project-vendor-boundary — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited project-vendor-boundary (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This is a composable project overlay. Add matching implementation guidance when the work requires language-specific code judgment.
For review, inspect provenance, local patches, and integration behavior without updating, fetching, or replacing the vendor tree. During implementation, preserve pre-existing local changes and apply only the requested integration or update.
The change involves checked-in third-party source, a subtree or submodule, a vendor directory, copied sources, a local vendor patch, or the app-owned adapter around that material.
Do not use this for ordinary package-manager version or lockfile changes with no checked-in third-party source, app-owned code unrelated to the integration seam, or generated outputs that must be changed through their generator. Use project-release-maintainer for release concerns and compose it only when a vendor change also affects shipped metadata. Use security first when exploit review is the primary job.
source, submodule, generated output, or package-managed dependency. Read the repository's update instructions, provenance record, patch convention, and license or notice files when they exist.
seam can reasonably absorb it. Patch vendor source only when the seam cannot solve the problem without distorting the app contract.
mass mechanical rewrites, or local style normalization inside the vendor tree. Record the upstream source or base version and patch rationale using the repository's existing convention.
path the repo supports. Inspect the final diff for accidental vendor churn.
rules, or shipped metadata only when the vendor change affects them; do not rewrite these files for an app-only adapter change.
Treat fetching or replacing upstream source, moving a submodule, and filing an upstream issue or contribution as separate actions with their own network and external side effects. Do not edit generated vendor artifacts manually when a documented regeneration path owns them.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.