ship-demo — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ship-demo (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Make a project demo-ready: a seed that fills it with realistic, obviously-fake data, plus a script that walks someone through the product so it lands. Two deliverables that depend on each other — the script clicks through the records the seed creates, so a demo looks the same every run and never lands on an empty screen.
The point is a told story, not a feature dump. A handful of complete, wired-together records (a real-looking project with its tasks, files, money, and people) beats ten thousand random rows.
ship-demo → seed data + live-demo script ← you are here
user-guide-builder → the written guide the demo mirrors
shipping-log → "what's new" the demo can show off
screenshot-capture → can shoot the seeded screens for docs
logo-pack → the brand the script + page are themed with
all themed by docs/brand.json · versioned by docs/VERSIONOutputs go under the project's docs/. After seeding, offer to run screenshot-capture against the freshly-seeded app (the demo data makes for great doc screenshots), and user-guide-builder so the guide and the demo describe the same flows.
node <skill-dir>/scripts/discover-model.mjs --jsonIt reports: the ORM/data layer, schema files, model/table names, any existing seed script, prior demo docs (docs/demo/script.md, docs/DEMO-LOGINS.md), docs/brand.json, docs/VERSION, the package manager, and detected db:* scripts. Read it before doing anything.
guess — a wrong seed against a real DB is worse than none.
columns, required fields, enums, and foreign keys. Pick the adapter and the idempotency strategy from references/seed-adapters.md (Drizzle / Prisma / SQL+Supabase / TypeORM / Sequelize / Mongoose / API-only / unknown).
handling reality.
dashboards aren't barren. Wire records together so navigation and links work.
scripts/fake.mjs for all values (stable ids, @example.test emails, (555) phones — so data is reproducible AND obviously fake). The seed MUST:
is_demo flag, or the@example.test domain) and only ever touch that namespace.
transaction. Add a --reset path that clears only the demo namespace.
seed:demo package script) and capture logins indocs/DEMO-LOGINS.md (demo password or env var — never a real credential).
proves idempotency. Fix any duplication before moving on. If you can't reach the DB, say so and hand the user the exact command.
(sequencing, voice, the exact markdown contract), write docs/demo/script.md: a hook → core loop → wow moment → live-create → value-close walkthrough, each step mapped to a real seeded record, with Go to / Say / Show / Reset lines and an operator's appendix (accounts, reset command, failure recovery, timing).
node <skill-dir>/scripts/render-demo.mjs # docs/demo/script.md → docs/demo/script.htmlSelf-contained, keyboard-navigable, themed from docs/brand.json (default slate-blue, never purple; no backdrop-filter / no feTurbulence). Print-to-PDF gives a handout.
and the two output paths. Flag anything you stubbed, any field you guessed, and any feature in the script that is staged rather than shipped.
fake.mjs(@example.test, 555 numbers, fictional streets). Never scrape, copy, or invent a real person's name, email, address, or a real customer's data into the seed. If the repo already has demo data, reuse its conventions — don't introduce a second, conflicting fake-identity set.
fails this bar.
product, with deliberate happy-path AND edge cases — not lorem-ipsum sprinkled across tables.
give the demo. Every step points at a record the seed actually created.
what was guessed or stubbed. No claim that un-run seeds or un-shipped features work.
read — not a generic template. If you couldn't verify the persistence layer, you stopped and asked rather than shipping a plausible-but-wrong seed.
Nothing here is hardcoded to one app. discover-model.mjs and fake.mjs are generic; seed-adapters.md covers the common ORMs and a fallback for unknown layers. External tools are referenced via adapters (the project's own db client, its db scripts, or its API/MCP) and never assumed installed — if a layer can't be reached, the skill asks instead of fabricating.
scripts/discover-model.mjs — bounded, read-only scanner: ORM, schema files, models, existingseed/demo work, brand/version, db scripts. Run it first, JSON or human output.
scripts/fake.mjs — deterministic, dependency-free fake-data helpers (stable ids, fictionalpeople/companies/addresses, money in cents, date offsets). Import it into the seed; it has a node fake.mjs <seed> self-test.
scripts/render-demo.mjs — renders docs/demo/script.md → a themed, self-contained,keyboard-navigable presenter HTML page.
references/seed-adapters.md — per-ORM read + idempotent-upsert playbook and thedepth-over-breadth dataset guidance.
references/script-template.md — demo-script sequencing, voice, the markdown contractrender-demo.mjs consumes, and a full worked input→output example.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.