Atlas / Skills / davepoon / Init

InitCAUTION

skills/davepoon/init

A single hub to find Claude Skills, Agents, Commands, Hooks, Plugins, and Marketplace collections to extend Claude Code, Claude Desktop, Agent SDK and OpenClaw

Verdict
CAUTION
Grade
B
Trust score
89 /100
Version
—
Hosts
1 documented
License
MIT
Stars
3,604
01

Overview

A single hub to find Claude Skills, Agents, Commands, Hooks, Plugins, and Marketplace collections to extend Claude Code, Claude Desktop, Agent SDK and OpenClaw

Read from source at commit 80a0afd96301OBSERVED · 2026-10-07
02

Host compatibility

What the documentation claims. We have not run a compatibility test.

HostStatusNotes
claude-codementioned
03

What it tells the agent

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: init
description: >
  Frictionless setup. Detects missing daemon, installs it, configures local
  memory, and verifies the full plugin → MCP → daemon round-trip. Run
  after `/plugin install origin@7xuanlu`, or any time the user says "set up
  origin", "is origin working", "fix origin".
allowed-tools: ["Bash", "mcp__plugin_origin_origin__doctor", "mcp__plugin_origin_origin__context"]
---

# /init

Self-healing setup. Goal: 30 seconds, two user actions max (install plugin,
type /init). Default backend is local memory — no local model, no API key, no
prompts. Local model and Anthropic key are opt-in upgrades documented in
`/help`.

## Steps

Run in order. Stop and report at the first failure that needs human
attention. Otherwise, push through automatically.

### 1. Daemon health probe

```
Bash: curl -fsS -m 1 http://127.0.0.1:7878/api/health
```

- 200 OK → skip to step 4.
- Anything else → step 2.

### 2. Bootstrap (auto-install if missing)

Detect whether the `origin` CLI is on PATH:

```
Bash: command -v origin >/dev/null 2>&1 && echo present || echo absent
```

If `absent`, run the installer (no human prompts):

```
Bash: curl -fsSL https://raw.githubusercontent.com/7xuanlu/origin/v0.6.1/install.sh | bash
```

Then add it to PATH for the current session and configure local memory
non-interactively:

```
Bash: export PATH="$HOME/.origin/bin:$PATH" && origin setup --basic && origin install
```

If `present` (CLI exists, daemon down), just install + start:

```
Bash: origin setup --basic 2>/dev/null || true; origin install
```

`origin setup --basic` is idempotent — safe to re-run. `origin install`
writes the launchd plist and starts the daemon.

### 3. Re-probe daemon health

```
Bash: for i in 1 2 3 4 5; do curl -fsS -m 1 http://127.0.0.1:7878/api/health && break; sleep 1; done
```

If the daemon still isn't reachable after ~5s, surface the error and stop.
Likely cause: launchd plist load failure, port 7878 occupied by another
process, or macOS Tahoe Metal init issue (daemon degrades but still binds —
check `lsof -ti :7878`).

### 4. Doctor (verify backend)

Call the `origin` MCP server's `doctor` tool:

```
doctor()
```

Expected: local memory configured (no model, no key). Capture the mode
string for the final report.

### 5. MCP round-trip

```
context()
```

Pass → continue. Fail → MCP not wired. Tell user:
"origin-mcp didn't respond. Restart Claude Code so the plugin's
`.mcp.json` re-spawns the server."

### 6. Ready report

Print:

```
Origin ready.
  Daemon:   up on 127.0.0.1:7878
  Mode:     <mode from doctor()>
  MCP:      connected
  Data:     ~/.origin/  (pages, sessions, db symlink)
  Try:      /brief, /capture <thing>, /recall <query>, /help
```

If this was the first /init invocation in the session, dispatch `/help`
once so the user sees the verb cheat-sheet without asking.

## Optional upgrades (don't auto-run)

Mention these in the ready report only if the user explicitly asks for
"richer features" or asks about model-backed extraction:

- `origin model install` — local Qwen for distill cycles.
- `origin key set anthropic` — Anthropic for stronger synthesis.

Default flow ignores both. Storage, search, recall, and MCP memory all
work in local memory mode.

## When to use

- Right after `/plugin install origin@7xuanlu`.
- Hook printed "daemon down — run /origin:init".
- User says "set up origin", "is it working", "reinstall origin".

## When NOT to use

- Daemon already verified this session → `/brief` instead.
- Editing one config field → `origin doctor` or settings file directly.
04

Trust audit

CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeNA
L2Instruction surface (what it tells the agent)WARN
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
none-observed
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (3)

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
SKILL.md:26
Bash: curl -fsS -m 1 http://127.0.0.1:7878/api/health
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
SKILL.md:65
Bash: for i in 1 2 3 4 5; do curl -fsS -m 1 http://127.0.0.1:7878/api/health && break; sleep 1; done
MEDIUMSupply chain · prompt.pipe_to_shell · CWE-829, CWE-1357
SKILL.md:43
Bash: curl -fsSL https://raw.githubusercontent.com/7xuanlu/origin/v0.6.1/install.sh | bash

Gates applied: no_behavioural_pass.

Audited 2026-10-07 · audit v0.4.1 · source sha 80a0afd96301full audit observations/trust-audit/skill/davepoon__init.json · Report an issue / request a re-scan
05

Audit history

Every audit this skill has had.

DateSourceVerdictGradeScoreChange
2026-10-0780a0afd96301CAUTIONB89first audit
06

Questions

What does the Init skill do?

A single hub to find Claude Skills, Agents, Commands, Hooks, Plugins, and Marketplace collections to extend Claude Code, Claude Desktop, Agent SDK and OpenClaw

Is Init safe to install?

With care. The audit graded it B (89/100) and found 3 things worth knowing before you trust this skill, listed below with the exact line each was found on.

What can Init access on my machine?

The audit observed no filesystem, network or shell use at all in its source.

Which assistants does Init work with?

Its documentation mentions claude-code. That is what the text claims, not a compatibility test we ran.

How current is this page?

The grade is for one exact copy of the source (80a0afd96301), read on 2026-10-07. The repository is watched, and a new audit runs when it changes — this is the first audit.

Advertisement