adopt-project — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited adopt-project (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<!-- Mirrors ADOPT.md in the agent-starter repo. If ADOPT.md changes, update this skill to match. -->
Use on an existing codebase. Never on a green field - that's /new-project.
An existing project has state to audit, every change is potentially destructive, and adoption must be incremental. So the flow is audit-first, merge-don't-overwrite, opt-in per component.
git checkout -b adopt/agent-starter.Everything below is reversible by dropping the branch.
the developer wrote.
present). A red suite means stop and surface it.
non-invasive tier only.
never resolve them silently.
Ask one at a time:
memory / lint configs / code patterns / "audit first, then decide")
~/code/agent-starter(only needed if files will be copied).
Build a gap report before proposing anything.
Detect the stack:
package.json + tsconfig.json → TypeScript/JavaScriptpyproject.toml / setup.py / requirements.txt → PythonInventory (present as a table: component | what exists | starter offering | conflicts):
biome.json, Prettier;ruff (ruff.toml or [tool.ruff] in pyproject), mypy/pyright configs
tailwindcss 4.x in package.json dependencies,or a shadcn components.json. Either one makes the project a candidate for the @shadcn/lint fragment (Tier 3). Record the ESLint major.minor while here: the plugin needs 9.30+.
CLAUDE.md, CLAUDE.local.md, .claude/rules/, AGENTS.md.claude/settings.json hook entries; agent-starter hooks alreadyinstalled system-wide (~/.claude/hooks/.agent-starter-version - record the stamped version to compare against the repo VERSION)
~/.claude/skills/{commit,commit-push-pr,simplify,remember,dream,new-project,adopt-project,reflect}. Hooks and skills are user-global, so anything already installed already covers this project - don't re-propose it.
package.json scripts.test, pytest/tox config, Makefile targetsbash <repo-path>/hooks/check-codebase-health.shfrom the project root, or find src -name '*.ts' -o -name '*.py' | xargs wc -l | sort -rn | head -20
types? (grep for scattered process.env / os.environ, raw throw new Error / raise Exception)
Present the menu grouped by invasiveness, with per-item conflict notes from the audit. Wait for explicit approval per item (or "all of tier N"). Nothing is applied unapproved.
version matches the repo VERSION) - they're user-global and already cover this project. If stale, offer to update by re-running bash <repo-path>/install.sh (idempotent). Otherwise run it now: it installs to ~/.claude/hooks/ and merges the settings.json wiring with jq. Note for the developer: hooks are user-global - they will also fire in their other projects.
<repo-path>/skills/ to ~/.claude/skills/; leave already-present skills as-is (for s in ...; do [ -d ~/.claude/skills/$s ] || cp -r <repo-path>/skills/$s ~/.claude/skills/; done).
mkdir -p .harness/reflections && echo '.harness/ledger.jsonl' >> .gitignore
/reflect reads it.<repo-path>/templates/CLAUDE.md, fill in projectname and description.
Git Safety, Implementation Notes, Self-improvement loop. Read the existing file first; if its instructions contradict a starter section, list the contradictions and let the developer choose. The diff must show additions only.
TypeScript:
templates/biome.jsonc + templates/eslint.config.mjsfrom the repo, install deps (see AGENT.md step 4 there), run on the codebase, and report the damage. Where existing code fails a rule en masse, downgrade that rule to warn with a ratchet note instead of fixing hundreds of violations in the adoption branch.
correctness rules from guides/lint-rules-for-ai.md into their config, or (b) migrate to the starter flat config, carrying their custom rules over.
adopt the ESLint half only.
templates/eslint.shadcn.mjs + npm i -D @shadcn/lint, spread into their flat config as ...shadcnRules. Adapt settings.shadcn.ui and the **/components/ui/** override to where their components live. Existing ESLint below 9.30 has to be upgraded first. Run it on the codebase and downgrade rules that fail en masse to warn with a ratchet note, same as the base config.
Python:
templates/ruff.toml +templates/pyrightconfig.json, run ruff check, report counts per rule family, and downgrade noisy families per-project rather than mass-fixing.
select/ignorelists into pyproject. Do not drop a standalone ruff.toml next to it - ruff.toml silently takes precedence and their existing config stops applying.
disagree with each other more than they catch for each other.
Foundation templates (both stacks): copy only where the pattern is absent
env.ts / env.py), error registry (errorIds.ts /error_ids.py), truncator (truncate-for-context.ts / truncate_for_context.py). Adapt import paths to the project's layout. Skip any the project already has an equivalent for.
Write .claude/rules/starter-patterns.md with apply-on-touch guidance:
# Starter patterns - apply on touch
Apply these when already editing the relevant code. Never as a bulk refactor.
- Editing a file over 300 lines → split per the file-size hook's suggestions
(types / constants / validation / utils).
- Touching a `throw` / `raise` site → route it through the error registry
(`guides/error-id-registry.md`).
- Changing a fallible function's signature → consider returning a Result
(`guides/discriminated-union-results.md`).
- Touching an env read → move it behind the env boundary
(`guides/zod-at-the-boundary.md`).
- Adding a long-running operation → thread cancellation through it
(`guides/abort-signal-threading.md`).
- Adding a new tool → use the directory-per-tool layout
(`guides/tool-authoring-pattern.md`).Explicitly out of scope: restructuring directories, rewriting existing error handling, or converting APIs wholesale. The starter's layout is a target for new code, not a migration mandate.
Execute the approved items tier by tier, in tier order. After each Tier 3 item, run the project's lint and tests; stop on red. One commit per component, so the developer can drop any single adoption from the branch.
Confirm each item before reporting done:
.harness/ledger.jsonl gitignored, if the loop was adopted(in CLAUDE.md or the implementation notes)
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.