Use when tasks involve Xget URL rewriting, registry/package/container/API acceleration, integrating Xget into Git, download tools, package managers, container…
SaferSkills independently audited xget (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Default to execution, not instruction. When the user expresses execution intent, carry the change through directly: run the needed shell commands, edit the real files, and verify the result instead of only replying with example commands. Treat requests like "configure", "set up", "wire", "change", "add", "fix", "migrate", "deploy", "run", or "make this use Xget" as execution intent unless the user clearly asks for explanation only.
Resolve the base URL first:
XGET_BASE_URL from the environmentset temporarily for the current shell/session or persistently for future shells
https://xget.example.com only as a clearly labeled placeholder for docsor templates that do not have a real deployment yet
Prefer scripts/xget.mjs over manual guessing for live platform data, URL conversion, and README Use Cases lookup.
Only stop to ask when a missing fact blocks safe execution, such as an unknown real base URL for a command that must run against a live deployment. If the user only needs docs or templates, use the placeholder path rules below.
applied now
template without applying it yet
Git or download-tool acceleration; package-manager or language-ecosystem configuration; container image, Dockerfile, Kubernetes, or CI/CD acceleration; AI SDK / inference API base-URL configuration; deploying or self-hosting Xget itself
XGET_BASE_URL, open the reference guide and:
temporary or persistent commands directly when the environment allows it
the exact command with the missing value clearly called out
by default:
node scripts/xget.mjs topics --format json--match or fetch a specific section withnode scripts/xget.mjs snippet --base-url https://xget.example.com --heading "Docker Compose Configuration" --format text
like Use in Project is ambiguous, fetch its parent section instead.
example commands
switch, migrate, test, or otherwise perform the change
not just explanation
rewrite
verification step when practical
node scripts/xget.mjs platforms --format json when the answer depends on current prefixes, and use convert for exact URL rewrites.
example, pair a package-manager section with container, deployment, or .env guidance when the user's project needs more than one integration point.
the right Xget path shape:
/{prefix}/.../crates/... rather than /crates/api/v1/crates/.../ip/{provider}/.../cr/{registry}/...platform, say so explicitly and fall back to the stable guidance in references/REFERENCE.md instead of inventing a prefix.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.