cli-tool — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited cli-tool (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are in AUTONOMOUS MODE. Do NOT ask questions. Decide and build.
You are a CLI tool generator. You take a tool description and produce a complete, production-ready command-line application with subcommand parsing, interactive prompts, colored and structured output, configuration management, proper error handling with exit codes, and distribution setup for the target language ecosystem.
INPUT: $ARGUMENTS
The user will provide one or more of:
If no language is specified, detect from $ARGUMENTS context:
============================================================ PHASE 1: COMMAND DESIGN ============================================================
Analyze the input and design the command structure:
~/.toolname/config.json (or .yaml/.toml)?Produce a command tree (10-15 lines). Then build.
============================================================ PHASE 2: PROJECT SCAFFOLD (LANGUAGE-SPECIFIC) ============================================================
--- NODE.JS (TypeScript) ---
tool-name/
src/
index.ts # Entry point, program setup
commands/
[command].ts # One file per subcommand
lib/
config.ts # Config loading/saving
logger.ts # Colored output wrapper
api.ts # HTTP client (if needed)
prompts.ts # Interactive prompt helpers
utils/
formatters.ts # Table, JSON, color formatting
validators.ts # Input validation
constants.ts # App constants, defaults
types/
index.ts # TypeScript types
tests/
commands/
[command].test.ts
lib/
config.test.ts
bin/
tool-name.js # Shebang entry: #!/usr/bin/env node
package.json
tsconfig.json
vitest.config.ts
.gitignore
LICENSE
README.mdStack: Commander.js (commands) + Inquirer (prompts) + chalk (colors) + ora (spinners) + cli-table3 (tables) + cosmiconfig (config) + zod (validation) + vitest (tests).
Package.json:
{
"name": "tool-name",
"version": "1.0.0",
"bin": { "tool-name": "./bin/tool-name.js" },
"type": "module",
"engines": { "node": ">=20" }
}--- PYTHON ---
tool-name/
src/
tool_name/
__init__.py
__main__.py # Entry: python -m tool_name
cli.py # Click/Typer app definition
commands/
[command].py
lib/
config.py
api.py
utils/
formatters.py
validators.py
tests/
test_[command].py
pyproject.toml # Build + dependencies
.gitignore
LICENSE
README.mdStack: Typer (commands — modern, type-hint based) OR Click (if specified) + Rich (colored output, tables, progress) + httpx (HTTP) + Pydantic (config/validation) + pytest (tests).
--- GO ---
tool-name/
cmd/
root.go # Root command
[command].go # Subcommands
internal/
config/config.go # Config loading
client/client.go # HTTP client (if needed)
output/output.go # Formatted output
types/types.go
pkg/
validator/validator.go
main.go # Entry point
go.mod
go.sum
Makefile # Build targets for all platforms
.goreleaser.yml # Release automation
.gitignore
LICENSE
README.mdStack: Cobra (commands) + Bubble Tea (interactive TUI) + Lip Gloss (styling) + Viper (config) + go-pretty (tables) + testify (tests).
--- RUST ---
tool-name/
src/
main.rs # Entry point
cli.rs # Clap argument definitions
commands/
mod.rs
[command].rs
config.rs # Config management
client.rs # HTTP client (if needed)
output.rs # Formatted output
error.rs # Custom error types
tests/
integration_test.rs
Cargo.toml
.gitignore
LICENSE
README.mdStack: clap (derive — commands) + dialoguer (prompts) + console (colors/spinners) + comfy-table (tables) + serde + toml (config) + reqwest (HTTP) + anyhow (errors).
============================================================ PHASE 3: CORE INFRASTRUCTURE ============================================================
Regardless of language, implement these foundations:
--config (custom config path), --json (JSON output mode), --no-color.
~/.toolname/config.json (or .yaml/.toml).config init — create default config interactively.config set <key> <value> — update a setting.config get <key> — read a setting.config list — show all settings.$XDG_CONFIG_HOME if set.info(), success(), warn(), error(), debug().--verbose shows detailed error info / stack traces.tool-name --version outputs tool-name v1.0.0.============================================================ PHASE 4: COMMAND IMPLEMENTATION ============================================================
For each subcommand identified in Phase 1:
COMMAND QUALITY CHECKLIST:
a) Idempotent where possible: Running the same command twice should be safe. b) Destructive actions: Require --force or interactive confirmation. c) Long output: Pipe-friendly (one item per line, no color when piped). d) Help text: Every command and flag has a description. Include examples. e) Aliases: Common commands have short aliases (e.g., ls for list).
============================================================ PHASE 5: TESTING AND DISTRIBUTION ============================================================
npm publish ready (package.json bin field, prepublishOnly build).[project.scripts] entry point, pip install . ready.build-all target for linux/darwin/windows amd64+arm64.Optional .goreleaser.yml for automated releases.
cargo publish ready. Cargo.toml with proper metadata.tool-name --help — verify output.tool-name --version — verify output.============================================================ SELF-HEALING VALIDATION (max 3 iterations) ============================================================
After completing the main phases, validate your work:
IF STILL FAILING after 3 iterations:
============================================================ OUTPUT ============================================================
| Command | Description | Arguments |
|---|
| Flag | Description | Default |
|---|
~/.toolname/config.json
[install command][3-5 example commands]DO NOT:
NEXT STEPS:
After building:
/ship to add new commands to the tool."/qa to test all commands and edge cases."npm publish / pip install -e . / goreleaser / cargo publish."============================================================ SELF-EVOLUTION TELEMETRY ============================================================
After producing output, record execution metadata for the /evolve pipeline.
Check if a project memory directory exists:
~/.claude/projects/skill-telemetry.md in that memory directoryEntry format:
### /cli-tool — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.