setup-pathmode-workflow — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited setup-pathmode-workflow (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<what-to-do>
Walk the user through the workflow questions below. Ask ONE question at a time. For each question, propose your best-guess answer based on what you can see in the repo (package.json scripts, CI config, README, existing PRs). The user accepts or corrects.
Questions to cover (in order):
npm test, pytest, pnpm vitest)npm run build, tsc --noEmit)shipped? As verified? (merge to main, deploy to prod, metric hold for 1 week)log_implementation_note, ADR file, commit messages, PR descriptions)When all questions are answered, output a single self-contained block the user can paste into their CLAUDE.md file (or the equivalent for their agent). Format:
## Pathmode Workflow Conventions
- Primary agent: [answer]
- Issue tracker: [answer]
- Test: `[command]`
- Typecheck/build: `[command]`
- PR conventions: [answer]
- Status mapping: shipped = [event]; verified = [event]
- Implementation notes: [convention]If PATHMODE_API_KEY is set, ALSO call log_implementation_note against a workspace-level convention record (the user's current intent if any, otherwise the first intent in the workspace) so other team members and other agents inherit the conventions.
Do NOT write to a .pathmode/ directory in the repo. The canonical conventions live in CLAUDE.md (visible to every agent session) and in the Pathmode workspace (visible to PMs). The repo is a consumer of intent, not where intent fossilizes.
</what-to-do>
<supporting-info>
Each question maps to a real friction point in agent-assisted development:
split-intent-to-issues where to format output forreview-against-intent how to check that outcomes are actually deliveredhandoff-intent whether decisions go in PR descriptions or somewhere elsehandoff-intent when to propose update_intent_status to shipped vs verifiedWithout these answers, every skill has to re-ask the same questions every session. Capturing them once makes downstream skills feel native.
Before asking, look at the repo:
package.json scripts field → likely test/build/typecheck commands.github/workflows/ → likely CI commands the team trustsCONTRIBUTING.md, CODEOWNERS, PR templates → PR conventions.linear/, .jira/, .github/ISSUE_TEMPLATE/ → likely issue trackerCLAUDE.md, .cursorrules, .windsurfrules → likely primary agentFor each inference, propose it as the best-guess answer ("Looks like you use Linear — there's a .linear/ directory. Is that right, or are tickets actually in [other place]?").
CLAUDE.md only. The user paste-edits it themselves. The skill does not write files.CLAUDE.md output, PLUS a log_implementation_note call so the conventions are visible in the Pathmode workspace..pathmode/ or any repo subdirectory beyond CLAUDE.mdIt is an interview, not an installer.
</supporting-info>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.