lovable-cleanup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited lovable-cleanup (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Remove every trace of Lovable scaffolding and ship the project as your own. Made with antigravity-awesome-skills · author: whoisabhishekadhikari
Lovable (lovable.dev) bootstraps Vite + React + shadcn/ui projects with its own tagger dependency, branding, placeholder assets, and generated markdown docs baked in. Most developers export from Lovable and want a clean, ownable codebase before shipping or open-sourcing. This skill covers all 14 areas where Lovable leaves fingerprints.
lovable-tagger in package.jsonCLEANUP_SUMMARY.md, DEPLOYMENT_GUIDE.md, or DEVELOPMENT_SUMMARY.mdindex.html still has a generic <title> or Lovable faviconLovable adds three categories of scaffolding that must be removed:
lovable-tagger dev dep + componentTagger() call in vite.config.ts.This is the only runtime hook; removing it is always safe.
favicon.ico/png, og-image.png, logo.png, generic <title>,and a Lovable project URL in README.md.
CLEANUP_SUMMARY.md, DEPLOYMENT_GUIDE.md, DEVELOPMENT_SUMMARY.md,LOGO_UPDATE.md in the project root.
Removing deps before editing source files avoids lockfile conflicts. Cleaning docs last means the README reflects the already-cleaned project.
Lovable pre-installs the full shadcn/ui component set (~29 components) and all Radix UI primitives (~30 packages). Most projects use 5–10. The unused ones are safe to remove but @radix-ui/react-slot must be kept — it is an indirect dep used internally by many shadcn components via the asChild prop.
# Welcome to your Lovable project with the real project titlehttps://lovable.dev/projects/REPLACE_WITH_PROJECT_ID✅ After stripping, read the README end-to-end. Offer to write a replacement intro paragraph if large sections were removed.
"lovable-tagger" from devDependencies"name" from "vite_react_shadcn_ts" to the real project name (kebab-case)scripts block for "lovable" or "lovable:*" entries and remove them<!-- security-allowlist: grep for scanning package.json content, read-only, no network -->
grep -n "lovable" package.jsonimport { componentTagger } from "lovable-tagger"mode === 'development' && componentTagger() from the plugins array.filter(Boolean) if it was only present to handle the conditional tagger<!-- security-allowlist: grep for scanning vite config, read-only -->
grep -n "lovable\|componentTagger\|filter(Boolean)" vite.config.ts<title> with the real product name<!-- Generated by Lovable --> comments or Lovable meta tags<!-- security-allowlist: grep for scanning HTML file, read-only -->
grep -in "lovable\|generator" index.htmlReplace these files (keep filenames, swap content):
| File | Action |
|---|---|
favicon.ico | Replace with real icon |
favicon.png | Replace with real icon |
og-image.png / logo.png | Replace with real brand assets |
placeholder.svg | Usually unused — safe to delete |
✅ Flag which files are actually referenced in <head> vs dead weight so the user knows what to prioritise.
src/main.tsx — scan for Lovable HOCs, wrappers, or commentssrc/App.tsx — same// generated by Lovable headers<!-- security-allowlist: grep over source files, read-only, no network -->
g~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.