repo-intel — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited repo-intel (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
extend op-cell: add situational awareness before planning, review, onboarding, or risk triage. The skill answers temporal, social, graph, symbol, and project-shape questions with native tool recipes only; no prebuilt artifact is required.
All signal recipes are in references/signals.md. Run the smallest recipe set that answers the user's query, then report the evidence shape directly: file, count, score, owner, last-seen, callers, callees, or manifest field.
git rev-parse --show-toplevel; run recipes from that root. If the user names a path, keep every command path-scoped.codegraph_explore, codegraph_search, codegraph_callers, codegraph_callees, codegraph_impact, codegraph_files. If unavailable or stale, degrade to ast-grep plus git grep fallbacks from references/signals.md.npx -y repomix --compress for compressed whole-repo context.*.d.ts, *.snap, lockfiles, generated/, codegen/, dist/, build/, vendor/.| Query | Primary evidence | Output | |
|---|---|---|---|
hotspots [path] | git --no-pager log --format churn, 90-day recent window | files ranked by score = (recentChanges*2 + totalChanges)/(totalChanges+1) | |
bugspots [path] | fix/hotfix commit subjects + changed files, generated suppression | files ranked by bug-fix density | |
coupling <file> | commits touching target and co-changing files | related files with common commit count + Jaccard/target ratios | |
ownership <path> | per-file/path author commits | primary owner, owner shares, stale owner flags | |
bus-factor [path] | commit ownership concentration, bots ignored when identifiable | people required to cover 80% of commits + at-risk paths | |
contributors [path] | git shortlog -sne + per-author last seen | contributors, commits, recent/stale status | |
recency [path] | last commit per file/author | active/cold/stale files and owners | |
entry-points | codegraph entry-point exploration; manifest and AST fallbacks | scripts, commands, main functions, service starts | |
| `symbols <file | name>` | codegraph search/explore; AST fallback | definitions, exports, imports, locations |
dependents <symbol> | codegraph callers/impact; AST/text fallback | files/symbols that call/import/reference the target | |
metadata | manifest reads | stack, package manager, CI/test scripts, workspace shape | |
digest | npx -y repomix --compress | compressed repo packet for synthesis | |
health | hotspots + bugspots + bus factor + recency + metadata | evidence-backed repo health summary |
src/payments/ is single-owner.lastSeen to the repo's last commit; stale means more than 90 days older than that point, not older than wall-clock today.git grep proves references exist; it does not prove call semantics.Git history is the stable baseline for this skill. Codegraph is optional and improves symbol, caller, callee, impact, and entry-point precision when the repo is indexed. When codegraph is unavailable, use ast-grep for structural matches and git grep for exact text references; mark those answers MEDIUM and include the fallback command.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.