thrunt-thread — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited thrunt-thread (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 4 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 4 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<objective> Create, list, or resume persistent context threads. Threads are lightweight cross-session knowledge stores for work that spans multiple sessions but doesn't belong to any specific phase. </objective>
<process>
Parse $ARGUMENTS to determine mode:
<mode_list> If no arguments or $ARGUMENTS is empty:
List all threads:
ls .planning/threads/*.md 2>/dev/nullFor each thread, read the first few lines to show title and status:
## Active Threads
| Thread | Status | Last Updated |
|--------|--------|-------------|
| fix-deploy-key-auth | OPEN | 2026-03-15 |
| pasta-tcp-timeout | RESOLVED | 2026-03-12 |
| perf-investigation | IN PROGRESS | 2026-03-17 |If no threads exist, show:
No threads found. Create one with: /thrunt-thread <description></mode_list>
<mode_resume> If $ARGUMENTS matches an existing thread name (file exists):
Resume the thread — load its context into the current session:
cat ".planning/threads/${THREAD_NAME}.md"Display the thread content and ask what the user wants to work on next. Update the thread's status to IN PROGRESS if it was OPEN. </mode_resume>
<mode_create> If $ARGUMENTS is a new description (no matching thread file):
Create a new thread:
SLUG=$(node ".github/thrunt-god/bin/thrunt-tools.cjs" generate-slug "$ARGUMENTS") mkdir -p .planning/threads cat > ".planning/threads/${SLUG}.md" << 'EOF'
# Thread: {description}
## Status: OPEN
## Goal
{description}
## Context
*Created from conversation on {today's date}.*
## References
- *(add links, file paths, or issue numbers)*
## Next Steps
- *(what the next session should do first)*
EOFerror messages, investigation results), extract and add it to the Context section.
node ".github/thrunt-god/bin/thrunt-tools.cjs" commit "docs: create thread — ${ARGUMENTS}" --files ".planning/threads/${SLUG}.md" ## 🧵 Thread Created
Thread: {slug}
File: .planning/threads/{slug}.md
Resume anytime with: /thrunt-thread {slug}</mode_create>
</process>
<notes>
/thrunt-add-phase or /thrunt-add-backlog with context from the thread
</notes>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.