alignfirst-setup-guide — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited alignfirst-setup-guide (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A one-time companion for setting up a consumer repository. It installs any subset of three independent tools:
docs/.Pick any combination. Each has its own reference; this skill investigates the repo, agrees on scope, then follows the matching reference(s).
Follow these four steps in order. Do not skip ahead: complete each before starting the next.
Detect the stack and package manager: check the packageManager field in package.json, else the root lockfile — package-lock.json → npm, pnpm-lock.yaml → pnpm, yarn.lock → yarn, bun.lockb/bun.lock → bun — falling back to npm. Record the result — every reference in Step 3 reuses this one detection rather than repeating it.
Commands in this guide are written for npm; convert each one to the detected manager — both when you run it and when you write it into project files. Only npm needs a -- separator to pass flags to a script (npm run docmap -- --guide); pnpm and yarn drop the run and the separator (pnpm docmap --guide), and bun keeps run but needs no separator (bun run docmap --guide). Install verbs differ too (npm install -D vs pnpm add -D / yarn add -D / bun add -D).
Then detect each tool's existing footprint:
docmap script, a @paleo/docmap dependency, or a docs/ directory.workspace script or a @paleo/workspace dependency..plans/ directory, or an ## AlignFirst section in AGENTS.md / CLAUDE.md.Present the findings and agree with the user on which tools to install or upgrade. Any combination is valid.
Require a clean working tree first (git status). If it isn't clean, stop and ask the user to commit or stash. Then follow the matching reference(s):
@paleo/workspace).Upgrading from an older AlignFirst (v1/v2): route through alignfirst-upgrade.md, which detects the version and follows alignfirst-upgrade-from-v1.md or alignfirst-upgrade-from-v2.md.
This skill is temporary. Once setup is done, the user can uninstall it. Provide them the command:
npx skills remove alignfirst-setup-guide --yes
# prune the entry in skills-lock.json
node --input-type=module -e 'import {readFileSync as r,writeFileSync as w} from "node:fs";const f="skills-lock.json",j=JSON.parse(r(f));delete j.skills["alignfirst-setup-guide"];w(f,JSON.stringify(j,null,2)+"\n")'~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.