gen-ci — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited gen-ci (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are the gen-ci skill. You generate a GitHub Actions CI workflow that mirrors the project's quality gates (lint, typecheck, test) based on the detected stack and nyann profile.
DO NOT trigger on: general questions about CI/CD concepts, debugging existing workflows not managed by nyann, or requests to modify workflows outside nyann markers.
bin/detect-stack.sh --path . to get a StackDescriptor JSON.bin/load-profile.sh <name>(resolves preferences → CLAUDE.md markers → "default" fallback).
bin/gen-ci.sh --profile <profile> --stack <stack> --target . --dry-run to preview the generated workflow.If the profile has a governance block, or if the user mentioned "governance", "health check", or "drift check", offer to also generate the governance-check workflow:
"Also generate a governance check that runs doctor on every PR and posts a health report comment? (adds governance-check.yml)"If the user accepts (or originally asked for it), add --governance to the gen-ci.sh invocation.
.github/workflows/ci.yml?" bin/gen-ci.sh --profile <profile> --stack <stack> --target . [--governance]--governance)./nyann:gen-templates to add PR and issue templates"/nyann:doctor to check overall repo health"governance block to yourprofile to customize threshold and severity"
# nyann:ci:start / # nyann:ci:end). Regeneration replaces only the marked region; user content outside markers is preserved.ci.enabled: false, explain that CI generation is disabled in the profile and offer to enable it..github/workflows/ci.yml already exists with nyann markers, inform the user it will be regenerated (not duplicated)..github/workflows/ci.yml exists WITHOUT markers, the script refuses by default — it warns and skips so user-written CI isn't accidentally clobbered. Pass --allow-merge-existing to gen-ci.sh to opt in to appending the marked block (existing content is preserved above the markers). Suggest manual cleanup either way if the result isn't what the user wants.generic.yml template, warn that lint/test steps are placeholdersdefault profile (CI disabled by default — offer to enable)templates/ci/ directoryThe --governance flag generates .github/workflows/governance-check.yml:
bin/doctor-ci.sh on every PR against base branchesgovernance.threshold (default 70)Profile governance configuration (optional — all fields have defaults):
{
"governance": {
"enabled": true,
"threshold": 70,
"severity": "block",
"ignore": ["orphans", "stale"]
}
}| Field | Default | Effect |
|---|---|---|
enabled | true | Set false to disable governance check generation |
threshold | 70 | Minimum health score (0-100) to pass the gate |
severity | "block" | block = fail check; warn = annotate only; off = skip |
ignore | [] | Categories excluded from score (e.g. orphans, stale) |
gen-templates skill.doctor skill.gh-protect skill.governance block.commit skill, then ship skill.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.