preparation, or public sharing requests.When a general modding answer includes these follow-up areas, make the route explicit in the user-visible handoff: name cities2-mod-release for release readiness or public distribution follow-up, and name cities2-mod-debugging for runtime, log, UI debugger, or in-game failure follow-up. Do this even when you also provide immediate next steps. In the final answer, say which focused workflow should handle each follow-up, for example: "Use cities2-mod-release for release readiness after local playtesting" and "Use cities2-mod-debugging if the in-game UI does not appear."
Local package/install steps after a build or fix are allowed when their purpose is playtesting. Treat them as playtesting handoff moments, not distribution. For public package, publish, upload, distribute, or release requests, require the release-readiness workflow.
search(query, limit=5) and query_reference(query, limit=5).best practice, recommended, should, do not, should not, must not, cannot, can't, and won't.get_page(page_id) when snippets are not enough.get_snippets(query, limit=3) for code-oriented wiki snippets.Example queries:
modding toolchain requirements dotnet runtime mod post processorlocalization mod settings file localeui mod project structure react typescriptcsharp mod project harmony settings system updateBefore writing files, building, packaging, or preparing playtesting handoff steps:
is outside it, do not present this as a tool failure. Tell the user the knowledge tools still work, but local mod workflow tools need an allowed folder before they can read/write/build projects.
preferably add the parent folder that contains all of their CS2 mod projects so future projects under it work too.
settings and the Trusted mod projects folder option. If the agent has local file/command access, offer to fix the Claude desktop setting directly: identify the relevant settings file or app-managed config, ask before editing it, back it up, and set the folder to either this project or a shared parent folder. In Claude Code, project-scoped plugin installs normally use the current project automatically.
cache rather than the current session folder. If a Codex MCP workflow tool is allowlist-blocked for the active project, do not describe that as a successful MCP workflow-tool run. Either help the user add a project-scoped MCP configuration for that workspace, or use normal Codex workspace file edits/shell commands as an explicit fallback and say the MCP workflow tool was blocked.
scaffold_project is blocked, do not hand-roll a newmod template from wiki prose. Copy the bundled template files from the installed package/plugin cache when available, preserving the bundled structure, dependencies, and current corpus-derived game metadata. If the bundled template is not reachable, ask whether to configure MCP workspace access before creating files manually.
not add extra libraries, visual polish, demo dashboards, Vite configs, or a game_version/gameVersion value not provided by the bundled template or MCP scaffold metadata unless the user explicitly asks for them.
scaffold_project for new mod templates.list_project_tree before editing unfamiliar projects.write_project_file for explicit file changes.analyze_project before or after edits to catch structure/toolchain problems.build_project for trusted workspace code build/package diagnostics. Do not use it for arbitrary untrusted repositories.package_project for distributable output.If a write/build tool returns diagnostics, summarize the actionable errors first and include paths or commands that matter.
When inspecting an unfamiliar or incomplete project, explicitly report package-state evidence before giving build, playtest, or release advice. If package markers or tool output say no generated build output exists, say that no generated build output is present and that there is no installable local artifact yet. Do not call that a successful package, public release candidate, or playable handoff. The next workflow is to restore or scaffold a real project, analyze/build it, then create or install a package/installable artifact for local playtesting.
On Windows, use npm.cmd for both install and build commands; do not try bare npm first because execution policy can block npm.ps1. Use native file listing (Get-ChildItem) when checking template files or build outputs instead of assuming rg is installed. Verify generated outputs by checking file existence, size, and a short relevant snippet only; do not dump large generated files such as package-lock.json into the transcript. If the user asked only to scaffold and build, stop after build verification; do not start a dev server or browser preview unless the user also asks to run or preview the UI. In Windows sessions, report Windows paths rather than WSL-style /mnt/c/... paths.
For hybrid C#/UI mods, verify the actual target deploy folder after any local build or install handoff. The managed DLL, native companion files, UI bundles, CSS, images, and dependency DLLs should all appear in the intended Mods\<ModName> or package output folder with expected timestamps. Make UI build scripts emit to the same MSBuild deploy directory, such as $(DeployDir) or an explicit output override, instead of a default live Mods path; otherwise a temporary or custom C# deploy can silently split managed and UI outputs.
When a build, install, or fix needs in-game validation, provide a playtesting handoff instead of saying the work is done. Name what was installed, where it was installed, whether the game or playset must be restarted, the exact in-game checks to perform, the expected success signal, the likely failure signal, and relevant evidence such as Modding.log, Unity/Player logs, UI debugger output at localhost:9444, installed files, or playset state.
For incomplete-project handoffs, keep the local playtest section concrete even when playtesting is not ready yet: state the package/installable artifact status, then list the evidence required for a future handoff: launch the game, confirm the playset, collect logs, check the UI debugger, and capture confirmation. If there is no installable local artifact, say local playtesting is blocked until one exists, then name the exact package/install step that would unblock it, such as create or install a package/installable artifact for local playtesting.
Cities: Skylines II must be closed before installing or replacing a local mod build. If the game is running, stop and tell the user to close Cities: Skylines II before install. After install, tell the user to launch the game, enable or confirm the playset/mod if needed, and then run the playtest scenario.
If a workflow tool returns a workspace/allowlist/configuration error, pause MCP workflow-tool retries and help the user configure access before trying that MCP tool again. Phrase it as a normal setup step, not as a crash: "This plugin can work on that project after you add its folder, or a shared parent folder, to Trusted mod projects folder." In Codex, when the plugin cache allowlist blocks MCP workflow tools, you may use the explicit bundled-template or normal Codex workspace fallback described above, while saying the MCP workflow tool was blocked.
When scaffolding a new project, scaffold_project chooses a default game_version from the bundled corpus and returns game_version, game_version_source, bundled_game_version, and any installed-game warning. If the warning says the installed game appears newer than the bundled package, tell the user the project was still created and recommend checking for an updated package release before deeper modding work. If the user names a newer target game version than the bundled default, pass metadata.game_version explicitly.
Do not publish, upload, distribute, or prepare a public release immediately after code changes or a build unless local playtesting has been confirmed. A successful build is not enough. Do not block packaging or installing a local build whose purpose is playtesting; label it as a local playtest artifact, not a distribution release. If the user has not tested locally before public release, route to cities2-mod-release and provide a tailored playtest checklist. If the user explicitly overrides the gate, label the result as not gameplay-verified.
Sources: line naming the wiki page or snippet topic, with Markdown links for wiki URLs when available.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.