Skip to content
Back to skills

Baseline

ASecurity

Find the repository's own gates — install, format check, lint, typecheck, build, test — record them, and prove they all pass before anything is touched.

  • 234 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added September 28, 2026
ai-agents

Security analysis

A92/100
  • mediumInstalls packages at runtime which could introduce malicious dependencies

Pro shows the line behind each finding and how to fix it

Scanned September 28, 2026

npx -y skills add receptron/mulmoterminal --skill baseline --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Baseline?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Baseline
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/receptron-baseline/badge)](https://www.skillsdirectory.com/skills/receptron-baseline)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: blueprint-repo-baseline
description: "Find the repository's own gates — install, format check, lint, typecheck, build, test — record them, and prove they all pass before anything is touched."
---

# Green before anything moves

Every later change claims "this behaves the same". That claim is measured against these gates, so they
must be the repository's own, and they must be green on the untouched code. A gate that is already red
cannot tell a regression from the state it was in.

1. **Package manager** from the lockfile: `yarn.lock` → yarn, `pnpm-lock.yaml` → pnpm, `package-lock.json`
   → npm, `bun.lockb`/`bun.lock` → bun. The install command must not rewrite the lockfile:
   `yarn install --frozen-lockfile`, `pnpm install --frozen-lockfile`, `npm ci`, `bun install --frozen-lockfile`.
2. **Gates** from `package.json` scripts, in this order when present: a format CHECK (`format:check`, never a
   script that rewrites files), `lint`, `typecheck`, `build`, `test`. Read what each script runs.
   - Leave out a script that needs a service, a browser download or network the machine may not have
     (`test:e2e` and the like), and write why in the record.
   - Read the CI workflows too: CI is the ground truth these approximate. A gate CI runs and `package.json`
     lacks is worth noting.
3. Write `.blueprint/gates.json`:
   ```json
   {
     "packageManager": "yarn",
     "install": "yarn install --frozen-lockfile",
     "gates": [{ "name": "lint", "command": "yarn lint" }, { "name": "test", "command": "yarn test" }],
     "skipped": [{ "name": "test:e2e", "why": "needs a browser download" }]
   }
   ```
   `name` is the script name exactly as `package.json` has it.
4. Run the install, then every gate, and read each exit code — never the last line of output.
5. If any gate is red on the untouched code, **ask**: it is the person's decision whether to fix it first
   (as its own change) or leave that gate out with a reason. Do not change the repository in this step.

Done when the check passes: every recorded gate exits 0 on the untouched default branch.

## Always

- Read `.blueprint/spec.md` if it exists. It is the agreed plan; do not widen it.
- When you need a decision, ask it through the blueprint question tool and stop. Do not guess.
- Change nothing in the repository in this step.
- Say you are done by stopping; the executor runs the check. Do not claim success yourself.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.