bootstrap — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited bootstrap (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Respond in the user's preferred language (detect from their recent messages, or fall back to the language setting in CLAUDE.md).
Take a high-level game vision and turn it into a structured, executable project — decomposing pillars into epics, then driving each through the qq pipeline.
Arguments: $ARGUMENTS (a description, a file path to a pitch/checklist document, or empty for interactive)
Read the input. Extract:
Then ask about gaps, using these preset directions (ask only what's missing, skip what's already covered):
Max 5 questions total. Make reasonable assumptions for non-critical unknowns.
Break the vision into epics — each a self-contained vertical slice that can go through the full qq pipeline independently.
Rules:
Output a manifest file and save to Docs/qq/<branch-name>/bootstrap-manifest.md.
Present to user for confirmation. This is the key human checkpoint — user approves the breakdown before automation begins.
After approval, initialize state tracking:
qq-bootstrap-state.py init \
--project . --name "<project-name>" \
--manifest "Docs/qq/<branch-name>/bootstrap-manifest.md" \
--epics "Epic 1 name" "Epic 2 name" "Epic 3 name" ... \
--max-retries 3 --prettyThen set dependencies and parallel flags for each epic:
qq-bootstrap-state.py set-deps --project . --epic-id 2 --depends-on "1" --pretty
qq-bootstrap-state.py set-deps --project . --epic-id 3 --depends-on "1,2" --prettyCheck which epics are actionable:
qq-bootstrap-state.py status --project . --prettyFor each actionable epic (pending + all dependencies completed):
qq-bootstrap-state.py start-epic --project . --epic-id <N> --pretty/qq:design --auto with the epic description + relevant pillars qq-bootstrap-state.py complete-epic --project . --epic-id <N> --pretty qq-bootstrap-state.py fail-epic --project . --epic-id <N> --reason "<what failed>" --pretty"action": "retry" → retry the failed pipeline step"action": "paused" → skip this epic, report to user, move to nextParallel execution: when status shows multiple actionable epics with parallel: true, dispatch each as a separate subagent using the Agent tool with isolation: "worktree". Each subagent runs the full qq pipeline for its epic.
Between epics: always re-check status to get the next actionable set. Don't hardcode the order — let the state script resolve dependencies.
After all epics complete (or all non-paused ones):
/qq:test on the combined result/qq:commit-push for the final integrated state qq-bootstrap-state.py clear --project . --prettyIf a session crashes or the user resumes later, run:
qq-bootstrap-state.py status --project . --prettyThis shows exactly which epics are completed, which are paused, and which are next. Resume from the first actionable epic.
Docs/qq/ is human-readable; the state in .qq/state/bootstrap.json is machine-readable~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.