login — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited login (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Help the user set up their Nometria API token for deployments.
# Check environment (API key or JWT)
echo "API_KEY: $([ -n "$NOMETRIA_API_KEY" ] && echo 'set' || echo 'not set')"
echo "TOKEN: $([ -n "$NOMETRIA_TOKEN" ] && echo 'set' || echo 'not set')"
# Check .env
grep -s 'NOMETRIA_API_KEY\|NOMETRIA_TOKEN' .env .env.local 2>/dev/null && echo "Found in .env" || echo ".env: not found"
# Check nom CLI credentials
cat ~/.nometria/credentials.json 2>/dev/null && echo "Found ~/.nometria/credentials.json" || echo "~/.nometria/credentials.json: not found"If a token already exists, tell the user they're already authenticated and show which source it was found in. Ask if they want to update it.
Tell the user:
To get your Nometria API key:
>
1. Go to https://nometria.com/settings/api-keys 2. Sign in to your account 3. Click Generate New Key 4. Copy the key and paste it here
>
Your key is stored locally and never sent anywhere except the Nometria API. Alternatively, you can use nom login from the CLI.Wait for the user to provide the token. They will paste it in the chat.
Once the user provides a token, validate it by making a test API call:
curl -s -X POST https://app.nometria.com/listUserMigrations \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <USER_TOKEN>" \
-d '{}'If the response contains "success": true, the token is valid. If it returns 401 or an error, tell the user the token is invalid and ask them to try again.
If the current directory has a .env file, append to it:
NOMETRIA_API_KEY=<key>If no .env exists, create .env with the key.
Also check if .gitignore contains .env. If not, warn the user:
⚠️ Make sure.envis in your.gitignoreto avoid committing your token.
If no nometria.json exists and the user has migrations, ask if they want to link this workspace to one of their apps. If yes, create nometria.json:
{
"app_id": "<selected_app_id>",
"migration_id": "<selected_migration_id>",
"app_name": "<app_name>",
"api_url": "https://app.nometria.com"
}Tell the user:
✅ Authenticated as <email>
Key stored in: .env
Linked app: <app_name> (or "none - run /deploy to link")
You can now use:
/deploy - Deploy to production
/preview - Deploy staging preview
/status - Check deployment status
nom deploy - Deploy from CLI~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.