skainet-consumer-setup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skainet-consumer-setup (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Add SKaiNET to a Gradle project that does NOT live inside the SKaiNET repo. Centred on the BOM and the artifact picker so consumers don't end up hand-pinning every transitive version.
skainet-io-* or skainet-data-* artifact because you discovered you need it (e.g. ONNX support).libs.versions.toml of a consumer project to register SKaiNET artifacts.SKaiNET/build.gradle.kts, SKaiNET/settings.gradle.kts, SKaiNET/gradle/libs.versions.toml) — that's the contributor gradle-multimodule skill.skainet-data-dsl / skainet-nn-dsl.skainet-android-integration.skainet-java-consumer (the Maven coordinates are similar but the JVM toolchain notes differ).implementation(platform("sk.ainet:skainet-bom:<VERSION>")) (or the catalog-accessor equivalent) and depend on sk.ainet.core:skainet-* artifacts WITHOUT specifying versions. Hard-pinning per-artifact versions silently lets transitives drift.sk.ainet.core.sk.ainet.core:skainet-lang-core provides the DSL and types; sk.ainet.core:skainet-backend-cpu provides the default CPU runtime. Without the backend, DirectCpuExecutionContext.create() won't resolve.gradle/libs.versions.toml MUST register SKaiNET there too. Mixing styles inside one project is forbidden..jar is compiled for JVM 11. Configuring the consumer below 11 fails at link time.0.20.0-SNAPSHOT) only if the consumer explicitly opts in to the snapshot repo.libs.versions.toml and to the consuming module(s).-SNAPSHOT version) — maven("https://central.sonatype.com/repository/maven-snapshots/")../gradlew :app:test).| You want to … | Add (in addition to skainet-lang-core + skainet-backend-cpu) |
|---|---|
| Define networks and tensors only (no model files yet) | nothing else |
| Load a GGUF model | skainet-io-core + skainet-io-gguf |
| Load an ONNX model | skainet-io-core + skainet-io-onnx |
| Load SafeTensors weights | skainet-io-core + skainet-io-safetensors |
| Decode images for input pipelines | skainet-io-image |
| Use built-in datasets (MNIST, etc.) | skainet-data-simple |
Build preprocessing pipelines (pipeline().rescale().normalize()) | skainet-data-transform |
| Compile a DAG to StableHLO / C99 | skainet-compile-core + skainet-compile-hlo (StableHLO) or skainet-compile-c |
| Run a higher-level pipeline framework | skainet-pipeline |
| Use the YOLO model topology helpers | skainet-model-yolo |
| Test with the in-repo assertion library (rare for consumers) | skainet-test-groundtruth |
The full BOM-managed artifact list lives in references/bom-coordinates.md.
Kotlin DSL with version catalog (recommended):
# gradle/libs.versions.toml (in your consumer project)
[versions]
skainet = "0.20.0-SNAPSHOT" # or the latest stable
[libraries]
skainet-bom = { module = "sk.ainet:skainet-bom", version.ref = "skainet" }
skainet-lang-core = { module = "sk.ainet.core:skainet-lang-core" }
skainet-backend-cpu = { module = "sk.ainet.core:skainet-backend-cpu" }
skainet-io-gguf = { module = "sk.ainet.core:skainet-io-gguf" }
skainet-data-transform = { module = "sk.ainet.core:skainet-data-transform" }// app/build.gradle.kts
dependencies {
implementation(platform(libs.skainet.bom))
implementation(libs.skainet.lang.core)
implementation(libs.skainet.backend.cpu)
implementation(libs.skainet.io.gguf)
implementation(libs.skainet.data.transform)
}Inline form (acceptable only if the project is already inline-style throughout):
dependencies {
implementation(platform("sk.ainet:skainet-bom:0.20.0-SNAPSHOT"))
implementation("sk.ainet.core:skainet-lang-core")
implementation("sk.ainet.core:skainet-backend-cpu")
implementation("sk.ainet.core:skainet-io-gguf")
}Snapshot repo (only when the version ends in `-SNAPSHOT`):
// settings.gradle.kts in your consumer project
dependencyResolutionManagement {
repositories {
mavenCentral()
maven("https://central.sonatype.com/repository/maven-snapshots/") {
content { includeGroupByRegex("sk\\.ainet.*") }
}
}
}KMP consumer adding SKaiNET to common code:
// app/build.gradle.kts (KMP module)
kotlin {
jvm()
androidTarget()
iosArm64()
sourceSets {
commonMain.dependencies {
implementation(platform(libs.skainet.bom))
implementation(libs.skainet.lang.core)
}
jvmMain.dependencies {
// Backend is JVM-only by default; for KMP you can use it
// wherever the JVM (or Android) target compiles.
implementation(libs.skainet.backend.cpu)
}
androidMain.dependencies {
implementation(libs.skainet.backend.cpu)
}
}
}../skainet-data-dsl/SKILL.md.sequential / dag — ../skainet-nn-dsl/SKILL.md.../skainet-model-loading/SKILL.md.ExecutionContext for inference — ../skainet-inference/SKILL.md.../skainet-android-integration/SKILL.md.../skainet-java-consumer/SKILL.md.// WRONG — pinning per-artifact versions, no BOM
implementation("sk.ainet.core:skainet-lang-core:0.20.0-SNAPSHOT")
implementation("sk.ainet.core:skainet-io-gguf:0.19.0") // drift waiting to happen// RIGHT — BOM manages all SKaiNET versions in one place
implementation(platform("sk.ainet:skainet-bom:0.20.0-SNAPSHOT"))
implementation("sk.ainet.core:skainet-lang-core")
implementation("sk.ainet.core:skainet-io-gguf")// WRONG — wrong group for the BOM
implementation(platform("sk.ainet.core:skainet-bom:0.20.0-SNAPSHOT"))// RIGHT — BOM lives at sk.ainet, libraries at sk.ainet.core
implementation(platform("sk.ainet:skainet-bom:0.20.0-SNAPSHOT"))
implementation("sk.ainet.core:skainet-lang-core")// WRONG — only lang-core, no backend
dependencies {
implementation(platform(libs.skainet.bom))
implementation(libs.skainet.lang.core)
// DirectCpuExecutionContext.create() will not resolve
}// RIGHT — pair lang-core with at least one backend
dependencies {
implementation(platform(libs.skainet.bom))
implementation(libs.skainet.lang.core)
implementation(libs.skainet.backend.cpu)
}// WRONG — JVM target below 11
kotlin { jvmToolchain(8) }// RIGHT — JVM 11 minimum
kotlin { jvmToolchain(11) } // 17 or 21 also finereferences/bom-coordinates.md — every artifact in sk.ainet:skainet-bom, with the consumer-facing sk.ainet.core:* Maven coordinate and a one-liner on what each provides.references/artifact-picker.md — decision tree for "I need to do X, what artifacts do I add?".~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.