repo-preflight — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited repo-preflight (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Before the user hands this repository (or an MCP config) to an AI agent, commits it, or shares it with anyone, run a Holster preflight and report back.
holster.guard tool with the absolute path to the repo. It returns a RUN verdict (safe to run an agent on this locally?) and a SHARE verdict (safe to commit/share this?), plus a ranked fix order.npx/uvx with no pinned version) or that inherit the full shell environment,.env, *.pem, .aws/credentials, …) not covered by .gitignore.Then walk the user through the fix order, top item first.
holster.scan_repo (secret scan), holster.check_gitignore (gitignore audit), holster.rotation_playbook (provider-specific rotation steps).Holster runs entirely locally — the repo never leaves the machine. Never print raw secret values; refer to findings by type and location (file:line) only.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.