setup-knowledge-base — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited setup-knowledge-base (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Interactive setup that creates a structured, evidence-backed knowledge base in your project.
Ask the user (one question at a time, use AskUserQuestion):
Example category suggestions by domain:
Before creating anything, present the plan to the user:
I'll create this structure in your project:
kb/
.kb-config.yaml
index.md
scopes/
_default.yaml
README.md
{category1}/
{category2}/
{category3}/
scripts/
kb-index.py
kb-verify.py
kb-validate.py
kb-search.py
CLAUDE.md (or append to existing)
Ready to proceed?Wait for user confirmation.
Read the template files from this plugin and adapt them for the user's project:
templates/kb/.kb-config.yaml from this plugin. Create kb/.kb-config.yaml in the user's project, replacing the placeholder categories with the ones chosen in Step 1. Replace {{today}} with today's date.templates/kb/index.md from this plugin. Create kb/index.md, adding seed keywords for each chosen category. For example, if the user chose "security" and "technical", add initial keyword entries: | encryption, certificates, access | security/ |
| API, architecture, deployment | technical/ |templates/kb/scopes/_default.yaml from this plugin. Copy to kb/scopes/_default.yaml.templates/kb/scopes/README.md from this plugin. Copy to kb/scopes/README.md.kb/{category1}/, kb/{category2}/, etc.scripts/kb-index.py from this plugin. Copy to scripts/kb-index.py in the user's project.scripts/kb-verify.py from this plugin. Copy to scripts/kb-verify.py in the user's project.scripts/kb-validate.py from this plugin. Copy to scripts/kb-validate.py in the user's project.scripts/kb-search.py from this plugin. Copy to scripts/kb-search.py in the user's project.Read templates/CLAUDE.md from this plugin. Create (or append to existing) CLAUDE.md in the user's project root. Replace {{category}} placeholders with the actual categories chosen in Step 1.
The KB structure is ready, but empty. Ask the user:
"Do you have existing knowledge sources you'd like to import? (Notion pages, Slack channels, Confluence, local files)"
/kb-refresh to populate the KB from those sources. It handles source discovery, scraping, and entry creation.templates/kb/example/sample-entry.md from this plugin for the format, but write an entry relevant to the user's domain rather than copying the sample.Run the index script to confirm everything is wired up:
python3 scripts/kb-index.pyRegenerate the "All Files by Category" section of kb/index.md from the current entries:
python3 scripts/kb-index.py --writeValidate KB health (frontmatter, categories, related links):
python3 scripts/kb-validate.pyIf kb-index.py lists the entries and kb-validate.py reports "All entries valid", setup is complete.
Tell the user:
kb/{category}/ folder; nested sub-folders like kb/security/access/ are supported)/kb-answer)/kb-import)/kb-refresh)python3 scripts/kb-index.py)python3 scripts/kb-search.py "keyword")~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.