Is algora-bounty-scout safe to install?

SaferSkills independently audited algora-bounty-scout (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/algora-bounty-scout/SKILL.md · 1 file

skills/algora-bounty-scout/SKILL.md2.1 KB · Markdown

name: algora-bounty-scout

description: "Scout public Algora org bounty boards at algora.io/<org>/bounties?status=open - parse amount and linked GitHub issue, dedupe, then filter already-assigned issues, saturated races, joke bounties, dead-lane orgs, and maintainer comments that say the bounty is inactive. Use for scout algora, find OSS bounties, or open source bounty hunting."

Algora Bounty Scout

Use this skill when a user wants to find public Algora bounties and avoid wasting time on issues that are not realistically claimable. It teaches the scouting technique and generic pitfall filters without shipping a curated org list.

When to invoke

User says: "scout algora" / "find OSS bounties" / "open source bounty hunting"
Code in the conversation uses: HTTP scraping, GitHub issue metadata, or bounty triage.

When NOT to invoke

The user wants private or paid bounty platforms.
The user already has a specific GitHub issue and only needs implementation help.

Concrete example

User input:

Scout these public Algora org boards and show only viable bounties: acme, samplelab, widgetco.

Output:

algora scout (3 orgs) -> 9 raw bounties
  ok   $300  acme/webapp#812     "Add OIDC provider" (0 open PRs, unassigned)
  ok   $150  acme/cli#77         "Fix flaky retry test" (unassigned)
  skip $400  acme/webapp#640     assigned to another contributor
  skip $250  samplelab/api#92    maintainer comment says bounty is inactive
  skip $100  widgetco/quest#1    submission game, not a mergeable issue
  -> 3 viable

Pattern to apply

Start from user-provided public org slugs; do not use a hidden curated list.
Probe https://algora.io/<org>/bounties?status=open.
Parse amount, title, and linked GitHub issue URL.
Dedupe by GitHub issue URL.
Fetch GitHub issue metadata: assignees, linked PRs, recent maintainer comments.
Apply the pitfall filters before writing any implementation code.

Reference: assets/pitfall_list.md.

Source

Distilled from production use across the author's automation projects. v0.1.0. See also: [[pr-body-formatter]].

algora-bounty-scout— agent skill

Is algora-bounty-scout safe to install?

Algora Bounty Scout

When to invoke

When NOT to invoke

Concrete example

Pattern to apply

Source

Audit the pieces. Scan the whole. Decide.