Install
$ agentstack add skill-candycong2001-ui-agent-project-playbook-agent-project-bootstrap ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Agent Project Bootstrap
Procedure
- Confirm the target project root, project name, and document locale (
enorzh-CN). - Use the
simpleprofile unless current repository evidence shows a live runtime, shared state, real users, credentials, or external writes; then recommendproduction. - Run
bin/meminitfrom this repository. Add--productiononly for the production profile, or--with-projectmemonly when the optional cold-memory adapter is explicitly wanted. - Review the dry-run report; do not make the user remember the command.
- If the target already has Playbook files, run the same command with
--upgrade; apply the plan only when it has no blocked managed files. - If the original request explicitly authorizes installation and the dry-run has no conflict, apply without another confirmation. Otherwise ask once before
--apply. - Activate the generated documents using current repository evidence and keep
CURRENT_HANDOFF.mdlimited to one current state. - Mark unverified commands, runtime side effects, and risks instead of guessing.
- Run the installed Docs Lint before handing substantial implementation work back.
Safety
- Never overwrite existing project files.
- Never import another project's memory or status.
- Never store secrets / 密钥, tokens, cookies, personal data, or private logs.
- Never configure MCP, cross-project memory, background watchers, or global Agent settings from this skill.
--upgradeis read-only unless explicitly combined with--apply; safe upgrade updates metadata, restores missing managed files, and stops when a managed file was customized.- Never overwrite
AGENTS.md, BLUEPRINT, ARCHITECTURE, or CURRENT_HANDOFF during upgrade. - The default simple install does not include production safety tooling.
- The default install is Playbook Core only and does not require
pjm. - The optional projectmem adapter keeps hooks, watcher, history backfill, global inheritance, and automatic capture off.
- Current repository evidence outranks every generated placeholder.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: candycong2001-ui
- Source: candycong2001-ui/agent-project-playbook
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.