How do I install the Bootkeeper skill?

Run npx skillmds@latest add publieople/bootkeeper in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Bootkeeper safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Bootkeeper?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Bootkeeper free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Bootkeeper?

publieople (@publieople) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Bootkeeper by publieople — Agent Skill

Name: Bootkeeper
Rating: 4.2 (5 reviews)
Author: publieople

Bootkeeper

Manage Windows startup items via the bootkeeper CLI. Use when the user asks to list, inspect, analyze, enable, disable, remove, or restore autostart entries (registry Run keys, startup folders, scheduled tasks). Write operations require user confirmation via an elevated dialog.

publieople 3666ee3 7 files · 69.7 KB Updated Sep 17, 2026

File contents

BootKeeper

Manage Windows autostart (startup) items from the bootkeeper CLI.

When to use

The user wants to:

see what starts automatically at login (startup items)
inspect a specific autostart entry (command, signature, publisher, risk)
analyze which entries look suspicious (software-ruled risk)
enable / disable / remove a startup item
restore an item from a snapshot (undo)

Commands (all output JSON)

Read

bootkeeper list [--category registry_run|startup_folder|scheduled_task]
bootkeeper get <id>
bootkeeper analyze [--category ...]
bootkeeper snapshot list
bootkeeper snapshot show <id>

Each list item: id, category, name, command, location, signature, publisher, risk, enabled.

Write (elevated + user confirmation)

bootkeeper disable <id>          # rename Foo -> Foo.disabled
bootkeeper enable <id>           # rename back
bootkeeper remove <id>           # delete entry (snapshot created first)
bootkeeper restore <snapshot-id> <item-id>   # undo from snapshot

Write behavior (hard confirmation):

The CLI writes a request and launches bootkeeper-helper.exe elevated (UAC).
The helper re-verifies the item itself (registry lookup + WinVerifyTrust signature + rule engine) and shows a native confirmation dialog with machine-verified facts only.
Nothing is executed unless the user clicks Yes.
Every write creates a snapshot (kept 7 days) for undo.

You cannot and must not bypass the dialog. If the user hasn't confirmed, the operation fails with cancelled by user. That is by design.

Snapshots

Auto-created on every disable/enable/remove. Kept 7 days.
snapshot list shows id/time/operation/entry count.
restore needs the snapshot id and the item id (copy from the snapshot's entries[].item_id).

Platform notes

Must run on Windows for real enumeration; other OSes return [].
BOOTKEEPER_DATA overrides data dir (default %APPDATA%\BootKeeper).
BOOTKEEPER_HELPER overrides the helper exe path (usually auto-discovered).

Rules for the agent

Never fabricate items. If list returns [] or the platform isn't Windows, say so.
Risk is authoritative. risk + reasons come from the rule engine; you may explain but never change the verdict.
Never claim a write succeeded without a result. Check the JSON: ok: true + message. ok: false means cancelled or failed.
Disabling is safer than removing. Prefer disable (reversible via rename) over remove unless the user explicitly wants deletion.
Always suggest the confirmation dialog consequence before a write: "this will pop a UAC + confirmation dialog you must approve".

---name: bootkeeperdescription: Manage Windows startup items via the bootkeeper CLI. Use when the user asks to list, inspect, analyze, enable, disable, remove, or restore autostart entries (registry Run keys, startup folders, scheduled tasks). Write operations require user confirmation via an elevated dialog.---# BootKeeperManage Windows autostart (startup) items from the `bootkeeper` CLI.## When to useThe user wants to:- see what starts automatically at login (startup items)- inspect a specific autostart entry (command, signature, publisher, risk)- analyze which entries look suspicious (software-ruled risk)- enable / disable / remove a startup item- restore an item from a snapshot (undo)## Commands (all output JSON)### Read```shbootkeeper list [--category registry_run|startup_folder|scheduled_task]bootkeeper get <id>bootkeeper analyze [--category ...]bootkeeper snapshot listbootkeeper snapshot show <id>```Each list item: `id`, `category`, `name`, `command`, `location`, `signature`, `publisher`, `risk`, `enabled`.### Write (elevated + user confirmation)```shbootkeeper disable <id> # rename Foo -> Foo.disabledbootkeeper enable <id> # rename backbootkeeper remove <id> # delete entry (snapshot created first)bootkeeper restore <snapshot-id> <item-id> # undo from snapshot```**Write behavior (hard confirmation):**1. The CLI writes a request and launches `bootkeeper-helper.exe` elevated (UAC).2. The helper re-verifies the item itself (registry lookup + WinVerifyTrust signature + rule engine) and shows a native confirmation dialog with machine-verified facts only.3. Nothing is executed unless the user clicks **Yes**.4. Every write creates a snapshot (kept 7 days) for undo.**You cannot and must not bypass the dialog.** If the user hasn't confirmed, the operation fails with `cancelled by user`. That is by design.## Snapshots- Auto-created on every disable/enable/remove. Kept 7 days.- `snapshot list` shows id/time/operation/entry count.- `restore` needs the snapshot id and the item id (copy from the snapshot's `entries[].item_id`).## Platform notes- Must run **on Windows** for real enumeration; other OSes return `[]`.- `BOOTKEEPER_DATA` overrides data dir (default `%APPDATA%\BootKeeper`).- `BOOTKEEPER_HELPER` overrides the helper exe path (usually auto-discovered).## Rules for the agent1. **Never fabricate items.** If `list` returns `[]` or the platform isn't Windows, say so.2. **Risk is authoritative.** `risk` + `reasons` come from the rule engine; you may explain but never change the verdict.3. **Never claim a write succeeded without a result.** Check the JSON: `ok: true` + message. `ok: false` means cancelled or failed.4. **Disabling is safer than removing.** Prefer `disable` (reversible via rename) over `remove` unless the user explicitly wants deletion.5. **Always suggest the confirmation dialog consequence** before a write: "this will pop a UAC + confirmation dialog you must approve".

Frequently asked questions