onboarding — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited onboarding (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Run these in parallel:
git log --oneline -10 # recent work — what's been happening
git branch -a # branches in flight
ls -la # root layout
cat README.md 2>/dev/null || echo "No README found"Then read:
AGENTS.md or .cursor/AGENTS.md if present — AI agent instructions specific to this project.cursor/rules/ — active Cursor rules (what the AI will and won't do here)CONTRIBUTING.md — team conventionsReport back: what the project does (one sentence), the main directories, and any rules or conventions you spotted.
git config user.name
git config user.email
git remote -v
git statusFlag if:
user.name or user.email is not set — commits will be anonymousorigin remote — pushes will fail silentlyCheck if the repo has branch protection by looking for:
.github/ directory (GitHub Actions / branch rules)CONTRIBUTING.md section on branchingTell the user:
main or masterfeature/<what>, fix/<what>, chore/<what>, docs/<what>git checkout -b feature/<your-task-description>These skills are available to you in this project. Use them by typing their name in Cursor:
| Skill | When to use |
|---|---|
pre-commit-check | Before every commit — catches secrets, debug code, bad messages |
commit-message | When you're unsure how to phrase a commit |
pr-summary | Before opening a PR — generates the description |
pr-review-canvas | When reviewing someone else's PR |
deslop | After a long AI session — removes noise from generated code |
document-this | When asked to document a function or module |
handoff | End of day or before switching tasks |
Before you open your first pull request:
main/master, not off another feature branchgit diff main...HEAD — confirm only your intended changes are includedpre-commit-check on every commitconsole.log, print(, debugger, or TODO left in production code.env or secrets stageddocker-compose I should run?"~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.