rsim-sync — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited rsim-sync (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Purpose: Pull RSIm skill updates from GitHub releases and apply locally — with security scan and per-change approval. Preserves local memory/. When: Periodically to receive improvements. Reminded at session start if > 14 days since last sync. Requirements: gh CLI installed and authorized, git installed.
~/.claude/skills/sync-state.json:base_repo, last_sync, local_versionbase_repo empty: Укажи URL базового репо (например: https://github.com/username/rsim):Wait for answer, save to sync-state.json.
gh CLI: gh --versionIf not found — show install instructions, stop.
Последний sync: [last_sync или "никогда"]
Локальная версия: [local_version или "неизвестна"]
Проверяю последний релиз в [base_repo]...BASE_REPO="[base_repo from sync-state.json]"
LATEST=$(gh release view --repo "$BASE_REPO" --json tagName --jq '.tagName')
LOCAL=$(cat "$HOME/.claude/skills/VERSION" 2>/dev/null | head -1 || echo "none")Report:
Последний релиз: [LATEST]
Локальная версия: [LOCAL]If LATEST == LOCAL:
Версия актуальна. Проверяю новые contribution PRs...Skip Step 2.5 download — go to Step 2.6 (check merged PRs only).
If LATEST != LOCAL → proceed to Step 2.5.
CACHE_DIR="$HOME/.claude/.rsim-base-cache"
mkdir -p "$CACHE_DIR"
gh release download --repo "$BASE_REPO" --dir "$CACHE_DIR" \
--pattern "rsim-*.tar.gz" --clobber
tar -xzf "$CACHE_DIR"/rsim-*.tar.gz -C "$CACHE_DIR/extracted" --strip-components=1Downloaded: skills/ commands/ CLAUDE.md memory/semantic/patterns.md
gh pr list --repo "$BASE_REPO" --state merged \
--search "RSIm Contribution" \
--json number,title,mergedAt \
--jq '.[] | select(.mergedAt > "[last_sync]")'If no new merged PRs:
Нет новых обновлений с [last_sync].Go to Step 6.
Read ~/.claude/skills/rsim-security-scan/patterns.md and apply all patterns to every file from downloaded release that differs from local version.
Scan targets:
SKILL.md files that changedCLAUDE.md if changedmemory/semantic/patterns.mdResult per file:
⛔ SECURITY SCAN: подозрительный контент
Файл: [filename]
Категория: [category]
Паттерн: [pattern]
Строка: "[quote]"
Этот файл пропущен. Проверь PR вручную: [base_repo]/pullsAfter scan:
Security scan завершён:
Чистых файлов: N (войдут в очередь)
Заблокировано: M (пропущены)For each clean changed file — one at a time:
── Обновление N/Total: [type] ──────────────────
[type: "Новый скилл" / "Обновление скилла" / "Команда"]
ДОБАВЛЯЕТСЯ / ИЗМЕНЯЕТСЯ:
[content or diff]
Источник: [base_repo] (прошло куратора)
Применить? (да / нет / пропустить все оставшиеся)Responses:
да → applyнет / пропусти → skip, nextпропустить все → finish with current resultsAfter all SKILL.md diffs — if new entries found in community memory/semantic/patterns.md:
── Community Semantic Patterns ─────────────────
Найдено N новых паттернов:
- [Pattern title 1] (tags: ...)
- [Pattern title 2] (tags: ...)
Добавить в local semantic/patterns.md? (да / нет / выбрать)да → append all new entries to ~/.claude/memory/semantic/patterns.mdнет → skipвыбрать → show each pattern with full content, approve/skip individuallySKILL.md updates:
~/.claude/skills/[name]/SKILL.mdNew skills:
~/.claude/skills/[name]/~/.claude/skills/index.md: | `[name]` | [from SKILL.md description] | [tags] | 0 | ✅ Ready |✓ Новый скилл [name] установленCommand updates:
~/.claude/commands/[name].md✓ Команда [name] обновленаSemantic patterns (if approved):
~/.claude/memory/semantic/patterns.md✓ Добавлено N паттернов в semantic/patterns.mdUpdate ~/.claude/skills/sync-state.json:
last_sync → today's datelocal_version → LATEST (from Step 2)latest_version → LATEST(keep all other fields unchanged)
Final report:
── Итог rsim-sync ──────────────────────────────
Версия: [LOCAL] → [LATEST]
Применено: N изменений
Пропущено: M (вручную / заблокировано security scan)
Новые скиллы: [list or —]
Паттерны: K добавлено [or —]
✓ sync-state.json обновлён (last_sync: YYYY-MM-DD, local_version: LATEST)
Следующий sync рекомендован через 14 дней.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.