Agentloopkit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Agentloopkit (Agent Skill) and scored it 66/100 (yellow). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 8 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 8 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This directory contains AgentLoopKit's own repo-local engineering loop artifacts.
manifest.json records the generated template version for this harness. agentloop doctor warns when the manifest is missing, stale, invalid, or newer than the installed CLI supports.
product-panel.mduser-personas.mdbacklog.mddogfood-log.mdmanifest.jsonresearch/tasks/reports/handoffs/state.jsonRun Start before broad repo reads, then expand only the source handles that matter to avoid broad scans:
agentloop create-task --title "Describe the next focused change" --type feature
agentloop task set .agentloop/tasks/<task-file>.md
agentloop task doctor
agentloop status
agentloop doctor --redact-paths
agentloop start --for generic --goal implement --redact-paths
agentloop context handles
agentloop context show <handle>
agentloop review-context
agentloop policy list
agentloop policy show security
agentloop policy status
agentloop verify
agentloop ship
agentloop prepare-pr
agentloop maintainer-check
agentloop handoff
agentloop runs --latest
agentloop intent <file>
agentloop upgrade-harness
agentloop report
agentloop badge
agentloop ci-summary
agentloop release-proofFor MCP-capable clients with tools already configured, ask the agent to call agentloop_start before broad reads. To configure a client, use agentloop mcp-server as that client's stdio command.
Use npx projscan doctor --format markdown during implementation work in this repository.
Local policy files are repo guidance. If agentloop policy status reports modified, read the local file and follow the repo-specific rule. Do not overwrite customized policy text just to match the bundled template.
Use agentloop ship as the main stop condition for meaningful code changes. It writes a ship report, records run evidence under .agentloop/runs/, and scores review-readiness evidence without claiming to measure code quality.
Use agentloop prepare-pr when reviewers need PR-ready copy. Use agentloop maintainer-check when reviewing whether an agent-assisted change has enough task, verification, handoff or ship, and risk evidence.
Use agentloop upgrade-harness after AgentLoopKit CLI upgrades. It reports stale local guidance, including missing Start/Context agent-readiness guidance, and writes nothing.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.