bootstrap — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited bootstrap (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Run qq scripts as${CLAUDE_PLUGIN_ROOT}/bin/<name>: they are not on PATH, so a bareqq-bootstrap-state.pyexits 127.
Respond in the user's preferred language (detect from their recent messages, or fall back to the language setting in CLAUDE.md).
Arguments: $ARGUMENTS (a description, a file path to a pitch/checklist document, or empty for interactive)
This skill is an orchestrator: it drives other qq skills and never writes code itself.
Read the input. Extract:
Then ask about what the input and the project leave open, at most 5 questions in total; make reasonable assumptions for non-critical unknowns:
Break the vision into epics — each a self-contained vertical slice that can go through the full qq pipeline independently.
Rules:
Save the manifest to Docs/qq/<branch-name>/bootstrap-manifest.md and present it to the user for confirmation. This is the key human checkpoint: the user approves the breakdown before any automation begins.
After approval, initialize state tracking (--pretty goes before the subcommand):
qq-bootstrap-state.py --pretty init \
--project . --name "<project-name>" \
--manifest "Docs/qq/<branch-name>/bootstrap-manifest.md" \
--epics "Epic 1 name" "Epic 2 name" "Epic 3 name" ... \
--max-retries 3Then set each epic's dependencies, adding --parallel for the epics flagged as parallel:
qq-bootstrap-state.py --pretty set-deps --project . --epic-id 2 --depends-on "1"
qq-bootstrap-state.py --pretty set-deps --project . --epic-id 3 --depends-on "1,2"Check which epics are actionable:
qq-bootstrap-state.py --pretty status --project .For each actionable epic (pending + all dependencies completed):
qq-bootstrap-state.py --pretty start-epic --project . --epic-id <N>/qq:design --auto with the epic description + relevant pillarsworkflow: prototype-loop: design → the user approves the epic's checklist → plan → execute → one code review round → test → commit-push, see shared/prototype-loop.md) qq-bootstrap-state.py --pretty complete-epic --project . --epic-id <N> qq-bootstrap-state.py --pretty fail-epic --project . --epic-id <N> --reason "<what failed>""action": "retry" → retry the failed pipeline step"action": "paused" → skip this epic, report to user, move to nextParallel execution: when status shows multiple actionable epics with parallel: true, dispatch each as a separate subagent using the Agent tool with isolation: "worktree". Each subagent runs the full qq pipeline for its epic.
Between epics: always re-check status to get the next actionable set. Don't hardcode the order — let the state script resolve dependencies.
After all epics complete (or all non-paused ones):
/qq:test on the combined result/qq:commit-push for the final integrated state qq-bootstrap-state.py --pretty clear --project .After a crash or in a later session, run qq-bootstrap-state.py --pretty status --project . — it shows which epics are completed, paused and next — and resume from the first actionable epic.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.