init-project-guidance — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited init-project-guidance (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
init-project-guidance)This skill automates the creation of AI-agent guidance files (GEMINI.md and AGENTS.md) for new or existing projects. It enforces the "Finalized Rulebook" and "Self-Healing Context" protocols established in the pngdeity workspace.
Sub-directory GEMINI.md > Root GEMINI.md > Global ~/.gemini/AGENTS.md.Research -> Strategy -> Execution lifecycle using PLANS.md.AGENTS.md and GEMINI.md before initiating research.PLANS.md and CONTEXT.md at end-of-session.AGENTS.md.Makefile (or Taskfile) MUST act as the sole entry point for the developer environment to hide polyglot complexity..gemini/ or .agents/. Confirm before committing to main.-S), Semantic messages, imperative mood.git rebase --root --exec 'GIT_COMMITTER_DATE="$(git log -1 --format=%aD)" git commit --amend --no-edit -S'.The agent MUST perform a Tooling Audit and Stack Detection:
*.csproj, package.json, requirements.txt, uv.lock, PKGBUILD, main.tf, etc.dotnet, npm/uv, pkgctl, terraform.Generate a GEMINI.md in the project root with the following sections:
Analyze the detected stack and link relevant procedural skills from the central library using a portable, client-agnostic approach:
Scaffolding repository discovery: This skill is deployed via symlink from .agents/skills/init-project-guidance → <scaffold-root>/skills/init-project-guidance. Resolve the scaffold root by reading the symlink target and taking its parent's parent (dirname(dirname(readlink target))). If the symlink cannot be resolved (e.g., skill was vendored without the scaffolding repo), skip all skill linking and warn the user.
skill-index.json from ${SCAFFOLD_ROOT}/skill-index.json.compatibility_tokens matching the detected stack (see references/stack-compatibility-map.md).ln -sf ${SCAFFOLD_ROOT}/skills/<name> .agents/skills/<name>gemini CLI is available, also run gemini skills link <path> --scope workspace as enrichment.Create an AGENTS.md with:
After scaffolding, confirm correctness:
node skills/verification/scaffold-output-validator.cjs against the generated output.GEMINI.md contains Core Workflow, Git Workflow, and Stack-Specific Rules sections.AGENTS.md contains a harvestable ### Candidates for Global subsection.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.