setup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited setup (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Setup orchestrator for the Octowiz Bridge. Runs only the phases with gaps.
Invoked by octowiz:octowiz when the live check reports gaps. Do not invoke directly.
octowiz-cache checkParse the JSON output. Store hard_gaps and advisory_gaps.
If hard_gaps is empty: delete ONBOARDING.md from the current directory if it exists, then return control to octowiz:octowiz to show the A/B/C/D menu.
If .octowiz/setup-state.json does not exist in the current directory, create ONBOARDING.md:
# Octowiz Setup
## Environment (per-machine)
- [STATUS] superpowers plugin
- [STATUS] mattpocock-skills plugin
- [STATUS] antfu-skills plugin
- [STATUS] LiteLLM env vars (LITELLM_BASE_URL + API key)
- [STATUS] LiteLLM routing cache (verified within 24h)
- [STATUS] Project namespace seeded in LiteLLM Memory
## Project (per-repo)
- [STATUS] antfu skills setup (if TypeScript/Vue stack)
- [STATUS] Agent instructions file (AGENTS.md / CLAUDE.md / GEMINI.md)
- [STATUS] mattpocock-skills section in agent file (## Agent skills)
## Next step
[What is about to run]Use [x] for passing checks, [ ] for gaps, [!] for advisory items.
Run if any of these are in `hard_gaps`: plugin_superpowers, plugin_mattpocock-skills, plugin_antfu-skills
For each missing plugin, explain what it does and why it is required, then show the install command. Verify after each install.
Provides workflow discipline skills — TDD, brainstorming, code review, git worktrees, subagent-driven development.
claude plugins install superpowersVerify: ls ~/.claude/plugins/cache/*/superpowers/ 2>/dev/null | head -1
Provides domain documentation and issue management skills — grill-with-docs, to-prd, to-issues, triage, diagnose, prototype.
Note: install ID is mattpocock-skills; slash-command namespace is /mattpocock-skills: — these match.
claude plugins install mattpocock-skillsVerify: ls ~/.claude/plugins/cache/*/mattpocock-skills/ 2>/dev/null | head -1
Provides TypeScript/Vue/Vite code quality skills — ESLint config, Vitest setup, Vite configuration, UnoCSS integration.
claude plugins install antfu-skillsVerify: ls ~/.claude/plugins/cache/*/antfu-skills/ 2>/dev/null | head -1
After all plugins are installed, update machine-state.json:
python3 -c "
import sys; sys.path.insert(0, '$(which octowiz-cache | xargs dirname 2>/dev/null || echo .)')
from packages.memory_client.env import init_machine_state, save_machine_state, MACHINE_STATE_PATH
state = init_machine_state()
for pid in ['superpowers', 'mattpocock-skills', 'antfu-skills']:
state.plugins[pid] = 'verified'
save_machine_state(state)
print('machine-state.json updated')
"Run if any of these are in `hard_gaps`: litellm_env, litellm_cache Also run Step 2.4 alone if hard_gaps has no Memory entries but setup-state.json has no project_id (i.e. this is the first /octowiz run in this repo on a machine already fully configured). Check with:
python3 -c "
from packages.memory_client.env import load_repo_state
import pathlib
s = load_repo_state(pathlib.Path('.'))
print('seeded' if s and s.project_id else 'not-seeded')
"If the output is not-seeded, skip Steps 2.1–2.3 and run only Step 2.4.
This phase covers all LiteLLM operations in sequence: env vars → role cache → project namespace seed.
If litellm_env is in hard_gaps, check current state:
echo "LITELLM_BASE_URL: ${LITELLM_BASE_URL:-<not set>}"
echo "LITELLM_ADMIN_API_KEY: ${LITELLM_ADMIN_API_KEY:-<not set>}"
echo "LITELLM_API_KEY: ${LITELLM_API_KEY:-<not set>}"Guide the developer to add to ~/.claude/settings.json:
{
"env": {
"LITELLM_BASE_URL": "http://your-litellm-server:4000",
"LITELLM_ADMIN_API_KEY": "your-admin-key-here"
}
}Ask them to reload Claude Code so the env vars take effect, then verify before continuing.
octowiz-cache build --all --namespace "${OCTOWIZ_NAMESPACE:-allspark}"If this fails, check: Is LiteLLM running? curl -s "${LITELLM_BASE_URL}/health"
octowiz-cache get --role routing --namespace "${OCTOWIZ_NAMESPACE:-allspark}" > /dev/nullIf exit code is 0, record routing_verified_at:
python3 -c "
from packages.memory_client.env import init_machine_state, save_machine_state, MACHINE_STATE_PATH, _now_iso
state = init_machine_state()
state.litellm['routing_verified_at'] = _now_iso()
save_machine_state(state)
print('routing_verified_at recorded')
"Seed the project namespace into LiteLLM Memory (idempotent — safe to re-run):
octowiz-cache seedThis writes project:{id}:octowiz:config and project:{id}:octowiz:rules if they do not already exist. The project_id is derived from the git remote URL (UUID fallback) and stored in .octowiz/setup-state.json for stability across runs.
If this fails with a connection error, LiteLLM is not reachable. Revisit Steps 2.1 and 2.2 before retrying.
Run if any of these are in `hard_gaps` or `advisory_gaps`: antfu, agent_file, mattpo_skills_setup
octowiz-cache checkAlso detect manually:
AGENTS.md, CLAUDE.md, GEMINI.md (in that priority order)package.json for vue/vite/react/typescript; check for pyproject.tomlCONTEXT.md and docs/adr/Update the "Project (per-repo)" section of ONBOARDING.md with findings.
If mattpo_skills_setup is in advisory gaps and the agent file exists but has no ## Agent skills section, invoke:
/mattpocock-skills:setup-matt-pocock-skills
If no agent file exists: note in ONBOARDING.md that this step is deferred. Do not create the file.
Update setup-state.json:
python3 -c "
from packages.memory_client.env import init_repo_state, save_repo_state
import pathlib
state = init_repo_state(pathlib.Path('.'))
state.mattpocock_setup = True
save_repo_state(state, pathlib.Path('.'))
"ts_vue or polyglot stack only.
If agent file exists, detect which antfu sub-skills are relevant from package.json and append to ## Agent skills:
- /antfu-skills:vue — Vue 3 composition API patterns
- /antfu-skills:vite — Vite configuration and build optimization
- /antfu-skills:vitest — Vitest setup and patterns
- /antfu-skills:pnpm — pnpm workspace commands
- /antfu-skills:unocss — UnoCSS integrationUpdate setup-state.json:
python3 -c "
from packages.memory_client.env import init_repo_state, save_repo_state
import pathlib
state = init_repo_state(pathlib.Path('.'))
state.antfu_setup = True
state.antfu_relevant = True
save_repo_state(state, pathlib.Path('.'))
"If no agent file exists or stack is not ts_vue/polyglot: note in ONBOARDING.md, set antfu_relevant = False if applicable.
In ONBOARDING.md, note any items that follow lazy-creation:
CONTEXT.md absent: [!] CONTEXT.md — not present; will be created lazily by /grill-with-docsdocs/adr/ absent: [!] docs/adr/ — not present; will be created lazily by /grill-with-docsDo NOT create these files now.
Always run last, after all other phases complete.
octowiz-cache checkBoth services self-heal on version skew at session start (Node daemon since 0.9.17, Python A2A server since 0.9.18) — verify they are up and current:
# Node daemon (launchd)
launchctl list de.integrahub.octowiz-daemon 2>/dev/null || echo "daemon: not loaded"
# Python A2A server — version must match the installed plugin
curl -s -m 3 "http://localhost:${OCTOWIZ_A2A_PORT:-8765}/health" 2>/dev/null \
|| echo "a2a: down (starts on next session open)"If either is missing or stale, route to /octowiz:octowiz-doctowiz (fixes daemon_start and aelli_python) rather than fixing inline here.
ONBOARDING.md from the current directory: rm -f ONBOARDING.mdoctowiz:octowiz to show the A/B/C/D menu.Report remaining gaps. For each:
| Gap ID | Message |
|---|---|
plugin_superpowers | superpowers plugin not found. Run: claude plugins install superpowers |
plugin_mattpocock-skills | mattpocock-skills plugin not found. Run: claude plugins install mattpocock-skills |
plugin_antfu-skills | antfu-skills plugin not found. Run: claude plugins install antfu-skills |
litellm_env | LITELLM_BASE_URL or API key not set. Add to ~/.claude/settings.json under "env". |
litellm_cache | LiteLLM routing bundle not verified. Run: octowiz-cache build --all |
antfu | Antfu setup needed for this TypeScript/Vue project. Re-run Phase 3. |
Offer the escape hatch:
"Setup is incomplete. You can skip this and proceed anyway — but some features may not work.
>
To skip a specific check: respond with the check ID (e.g.,litellm_env). To skip all and proceed: respondskip all. To fix: respondfix."
To dismiss a check:
python3 -c "
from packages.memory_client.env import dismiss_check, MACHINE_STATE_PATH
import pathlib
dismiss_check('<check_id>', pathlib.Path('.'), MACHINE_STATE_PATH)
print('check dismissed')
"Advisory gaps (agent_file, mattpo_skills_setup) are noted but do not block Phase 4 from passing.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.