maestro-setup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited maestro-setup (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Tune a Maestro-enabled repository harness from current repository evidence.
Activate with a known session id: maestro hook record --event skill_activation --skill maestro-setup --session <session_id>
maestro init.maestro install.running binary with minimal repeated token cost.
maestro doctor reports setup or local agent integration problems.pwd, then maestro status.setup, take the cheap rerun path before any broader read-in:
maestro sync --dry-run.maestro sync.maestro sync, then report only changed resources,backup paths, and blockers.
maestro sync --global-skills only when the user asks for globalskills or maestro doctor reports global skill drift.
maestro doctor, then maestro status.maestro init --dry-run.operating on <path> and that path is not the intendedcurrent project root, stop and ask the user to pick or create the root before any write.
maestro init --yes.maestro doctor.maestro install --agent codexunless the user asked for another agent.
repo root, and under each folder matched by the projects: globs in .maestro/harness/harness.yml, read AGENTS.md, CLAUDE.md, README.md, and top-level docs/*.md. Stay shallow (one level per location, no deep crawl) and skip outsized files (roughly 64 KB and up) so a vendored doc dump cannot flood context. With no projects: declared, this is the repo root alone.
per project (a single section when nothing is declared). This is read-in only: never write maestro-managed guidance into a sub-project's own AGENTS.md/CLAUDE.md -- maestro install/sync write managed blocks at the repo root alone. Cite the inspected files; do not tune from guesses.
maestro doctor, then maestro status.maestro init --dry-run writes nothing; use it before init writes.maestro init --yes keeps existing files and creates missing files.maestro sync --dry-run is the cheap already-initialized update check; do notrun broader setup read-in when it proves the setup is current and no doctor blocker remains.
maestro init --force only for deliberate refresh; it backs up managedfiles first.
memory.
maestro-managed guidance into a sub-project's AGENTS.md/CLAUDE.md.
maestro status.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.