deploy — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited deploy (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are deploying the user's app to production via the Nometria platform. Execute this workflow precisely.
Find the Nometria API token. Check in this order:
# 1. Environment variables (API key or JWT token)
echo "$NOMETRIA_API_KEY"
echo "$NOMETRIA_TOKEN"
# 2. .env file in current project
grep -s 'NOMETRIA_API_KEY\|NOMETRIA_TOKEN' .env .env.local 2>/dev/null
# 3. Stored credentials from `nom login`
cat ~/.nometria/credentials.json 2>/dev/null
# 4. Home directory config (legacy)
cat ~/.nometria 2>/dev/nullIf no token is found, tell the user:
No Nometria API token found. Runnom loginor/nometria-loginto authenticate. Get your API key at https://nometria.com/settings/api-keys
Stop here if no token. Do not proceed without a valid token.
Store the token: TOKEN="<the token>"
Check if there's a nometria.json in the workspace root:
cat nometria.json 2>/dev/nullIf it exists, extract app_id and migration_id from it.
If not, or if the user specified an app name as $ARGUMENTS, list all migrations:
curl -s -X POST https://app.nometria.com/listUserMigrations \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $TOKEN" \
-d '{}'From the response, find the matching migration. If multiple apps exist and the user didn't specify which one, show a numbered list and ask them to pick:
1. MyApp (Base44) - hosting, paid
2. OtherApp (Lovable) - hosting, paid
3. TestApp (Manus) - download, pendingOnly proceed with migrations that have delivery_type: "hosting" and payment_status: "paid".
Store: APP_ID="<app_id>" and MIGRATION_ID="<migration_id>"
curl -s -X POST https://app.nometria.com/checkAwsStatus \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $TOKEN" \
-d "{\"app_id\": \"$APP_ID\"}"Parse the response to determine the instance state.
If instance is running (data.instanceState === "running"):
Tell the user: "App is already running. Resyncing code to production..."
curl -s -X POST https://app.nometria.com/resyncHosting \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $TOKEN" \
-d "{\"app_id\": \"$APP_ID\"}"If instance is stopped (data.instanceState === "stopped"):
Tell the user: "Instance is stopped. Starting and resyncing..."
curl -s -X POST https://app.nometria.com/updateInstanceState \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $TOKEN" \
-d "{\"app_id\": \"$APP_ID\", \"instance_state\": \"start\"}"Then resync once it's running.
If not deployed (status === "not_deployed"):
Tell the user: "Deploying new production instance..."
curl -s -X POST https://app.nometria.com/deployToAws \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $TOKEN" \
-d "{\"migration_id\": \"$MIGRATION_ID\"}"Poll every 5 seconds until the deployment reaches a terminal state:
curl -s -X POST https://app.nometria.com/checkAwsStatus \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $TOKEN" \
-d "{\"app_id\": \"$APP_ID\"}"Terminal states:
instanceState: "running" → SuccessdeploymentStatus: "failed" → Failure (report errorMessage)instanceState: "terminated" → FailurePoll up to 60 times (5 minutes). Report progress every 3 polls.
On success, display:
✅ Deployed successfully!
App: <app_name>
URL: <deployUrl or hosted_url>
IP: <ipAddress>
Type: <instanceType>On failure, display the error and suggest checking the Nometria dashboard.
If nometria.json doesn't exist, create it so future deploys are faster:
{
"app_id": "<APP_ID>",
"migration_id": "<MIGRATION_ID>",
"app_name": "<app_name>",
"api_url": "https://app.nometria.com"
}Do all of the above. Execute every curl call and report results to the user.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.