klaussy-init — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited klaussy-init (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<!-- Made with klaussy by Dovatech LLC. Creator: Stephanie Dover. © 2026 Dovatech LLC. Licensed under FSL-1.1-MIT: https://github.com/steph-dove/klaussy-agents/blob/main/LICENSE -->
Scaffold AI coding-agent boilerplate for the user's project by running klaussy. By default this covers every supported agent (Claude Code, Gemini CLI, Cursor, Codex, GitHub Copilot, Google Antigravity, Cline, Aider, opencode, and Kimi Code CLI) from a single shared set of conventions. Run klaussy init --help for the current list rather than trusting this sentence — backends get added.
klaussy --version. If the command isn't found, install with pipx install klaussy-agents (preferred) or pip install --user klaussy-agents. The PyPI distribution is klaussy-agents; klaussy is only the command it installs, and is not a package name. Re-verify with klaussy --version afterward.git branch --list dev develop main master | head -1 and pass --base-branch <detected>. If none of those exist, fall back to whatever git symbolic-ref refs/remotes/origin/HEAD returns, or main.$ARGUMENTS if the user supplied any (e.g. --force, --skip-enrich): klaussy init --base-branch <detected> $ARGUMENTSIf .claude/skills/ or ./CLAUDE.md already exists, ask the user whether to pass --force rather than assuming. The migration in klaussy init removes legacy .claude/commands/*.md files only if it owns them (via the .klaussy-version marker) — user-authored commands are left alone.
Not committing it? If the user wants klaussy for themselves without adding files to the repo (trying it on a team repo, say), pass --local. klaussy puts what it creates in .git/info/exclude instead of committing anything, and leaves committed files as they were.
Agent targets. By default klaussy scaffolds every supported agent from the same conventions; klaussy init --help lists them. Each gets its native conventions file (e.g. CLAUDE.md, GEMINI.md, AGENTS.md for Codex/Antigravity, .github/copilot-instructions.md, .cursor/rules/, .clinerules/conventions.md, CONVENTIONS.md for Aider), plus the bundled skills in its native skills directory and permissions — except Aider, which is conventions-only (it has no skills or hooks mechanism). To narrow to specific agents, pass --agents claude,gemini (any subset). If the user only uses Claude, suggest --agents claude.
.gemini/, .cursor/, .agents/ for Codex, .github/ for Copilot) plus its native conventions file. Confirm these landed:./CLAUDE.md at the repo root (with project-wide content).claude/rules/<glob-stem>.md for each path-scoped rule bucket klaussy-repo-conventions detected (zero or more files; some repos won't have any).claude/skills/<repo>-<skill>/SKILL.md — one directory per bundled skill (review, plan, debug, implement, and the rest). Count the directories rather than checking against a number quoted here; the set grows between releases..claude/settings.json.github/PULL_REQUEST_TEMPLATE.md (only if the repo didn't already have one).gitignore updated with klaussy output exclusions (with --local, .git/info/exclude instead, and git status shows none of the generated files)<repo>-plan and <repo>-review as the high-leverage ones), summarize what's in CLAUDE.md and any .claude/rules/*.md files, and suggest reviewing them before committing.klaussy init will be a near-no-op; suggest the klaussy-update skill instead if the user actually wants to refresh.klaussy-uninstall skill;init has no inverse of its own.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.