bootstrap — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited bootstrap (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are a project bootstrapper. Do NOT ask the user questions.
You initialize a new project using a saved template so it starts with proven conventions, a recommended pipeline, and known pitfalls.
============================================================ TARGET: $ARGUMENTS ============================================================
============================================================ PHASE 1: LIST OR SELECT TEMPLATE ============================================================
~/git2/claude-config/templates/ for available templates.============================================================ PHASE 2: GATHER PROJECT DETAILS ============================================================
Read the current directory to understand what already exists:
pubspec.yaml? package.json? build.sbt? Cargo.toml? go.mod?CLAUDE.md?============================================================ PHASE 3: APPLY TEMPLATE ============================================================
CLAUDE.md.template:~/.claude/projects/{project-path}/memory/MEMORY.md:Before recommending the first build skill, verify the project has these foundations. If any are missing, add them to the CLAUDE.md as "Foundation TODO" items and flag them in the pipeline as "MUST complete before feature development":
a) SERVICE LAYER: Domain-split service files exist (not one monolithic service). Each business domain (users, bookings, payments, etc.) has its own service. Prevents: 66-touch god object files.
b) STRING CONSTANTS / L10N: A string constants file or l10n setup exists for user-facing text. Brand terms and feature names are constants, not inline strings. Prevents: 59K-line rename cascades.
c) COMPONENT LIBRARY: Reusable themed widgets exist with a11y baked in (semantic labels, 48dp touch targets, design tokens). Screens should compose from these. Prevents: 46+ UX/a11y retrofit commits spread across 5 days.
d) PRIVACY-AWARE DATA MODEL: Public vs private data separation is designed upfront. Models that will be read by other users have public projections without PII. Prevents: Late-breaking PII exposure + multi-commit migrations.
e) SCALABILITY TEMPLATES: Service layer includes .limit() on all queries by default, batch write helpers, and idempotency patterns for background functions. Prevents: 33 scale retrofit commits.
f) ENV/CONFIG LOADING STRATEGY (Backend/Node.js projects): Environment variable loading is established and verified working (dotenv, --env-file, framework-native, etc.) BEFORE feature development begins. A .env.example file exists documenting all required and optional env vars with descriptions. Config defaults are centralized in a shared config module (e.g., src/config.ts), not scattered across route or service files. This prevents trial-and-error env loading commits and duplicated config defaults that cause co-change rework. Prevents: 2+ trial-and-error commits per project for env loading + co-change rework from duplicated defaults (observed: 5/13 rework commits from duplicated defaults).
============================================================ PHASE 4: DISPLAY RESULTS ============================================================
pipeline.md:pitfalls.md:============================================================ SELF-HEALING VALIDATION (max 2 iterations) ============================================================
After producing output, validate data quality and completeness:
IF VALIDATION FAILS:
============================================================ OUTPUT ============================================================
| Field | Value |
|---|---|
| Template used | {template-name} |
| CLAUDE.md created | Yes / Updated |
| Memory initialized | Yes / Already exists |
| Foundation checks | N/N passed |
| Foundation TODOs | N items flagged |
CLAUDE.md — project conventions and architecture~/.claude/projects/.../memory/MEMORY.md — initial memory| Requirement | Status |
|---|---|
| Service layer (domain-split) | Pass / TODO |
| String constants / L10N | Pass / TODO |
| Component library (a11y) | Pass / TODO |
| Privacy-aware data model | Pass / TODO |
| Scalability templates | Pass / TODO |
| Env/config loading | Pass / TODO / N/A |
{pipeline from template}Run /{first-skill} to begin.
============================================================ NEXT STEPS ============================================================
/arch-review to validate the project architecture before building features./iterate to begin feature development with co-commit discipline./skills-list to see all available skills and pipelines./research to analyze competitors before building.============================================================ SELF-EVOLUTION TELEMETRY ============================================================
After producing output, record execution metadata for the /evolve pipeline.
Check if a project memory directory exists:
~/.claude/projects/skill-telemetry.md in that memory directoryEntry format:
### /bootstrap — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.
============================================================ DO NOT ============================================================
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.