pkg-bootstrap — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited pkg-bootstrap (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
When adding a new package to packages/:
PKGBUILD. For packages that mirror an existing Arch or AUR package, define the upstream source variable and the maintainer demotion flag:_upstream_aur_pkg for AUR packages_upstream_arch_repo for official Arch GitLab packages_demote_upstream_maintainer=true to automatically demote upstream maintainers to contributors_pkgname=<canonical-name> to declare the canonical software name (set on ALL packages in a variant family, including the base). If the package is standalone with no variants, omit _pkgname.gemini-cli variants, add _use_common_gemini_settings=true_deploy_aur=true if this package should be published to the AUR by the CI/CD pipeline_repo_subarch (e.g., "x86_64_v3") — mutually exclusive with _deploy_aurIf the package is entirely custom and does not mirror any upstream PKGBUILD, omit the _upstream_* variables and define a standard source array directly. In this case, skip step 2 and proceed to step 3.
bash scripts/sync-package.sh <pkgname> <version>This fetches the upstream PKGBUILD, initializes tracking state, applies declarative identity rules (demotion, asset sync), and updates hashes. Only one invocation is needed.
pkgctl version setupThis generates a valid .nvchecker.toml from the PKGBUILD source array.
AGENTS.md ONLY if the package has non-standard build requirements, undocumented quirks, or specific environmental constraints. Otherwise skip this step. The file must follow the Hierarchical Policies in the root AGENTS.md..nvchecker.toml for global version monitoring. namcap PKGBUILD
makepkg --printsrcinfo > .SRCINFO
pkgctl build
pkgctl diff --listsync-package.sh script expects the upstream source variable to be set correctly. If the upstream package uses a non-standard name, verify the variable before bootstrapping.pkgctl version setup must be run inside the package directory. The .nvchecker.toml it generates is package-specific.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.