Agent skill · Audited from source

init

skill · mcollina/skillsMIT licenceAudited 22 Oct 2026 · source 3f067ed6a979

★ 1,956pushed 3 days ago
✓SAFEGrade B · 89/100 · 22 Oct 2026 · 3f067ed
1,956repo stars · whole mcollina/skills

Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit 3f067ed6a979 and found no filesystem, network or shell access and no hard-coded secrets. What it does: Creates, updates, or optimizes an AGENTS.md file for a repository with minimal, high-signal instructions covering non-discoverable coding conventions, tooling quirks, workflow preferences, and project-specific rules…

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “init (mcollina/skills)”. Retrieved 22 Oct 2026. https://modelsatlas.com/skills/mcollina/init

4 skills are called “init”. You are viewing mcollina/skills.

Trust audit

Audit 0.4.1 · source read 22 Oct 2026

Trust score89/100✓SAFE B
0 critical0 high0 medium0 low0 info

SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 13,985 of 14,816 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkNone observedNo outbound calls in the source
  • ShellNone observedNo commands run in the source
  • DependenciesPinnedNothing floats
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS0
L1 Static sourceSecrets, path traversal, supply chain, hidden codeNA0
L2 InstructionsPrompt injection, authority framing, hidden directivesPASS0
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (0)

No findings at any severity. We re-audit when the source changes.

Audit 0.4.1 · source sha 3f067ed6a979 · 22 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publishermcollina GitHub userOwner of the repository this skill is read from
  • Source foldermcollina/skills/skills/initThe exact folder we audited
  • LicenceMITAs the repository states it
  • Commit pinned for this verdict3f067ed6a979A new audit runs when the source changes
  • Repository statusNot archivedLast push 3 days ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Creates, updates, or optimizes an AGENTS.md file for a repository with minimal, high-signal instructions covering non-discoverable coding conventions, tooling quirks, workflow preferences, and project-specific rules…

---
name: init
description: Creates, updates, or optimizes an AGENTS.md file for a repository with minimal, high-signal instructions covering non-discoverable coding conventions, tooling quirks, workflow preferences, and project-specific rules that agents cannot infer from reading the codebase. Use when setting up agent instructions or Claude configuration for a new repository, when an existing AGENTS.md is too long, generic, or stale, when agents repeatedly make avoidable mistakes, or when repository workflows have changed and the agent configuration needs pruning. Applies a discoverability filter—omitting anything Claude can learn from README, code, config, or directory structure—and a quality gate to verify each line remains accurate and operationally significant.
metadata:
  tags: initialization, agents, context-engineering, agents-md, maintenance
---

## When to use

Use this skill when creating or updating `AGENTS.md` for a repository.

Use it especially when:
- the current `AGENTS.md` is long, generic, or stale
- agents repeatedly make the same avoidable mistakes
- repository workflows changed and agent guidance needs pruning

## Instructions

Treat `AGENTS.md` as a **living list of non-discoverable landmines and workflow gotchas**, not a codebase overview.

### Core rule: discoverability filter

Before adding any line, ask:

> Can an agent discover this by reading the repo (`README`, code, config, scripts, directory tree)?

- If **yes**: do **not** include it in `AGENTS.md`.
- If **no**, and it materially affects task success/cost/safety: include it.

### What earns a line

Include only guidance that is:
1. **Non-discoverable** from repository files alone
2. **Operationally significant** (changes commands, outcomes, or safety)
3. **Actionable** (specific enough to execute)

Typical examples:
- Non-standard tooling choices (e.g. use `uv` instead of `pip`)
- Command caveats (e.g. tests must run with `--no-cache` due to fixture behavior)
- Hidden constraints/landmines (deprecated directories still imported in production)
- Critical local conventions that are not encoded in lint/tests/config

### What to remove or avoid

Do **not** include:
- Tech stack summaries
- Directory structure overviews
- Architecture descriptions agents can infer from code
- Generic best-practice advice
- Rules already enforced by tooling (linters, typecheck, tests, CI)
- Mandatory boilerplate headers unless the repo explicitly requires one

### Recommended structure

Prefer short, high-signal sections such as:
- `Scope & routing` (which areas need separate/module-local AGENTS files)
- `Non-discoverable commands`
- `Landmines / do-not-touch areas`
- `Task-specific constraints`

For large repos, recommend **hierarchical AGENTS.md** files near relevant modules instead of one monolithic root file.

### Source files to check first

- Existing `AGENTS.md`
- `README.md`
- `PROJECT.md` (if present)
- Cursor rules (`.cursor/rules/` or `.cursorrules`)
- Copilot instructions (`.github/copilot-instructions.md`)
- `GEMINI.md`
- CI/workflow files and package manager config (for command/tooling mismatches)

If `AGENTS.md` exists, improve it incrementally instead of replacing it blindly.

### Maintenance mindset

`AGENTS.md` is temporary guidance, not permanent configuration.

When recurring issues appear:
1. Prefer fixing the root cause in code/tooling (lint rule, test, script, structure)
2. Keep only the minimum instruction needed until the root cause is solved
3. Prune stale instructions aggressively

### Quality gate before finalizing

For each line in `AGENTS.md`, verify:
- Is it non-discoverable?
- Is it still accurate today?
- Does it materially reduce mistakes/cost/time?

Delete any line that fails one of these checks.

Excerpt, first 3,760 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 3f067ed

Download folder ↗
git clone https://github.com/mcollina/skills
git -C skills checkout 3f067ed6a979

The author documents no install command, so this uses the repository directly. Our verdict covers commit 3f067ed6a979 only.

Works in which agents?

What its own text says, not a test

AgentStatusMore
GitHub CopilotMentioned in its text, not testedSkills for GitHub Copilot · About GitHub Copilot
CursorMentioned in its text, not testedSkills for Cursor · About Cursor
“Mentioned” means the skill’s text names the agent. We have not run it there.

Audit history

Every audit, every source change

  1. ✓SAFE B 89 / 100

    first audit · source 3f067ed6a979

README badge

For maintainers · shows the latest audit

ModelsAtlas: SAFE BMODELSATLASSAFE · B
[![ModelsAtlas: SAFE B](https://modelsatlas.com/skills/mcollina/init/badge.svg)](https://modelsatlas.com/skills/mcollina/init/)

The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.

Similar skills

Add this badge to your README

[![ModelsAtlas: SAFE B](https://modelsatlas.com/skills/mcollina/init/badge.svg)](https://modelsatlas.com/skills/mcollina/init/)

Questions about init

What does the init skill do?
My own collection of skills for modern Node.js development
Is init safe to install?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.
What can init access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
Which assistants does init work with?
Its documentation mentions copilot and cursor. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (3f067ed6a979), read on 2026-10-22. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.