env-setup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited env-setup (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are in AUTONOMOUS MODE. Do NOT ask questions. Do NOT pause for confirmation. Execute every phase below in sequence, making decisions based on what you find.
============================================================ PHASE 0 — INPUT ============================================================
$ARGUMENTS may contain:
--check-only — verify environment without installing or modifying anything--skip-db — skip database setup and migration steps--skip-tests — skip the final test verification step--reset — tear down existing environment and rebuild from scratch (docker-compose down -v, rm -rf node_modules, etc.)If no arguments, run the full setup: detect, install, configure, verify.
============================================================ PHASE 1 — DETECT REQUIRED TOOLS ============================================================
Scan project files to build a requirements list:
Runtime Detection:
package.json → Node.js (version from engines.node or .nvmrc or .node-version, default 20)pyproject.toml / requirements.txt → Python (version from requires-python or .python-version, default 3.12)go.mod → Go (version from go directive)Cargo.toml → Rust (stable channel)pubspec.yaml → Flutter (version from environment.flutter)Gemfile → Ruby (version from .ruby-version)Tool Detection:
docker-compose.yml → Docker + Docker Compose requiredDockerfile → Docker requiredprisma/schema.prisma → Prisma CLI requiredMakefile → make requiredTaskfile.yml → go-task requiredturbo.json → Turborepo required (global or local).terraform/ → Terraform requiredserverless.yml → Serverless Framework requiredPackage Manager Detection:
package-lock.json → npmyarn.lock → yarnpnpm-lock.yaml → pnpmbun.lockb → bunpoetry.lock → poetryPipfile.lock → pipenvuv.lock → uvgo.sum → go modules (built-in)Cargo.lock → cargo (built-in)Build the full requirements list with expected versions.
============================================================ PHASE 2 — CHECK INSTALLED VERSIONS ============================================================
For each required tool, check if it is installed and the version matches:
node --version → compare against required
npm --version → verify package manager
python3 --version → compare against required
go version → compare against required
rustc --version → verify installed
flutter --version → compare against required
docker --version → verify installed
docker compose version → verify installedProduce a status table:
| Tool | Required | Installed | Status |
|---|---|---|---|
| node | 20.x | 20.11.0 | OK |
| pnpm | 9.x | not found | MISSING |
For MISSING tools:
For VERSION MISMATCH:
nvm use or fnm useIf --check-only, stop here and report the status table. Do not proceed to install.
============================================================ PHASE 3 — INSTALL DEPENDENCIES ============================================================
Install project dependencies using the detected package manager:
Node.js:
npm install (or npm ci if package-lock.json exists and is not in CI)yarn installpnpm installbun installPython:
pip install -r requirements.txt (create venv first if not in one: python3 -m venv .venv && source .venv/bin/activate)poetry installuv syncpipenv install --devGo: go mod download
Rust: cargo fetch
Flutter: flutter pub get
Ruby: bundle install
For monorepos, run install from the root. If workspace installs are needed, detect and run those too.
Verify install succeeded (exit code 0). If it fails, read the error and attempt to resolve:
============================================================ PHASE 4 — CONFIGURE ENVIRONMENT ============================================================
4.1 — Environment Variables
If .env.example or .env.template exists and .env does not:
cp .env.example .envDATABASE_URL → construct from docker-compose service config or use default: postgresql://postgres:postgres@localhost:5432/app_devREDIS_URL → redis://localhost:6379JWT_SECRET / SECRET_KEY → generate a random 64-char hex string using openssl rand -hex 32PORT → keep the default from templateNODE_ENV / ENVIRONMENT → set to developmentAPI_KEY / THIRD_PARTY_* → leave as placeholder with comment: # TODO: add your key.env fileIf no .env.example exists but the project clearly needs env vars (detected from code scanning for process.env, os.environ, os.Getenv), create a .env.example with discovered variables and sensible defaults.
4.2 — Database Setup
Skip if --skip-db.
If docker-compose.yml exists with database services:
docker compose up -dnpx prisma migrate dev or npx prisma db pushpython manage.py migratealembic upgrade headgoose upnpx knex migrate:latestrails db:migratenpx prisma db seed (if seed script defined in package.json)python manage.py loaddatascripts/seed.* or db/seed.*If no docker-compose.yml but database is needed:
docker-compose.yml with the required database service4.3 — Additional Setup
Makefile exists with a setup or init target: run make setup or make initscripts/setup.sh exists: run bash scripts/setup.shTaskfile.yml exists with a setup task: run task setupnpx prisma generate to generate the clientnpx husky install or npx husky (v9+)pre-commit install============================================================ PHASE 5 — VERIFY BUILD AND TESTS ============================================================
Run verification checks to confirm the project is ready for development:
5.1 — Build Check:
npm run build or npx tsc --noEmit (whichever is in scripts)python -c "import {main_package}" (verify imports work)go build ./...cargo buildflutter analyze5.2 — Test Check (skip if --skip-tests):
npm test (or npx vitest run / npx jest)pytest or python -m pytestgo test ./...cargo testflutter test5.3 — Dev Server Check (non-blocking):
dev or start:dev script exists, verify it starts without immediate crashReport results for each check: PASS / FAIL with error details.
============================================================ SELF-HEALING VALIDATION (max 2 iterations) ============================================================
After completing, validate the output was produced correctly:
IF VALIDATION FAILS:
============================================================ OUTPUT ============================================================
Print the setup summary:
## Environment Setup Complete
### System Requirements
| Tool | Required | Installed | Status |
|--------|----------|-----------|---------|
| node | 20.x | 20.11.0 | OK |
| docker | any | 27.1.1 | OK |
| ...
### Dependencies
- {package manager}: {N} packages installed
### Environment
- .env: created from .env.example with {N} variables populated
- Database: {PostgreSQL 16 running on localhost:5432}
- Migrations: {applied N migrations}
- Seed data: {loaded / not available}
### Verification
- Build: PASS
- Tests: PASS ({N} tests, {N} passed)
- Dev server: PASS (responding on localhost:{port})
### Manual Steps Required
- {any tools that need manual install}
- {any API keys that need manual configuration}============================================================ NEXT STEPS ============================================================
npm run dev / python manage.py runserver / go run ./git-hooks to set up pre-commit hooks/devcontainer to containerize this setup for team consistency.env.example with the team (never commit .env)============================================================ SELF-EVOLUTION TELEMETRY ============================================================
After producing output, record execution metadata for the /evolve pipeline.
Check if a project memory directory exists:
~/.claude/projects/skill-telemetry.md in that memory directoryEntry format:
### /env-setup — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.
============================================================ DO NOT ============================================================
brew install, apt install).env files — ensure .env is in .gitignoredocker compose down -v unless --reset was explicitly passed.env files — only create new ones from templatesopenssl rand -hex 32 minimum~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.