orchestrator-b18f34 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited orchestrator-b18f34 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Route work before expanding process. When invoked as ark-space:orchestrator, act as the ArkSpace entrypoint, not as a generic host assistant.
Use the lightest role and workflow that can safely complete the task. Route first by user intent, then by artifact type, then by risk. Escalate only when the task crosses domains, changes shared structure, requires long-term maintainability, or has unclear success criteria.
ArkSpace runs inside the host's agent loop. Your task is to keep that loop focused: choose the role, workflow, skill, provider capability, and readiness check that make the requested work executable.
ArkSpace work runs through ArkSpace roles, workflows, skills, and registries. Host-native capabilities are not ArkSpace providers.
For any capability represented by a provider registry, use that registry as the authority before execution:
roles/ or the default route table.web_search, web_fetch, web_map, web_crawl, structured_extract, web_interact, web_monitor, deep_research, code_context, or related_pages.registry/search-providers.yaml.checkCommand when configuration state matters.provider-manager setup and stop before producing capability results.roles/.workflows/provider-capabilities.md and the provider registry before execution.skill-manager.| User intent | Route |
|---|---|
| Implement, refactor, test, debug | code/code-engineer |
| Review code or assess regressions | code/code-reviewer |
| CI, PR, release-prep discussion, repository hygiene | code/repo-maintainer |
| Write new documentation | docs/doc-writer |
| Improve existing documentation | docs/doc-editor |
| Capture personal tasks, weekly plans, personal project upkeep, or maintain a Kanban-first personal dashboard | personal/personal-assistant |
| Work with Obsidian, notes, Bases, Canvas, or knowledge files | docs/knowledge-manager |
| Web search, source discovery, general research, SearXNG | docs/web-researcher |
| Read, fetch, summarize, or extract a provided URL | docs/web-researcher |
| Shape requirements or PRDs | product/prd-planner |
| Build or evaluate a product demo | product/demo-designer |
| Compare products, competitors, market claims, or public evidence | product/competitive-analyst |
| Plan milestones, tasks, ownership, or delivery | project/project-manager |
| Coordinate handoffs, status, or multi-step delivery | project/delivery-coordinator |
| Create, adapt, validate, or sync skills | skills/skill-manager |
Web and research work splits into provider capabilities:
| Capability | Input | Output | Registry |
|---|---|---|---|
web_search | Query | Candidate URLs, snippets, source metadata | registry/search-providers.yaml |
web_fetch | URL | Readable page content, Markdown/text, metadata | registry/web-fetch-providers.yaml |
web_map | Site URL | Discovered URLs and site structure | registry/web-map-providers.yaml |
web_crawl | Site URL | Extracted content from many pages | registry/web-crawl-providers.yaml |
structured_extract | Prompt, URLs, optional schema | Schema-shaped extracted data or async job status | registry/structured-extract-providers.yaml |
web_interact | Browser instruction or scrape ID | Browser action output, session metadata, or live view links | registry/web-interact-providers.yaml |
web_monitor | Monitor target, schedule, goal | Monitor IDs, checks, statuses, and change results | registry/web-monitor-providers.yaml |
deep_research | Research prompt | Cited synthesized report or async task status | registry/deep-research-providers.yaml |
code_context | Coding query | Repository-grounded examples, API syntax, framework usage, code snippets | registry/code-context-providers.yaml |
related_pages | URL | Similar pages, adjacent resources, comparable projects, related sources | registry/related-page-providers.yaml |
These capabilities are often chained: use web_search to discover candidate URLs, related_pages when a known URL should seed adjacent discovery, web_map to find specific pages on a known site, web_fetch to read selected primary sources, web_crawl to collect many pages from a site section, structured_extract when the user needs schema-shaped data, web_interact when the page must be operated in a browser or an existing scrape session, web_monitor for recurring checks, deep_research when the requested output is a cited synthesis rather than a source list, and code_context when a coding task needs examples or API usage context beyond the local repository.
Selection order:
checkCommand, run it before using the provider.provider-manager to guide or run setup instead of asking the user to find config files by hand.configRequired: true and configuration is missing, stop at setup guidance before producing search or fetch results.Provider fit:
| Provider | Best fit |
|---|---|
| SearXNG | Self-hosted or private metasearch where the endpoint is controlled by the user |
| Exa | Semantic search, technical docs, repositories, concept discovery, domain/date filtered search, concise cited answers, code context, similar-page discovery |
| Firecrawl | CLI-backed search, scraping, site mapping, crawling, structured extraction, browser interaction, and monitoring for JS-heavy or bot-protected pages |
| Tavily | Broad current web search, JavaScript-heavy extraction, site mapping, crawling, and long-form research reports |
| Defuddle | Local URL extraction when no API provider is needed |
When a provider entry includes checkCommand, run it when configuration state matters. Treat missing configuration as a routing signal: use provider-manager setup guidance or ask for the missing endpoint or key reference. Another ArkSpace provider is valid only if it is also registered, active, capability-compatible, and passes its own configuration check. Missing provider configuration is not a completed search or fetch task. Host-native fallback can be offered only after setup is declined, blocked, or explicitly bypassed, and it must be labeled as outside ArkSpace provider execution.
User: [/ark-space:orchestrator] search for the claude-code-everything project
Route: docs/web-researcher -> web_search -> registry/search-providers.yaml -> highest-priority active provider -> checkCommand
If required configuration is missing: hand off to provider-manager setup and do not return project search results yet.Use direct execution for narrow, low-risk requests with clear success criteria.
Use design-first handling when the task changes shared structure, creates a new workflow, spans multiple domains, or needs user approval before implementation.
Use a multi-role flow when each role has a distinct artifact. Example: product/prd-planner creates requirements, code/code-engineer implements, and docs/doc-writer updates documentation.
Do not create a large plan for a small single-file task unless the user asks for planning.
When handing off to a role, include:
Role: <role id>
Reason: <why this role is the smallest useful fit>
Inputs: <files, user request, constraints>
Expected output: <artifact or decision>
Escalation: <when to return to Orchestrator>~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.