init-profile — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited init-profile (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Capture project-specific facts that the SessionStart hook will inject every time. Pairs with the Environment Fingerprint block (host-level facts) by adding the Project Profile block (project-level facts).
Writes .claude/PROJECT_PROFILE.md with five sections, filled in interactively. The session-context.sh hook auto-loads this file on every SessionStart, so the agent has the facts upfront and stops guessing.
Without a profile, the agent re-discovers the same facts each session ("where does prod run?", "is this hostname local or remote?", "where are the env secrets?"). With a profile, those facts live in the system prompt from session 1.
CLAUDE.md (deployment URLs, commands).env, .env.example, .env.*.local, brands/*.local.envpackage.json, Dockerfile, docker-compose.yml, vercel.json, netlify.toml~/.profile / ~/.zshrc for project-specific env varsgit log for clues on dev workflowa. Hosts & topology
b. Service URLs
c. Secret/env file locations
d. Verification commands
gh api repos/x/y/actions/runs --jq '.workflow_runs[0].conclusion'e. Aliases the user uses for this project
brands/*.local.env) # Project Profile — <project name>
## Hosts
- <hostname>: <role> (this machine | remote)
- <hostname>: <role> (this machine | remote)
## URLs
- Production: <url>
- Local dev: <url(s)>
## Env / secrets
- <path>: <what's in it>
## Verify commands
- <env>: `<command>`
## Aliases
- "<phrase user uses>" → <what it actually maps to>.claude/PROJECT_PROFILE.md may contain internal hostnames or URLs that shouldn't be public — recommend .gitignore if the project is public..claude/PROJECT_PROFILE.md/init-profile.Environment Fingerprint block in session-context.sh — don't duplicate them here.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.