rsk-guide — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited rsk-guide (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Draft (v0.3.0). TherskCLI is in progress. Verify againstrsk --helponce shipped. For creating new skills (vs managing existing ones), useskill-builder. For designing CLIs in general, seecli-tool-architect.
Installing, pinning, updating, or uninstalling skills changes what tools and standards future agents will load in this and other projects. These are architectural decisions, not housekeeping. Never run `rsk install`, `rsk uninstall`, `rsk update`, `rsk new`, `rsk destroy`, `rsk pin`, or `rsk unpin` without explicit user confirmation.
For every proposed action:
--global / --for / project manifest), and what changes on disk (including .rsk/CLAUDE.md and ./CLAUDE.md edits when pinning)Read-only commands (rsk list, rsk catalog, rsk status without --stack) are safe to run without asking — they only display state. Anything that touches symlinks, the manifest, the project CLAUDE.md, the official cache, or makes network calls (rsk status --stack) needs an explicit go.
If the user gives a blanket "yes" up front (e.g. "set everything up for this project"), still pause and confirm before each bundle or pin. A slip from go-grpc to go-rest, installing globally when they meant locally, or pinning a skill they didn't want auto-loaded is hard to undo silently.
Pick the one that matches the user's intent.
.rsk/) — preferred for per-project skill setsMirrors go.mod: a declarative rsk.mod lists the skills this project depends on, rsk.lock records resolved versions, and pinned skills are auto-imported into ./CLAUDE.md via @.rsk/CLAUDE.md. Lives in <project>/.rsk/.
rsk new # creates .rsk/rsk.mod + .rsk/CLAUDE.md + appends import to ./CLAUDE.md
rsk install <name[@version]> # adds to manifest, symlinks into .rsk/skills/, updates rsk.lock
rsk install <name> --pin # also imports skill into .rsk/CLAUDE.md (auto-loaded in this project)
rsk pin <name> # pin an already-installed skill
rsk unpin <name> # remove the import (skill stays installed)
rsk list # show manifest entries with pinned/installed marks
rsk update <name> # re-resolve + re-link to latest available version
rsk install # (no args) re-installs everything in rsk.mod (after clone, after edits)
rsk destroy # delete .rsk/ and remove @.rsk/CLAUDE.md importPin vs install — installed skills are present on disk but not auto-loaded; pinned skills are imported in .rsk/CLAUDE.md and load every turn in that project. Pin only what truly needs auto-loading.
Install a curated bundle or single skill into the project (.rsk/skills/) or globally with --global (~/.claude/skills/, ~/.config/opencode/skills/).
rsk install <name...> # project: bundle or skill → .rsk/skills/, writes rsk.mod
rsk install <name...> --global # global: all configured tool dirs, no manifest
rsk install <name> --global --for claude-code # global, one tool only
rsk install <name> --personal # personal/ skill, explicit opt-in
rsk install <name> --dry-run # preview without writingNames are auto-resolved against the catalog: a name that matches a bundle expands to that bundle's skills; otherwise the name is treated as a single skill. Bundles win on name collisions.
Project installs land in.rsk/skills/and always updatersk.mod. Use--globalif you want the skill linked system-wide without manifest tracking.
| Command | Purpose | |
|---|---|---|
rsk catalog | All available skills | |
rsk catalog --bundles | All available bundles | |
rsk catalog --bundle <name> | Skills in a specific bundle | |
| `rsk catalog --source local\ | official` | Filter by source |
rsk catalog --personal | Include personal skills | |
rsk catalog -o json | Machine-readable output | |
rsk list | Project manifest entries (installed/pinned marks) | |
rsk list --global | Skills linked in global tool dirs | |
rsk list --global --for <tool> | Scope global listing to one tool | |
rsk status | What's installed across project + global; bundle tags; pinned tags (no network) | |
rsk status --global / --project | Restrict scope | |
rsk status --for <tool> | Scope --global to one tool |
rsk init # once per machine — writes ~/.config/rsk/config.json
rsk init --force # overwrite existing configrsk init prompts for:
ralvaskills repo) or hosted registry (skills.ralvarez.dev)claude-code, opencode, or both~/.claude/skills/, ~/.config/opencode/skills/)--global (all configured tools, or a single tool)rsk update [name...] [--global] [--for <tool>] [--official] [--personal] [--dry-run]git pull on the repo (symlinks update automatically). Add --official to also pull anthropics/skills cache.rsk uninstall <name...> [--global] [--for <tool>] [--personal] [--dry-run]Project uninstall also cleans the matching entries from rsk.mod / rsk.lock and unpins them from .rsk/CLAUDE.md (or opencode.json).
rsk status --stack [--refresh] # planned: fetch latest versions from proxy.golang.org / pypi.orgPer the spec this is opt-in with a 24h cache; the current build returns an explicit "not yet implemented" error. Don't promise drift checks until it ships.
First-time machine setup (confirm each step with the user)
rsk init — pick local clone or registry, configure toolsrsk install global --global — universal skills, machine-wideSet up a new project with tracked manifest
cd <project> then rsk newrsk install <name> per skill (use --pin for ones that should always auto-load).rsk/rsk.mod, .rsk/rsk.lock, .rsk/CLAUDE.md, and the @.rsk/CLAUDE.md import line in ./CLAUDE.mdSet up a new project with a stack bundle
cd <project> then rsk newrsk install <stack-bundle> — e.g. rsk install go-grpcBring an existing manifest project up to date after `git clone` — rsk install (no args)
Add a single skill mid-project
rsk install <name> (+ --pin if it should auto-load)rsk install <name> --globalUpdate everything — rsk update (local clone) or rsk update --official (also refresh Anthropic cache)
Upgrade a single manifest skill — rsk update <name>
| Bundle | Source | Use for |
|---|---|---|
global | local | Every machine — universal workflow + meta skills |
docs | official | Document creation (docx/xlsx/pdf/pptx/find-docs) |
design | mixed | Frontend / UI projects |
go-grpc | local | Go gRPC services |
gin | local | Go REST services (Gin) |
nethttp | local | Go REST services (stdlib net/http) |
go-cli | local | Go command-line tools |
fastapi | local | Python REST services (FastAPI) |
python-grpc | local | Python gRPC services |
python-cli | local | Python command-line tools |
llm-app | local | LLM apps / RAG pipelines |
ros2 | local | ROS2 robotics |
event-driven | local | Schema-first messaging (NATS/Kafka/RabbitMQ) |
observability | local | Signals + dashboards/alerts |
code-review | local | Reviewer triad: security, contracts, performance |
.rsk/.rsk/
├── rsk.mod # TOML: version, pinned[], skills{name = version-constraint}
├── rsk.lock # TOML: resolved {name, version, source, path} per skill
├── skills/ # symlinks into the local repo or registry cache
│ └── <name>/ # → ralvaskills/skills/.../<name>/ or registry cache
└── CLAUDE.md # one `@skills/<name>/SKILL.md` line per pinned skill./CLAUDE.md gets a single appended line: @.rsk/CLAUDE.md. Both rsk new (creates it) and rsk destroy (removes it) are idempotent.
For the complete CLI specification — exhaustive flag list, config.json shape, catalog overrides, discovery rules, edge-case behavior — see docs/SPECS.md in the ralvaskills repo.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.