project-bootstrap-en — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited project-bootstrap-en (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
When the user describes a software project they want to build, produce a structured bootstrap plan covering:
Ask or infer:
Use this decision table:
| Task type | Recommended model size | Reason |
|---|---|---|
| Simple CLI, single command | 7B (e.g. qwen2.5-coder-7b) | Skills carry the knowledge |
| Python library, multi-module | 14B (e.g. qwen2.5-coder-14b) | Needs more reasoning across files |
| CLI with subcommands (git/podman style) | 14B-32B | Complex architecture decisions |
| New language / unfamiliar domain | 32B+ or cloud model | Less skill coverage available |
Key insight: the richer the skill library, the smaller the model can be. Skills compensate for model size by providing domain knowledge externally.
For a Python CLI tool with subcommands (like git or podman), recommend:
python-project-structure — src layout, pyproject.toml, hatchlingclick-cli — Click framework for subcommands, options, argumentspython-testing — pytest structure, fixtures, coveragegit-workflow — branch naming, commit conventions, PR flowdatetime-format — consistent timestamp format across the toolpython-logging — structured logging for CLI toolssemver-bump — version management for releasespypi-publish — packaging and publishing to PyPIpython-refactoring — code quality improvementdocker-containerfile — if the tool needs container supportgithub-actions-ci — CI/CD pipelineCheck available skills first:
aider-skills list ./skillsIf a needed skill is missing, create it:
mkdir -p skills/<skill-name>
# write SKILL.md following the agentskills spec
aider-skills validate skills/<skill-name>For a Python CLI with subcommands (example: mytool):
mytool/
├── .devcontainer/
│ └── maintainer/
│ ├── Containerfile
│ ├── devcontainer.json
│ └── scripts/
│ ├── build.sh
│ ├── run.sh
│ └── post-create.sh
├── .github/
│ └── workflows/
│ ├── ci.yml
│ └── publish.yml
├── src/
│ └── mytool/
│ ├── __init__.py
│ ├── cli.py ← click group + subcommands
│ ├── commands/
│ │ ├── __init__.py
│ │ ├── init.py ← mytool init
│ │ ├── run.py ← mytool run
│ │ └── status.py ← mytool status
│ └── core/
│ ├── __init__.py
│ └── engine.py ← business logic, separate from CLI
├── tests/
│ ├── __init__.py
│ ├── test_cli.py
│ └── test_engine.py
├── skills/ ← project-local skills
│ └── mytool-conventions/
│ └── SKILL.md
├── pyproject.toml
├── README.md
├── CHANGELOG.md
└── LICENSEGenerate the skeleton in this order:
# 1. Start aider with all needed skills
aider --read $(aider-skills tmpfile ./skills)
# 2. Ask aider to scaffold
# "Create the pyproject.toml and cli.py skeleton for a Click CLI
# called mytool with subcommands: init, run, status"
# 3. Validate
aider-skills validate ./skills/mytool-conventions
# 4. Run first tests
pytest --tb=shortAfter the project skeleton exists, ask aider to analyse the architecture and generate a project-local conventions skill automatically.
Start aider with the skills:
aider --read $(aider-skills tmpfile ./skills)Then ask:
Analyse the architecture of this project and generate
skills/<projectname>-conventions/SKILL.md capturing:
- Key architecture decisions and layer responsibilities
- Coding patterns and conventions used in this project
- Error handling approach
- Testing approach and mocking patterns
- Code style rules
Follow the agentskills spec: YAML frontmatter with name and description,
then markdown instructions.Then validate the generated skill:
aider-skills validate ./skills/<projectname>-conventionsThe conventions skill becomes the permanent memory of architecture decisions for this project. Every future aider session loads it automatically:
aider --read $(aider-skills tmpfile ./skills)Any contributor — human or AI — works within the same conventions from the first message, without reading the whole codebase first.
Goal: build a CLI tool called 'kontainer' with subcommands:
kontainer build → build a container image
kontainer run → run a container
kontainer ps → list running containers
kontainer stop → stop a container
Platform: Linux, Python, wrap podman underneathRecommended model: qwen2.5-coder-14b (subcommand architecture needs reasoning)
Skills needed:
click-cli (subcommand routing)python-project-structure (src layout)python-subprocess (wrapping podman commands)python-testing (mock subprocess calls)semver-bump + pypi-publish (release)First aider prompt:
Create a Click CLI called 'kontainer' with four subcommands:
build, run, ps, stop. Each subcommand should call the equivalent
podman command via subprocess. Follow src layout with pyproject.toml.This skill itself is a Level 2 cascading skill — it references and composes other skills rather than implementing directly. It is a planning skill, not an execution skill.
The agent reads this skill, builds a plan, then activates each referenced skill in sequence to implement the solution.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.