setup-gitignore — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited setup-gitignore (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Initialize or idempotently revise the current repo's .gitignore — never the global excludesfile.
Per-repo only. Never read or write ~/.gitignore, ~/.config/git/ignore, or run git config --global. The user's global excludesfile handles cross-machine noise; this skill handles language/tool specifics for the current repo.
references/AI-TOOLING.mdreferences/IDE-EDITOR.mdgit status, confirmed interactivelygit rev-parse --show-toplevelAbort with a clear error if not inside a git repo.
Read references/LANGUAGE-DETECTION.md for the manifest → gitignore.io key table. Scan manifests:
fd --max-depth 2 -t fMatch filenames against the detection table; build a comma-separated key list (e.g., rust,node,typescript). If no manifests detected, use an empty key list (bundled blocks still apply).
If .gitignore exists, snapshot it before any modification:
cp .gitignore /tmp/gitignore-snapshot-$(date +%s).bakgit status -s -uall | rg '^\?\?' | rg -v '^\?\? \.gitignore'Cluster untracked paths by top-level directory or extension. Present clusters to the user and wait for explicit confirmation. Do not add any empirical pattern without confirmation.
Run scripts/compose-gitignore.sh <csv> to fetch and merge gitignore.io templates. If the network call fails, tell the user and ask whether to continue with bundled-only mode.
Append the bundled blocks after the API output in order:
# === AI TOOLING ===
<contents of references/AI-TOOLING.md>
# === IDE / EDITOR ===
<contents of references/IDE-EDITOR.md>
# === EMPIRICAL ===
<user-confirmed patterns, one per line># === SECTION === block idempotently — patterns already present in the file are deduplicated (first occurrence wins). Preserve all user content outside section headers. Show the full diff via difft; write only after user confirms.git status -s -uall | rg '^\?\?' | wc -lReport untracked count before and after. List any paths still untracked so the user can decide whether to add further patterns.
Re-running the skill on a repo where the skill already ran produces no diff. Section headers act as stable merge anchors. User content outside sections is never modified.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.