Project Bootstrap

Bootstrap new projects with predictable structure and validation commands.

Security Scan

This instruction-only 'Project Bootstrap' skill is internally consistent with its stated purpose, requests no credentials or installs, and contains no obvious incoherent or risky instructions.

Purpose & Capability

Name/description (bootstrap projects with structure and validation) match the SKILL.md content. The inputs, steps, validation, and outputs are appropriate for a scaffolding/bootstrap tool and do not request unrelated capabilities.

Instruction Scope

Runtime instructions are scoped to creating a project tree, configuring lint/test, producing .env.example, README, and running local validation commands. The SKILL.md explicitly says not to touch globals and not to include real secrets. It does not instruct the agent to read unrelated system files, other skills' tokens, or exfiltrate data.

Install Mechanism

There is no install spec and no code files; the skill is instruction-only, so nothing will be downloaded or written by an install step. That is the lowest-risk install posture for this purpose.

Credentials

The skill declares no required environment variables, credentials, or config paths. That is proportional to a local scaffolding/bootstrapper which should not need secrets or external credentials.

Persistence & Privilege

always is false and the skill is user-invocable. It does not request permanent presence or system-wide changes. The safety rules in SKILL.md explicitly forbid modifying global tooling unless explicitly requested.

Assessment

This skill appears coherent and low-risk: it only contains guidance for scaffolding projects and asks for no credentials. Before using it, verify the target path you pass so the agent only creates/modifies intended directories; confirm whether templates will be fetched from remote sources (the SKILL.md is silent about template origins) and prefer offline/local templates if you want to avoid network fetches; note the metadata shows author 'RedHat Dev' while the registry owner ID differs—this could be an innocuous labeling issue but you may want to confirm the publisher/source if provenance matters. Finally, run the first bootstrap in a disposable or version-controlled directory so you can inspect generated files before committing them.

SKILL: project-bootstrap

Purpose

Initialize a new project with a predictable structure, quality gates (lint/test), and safe configuration defaults.

When to Use

• Starting a new service/app/library.
• Creating a new package inside a monorepo.
• You need a repeatable baseline for contributors/CI.

Inputs

• project_type (required, enum: backend|frontend|library|contract|cli).
• stack (required, string): e.g., “node-ts”, “python-fastapi”, “nextjs”.
• name (required, string): project/package name.
• path (required, string): target directory.
• constraints (optional, string[]): repo rules, linting, deployment constraints.

Steps

1. Confirm target directory and ensure it is safe to create/modify.
2. Select a template that matches repo conventions; prefer minimal dependencies.
3. Scaffold project structure (src/tests/config/docs).
4. Configure:
   • lint/format (if repo uses them)
   • unit test runner
   • env/config examples (.env.example), never real secrets
5. Add a README with:
   • how to run locally
   • how to test
   • key design decisions
6. Run deterministic validation commands (install + test + build).

Validation

• Project builds/runs locally (basic smoke check).
• Tests execute and pass (even if minimal).
• No secrets or machine-specific paths are committed.

Output

• Created file tree
• Commands to run (install, dev, test, build)
• Configuration contract (env vars and defaults)

Safety Rules

• Never modify global tooling on the machine unless explicitly requested.
• Pin versions where the repo requires it.
• Do not auto-deploy; bootstrap is local by default.

Example

Bootstrap a TS backend:

• project_type: backend
• stack: node-ts
• Output: apps/api/ with pnpm test and pnpm dev working.