Is agent-integration safe to install?

SaferSkills independently audited agent-integration (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

priv/skills/agent-integration/SKILL.md · 1 file

priv/skills/agent-integration/SKILL.md3.1 KB · Markdown

name: agent-integration

description: "Attach ControlKeel to agents, verify MCP connectivity, confirm native skills availability, and choose the right distribution target for each client."

when_to_use: "Activate when setting up CK with a new agent, installing the plugin, configuring MCP, or when the user asks how to attach ControlKeel to their tool."

argument-hint: "[agent name or tool to integrate]"

license: Apache-2.0

compatibility:

- codex

- claude-standalone

- claude-plugin

- copilot-plugin

- github-repo

- open-standard

- cline-native

- cursor-native

- windsurf-native

- continue-native

- letta-code-native

- pi-native

- roo-native

- goose-native

- opencode-native

- gemini-cli-native

- kiro-native

- kilo-native

- amp-native

- augment-native

- hermes-native

- multica-native

- openclaw-native

- devin-terminal-native

- warp-native

- droid-bundle

- forge-acp

disable-model-invocation: true

metadata:

author: controlkeel

version: "2.0"

category: integration

Agent Integration Skill

Use this skill when the task is attaching or distributing ControlKeel across agents.

Workflow

Identify whether the target is native-skill capable, plugin-capable, or MCP-only.
Prefer native install where supported, with CK MCP as the transport for governance tools.
Export plugin bundles when the user wants a shareable package.
For MCP-only tools, generate the instruction bundle and installation guidance.
For Conductor, prefer the Claude Code install path because Conductor documents support for .mcp.json, CLAUDE.md, and .claude/commands.

Cursor (Rules, Skills, Agents, Hooks, Plugins)

Cursor’s Settings → Rules, Skills, Subagents (and related Commands, Hooks, Plugins) align to repo files ControlKeel already generates on controlkeel attach cursor:

Cursor concept	CK attach output	Notes
Rules	`.cursor/rules/controlkeel.mdc`	Always-on governance instructions for the agent.
Skills	`.cursor/skills/` plus `.agents/skills/`	Native Cursor skills tree plus open-standard AgentSkills for import tools.
Commands	`.cursor/commands/*.md`	Slash-style review / plan / annotate / last flows.
Agents / Subagents	`.cursor/agents/.md`, `.cursor/background-agents/.md`	Governor-style prompts and background workflow guidance; hooks include `subagentStart`.
Hooks	`.cursor/hooks.json`, `.cursor/hooks/*.sh`	Shell / write / MCP / session / stop gates calling `controlkeel validate` when available.
MCP	`.cursor/mcp.json`	Stdio MCP; use `${workspaceFolder}` for command paths and `CK_PROJECT_ROOT`.
Plugins	`.cursor-plugin/`	Distributable bundle (`plugin.json`, mirrored assets, `hooks/hooks.json`, `mcpServers`) for Plugins → Install / marketplace-style flows.

Install path: controlkeel attach cursor in the governed repo root, then enable the ControlKeel MCP server in Cursor and (if desired) install the generated .cursor-plugin from the repo or a release export.

Additional resources

Target matrix

agent-integration— agent skill

Is agent-integration safe to install?

Agent Integration Skill

Workflow

Cursor (Rules, Skills, Agents, Hooks, Plugins)

Additional resources

Audit the pieces. Scan the whole. Decide.