eywa — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited eywa (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Cross-session memory. Extracts handoffs at session end, retrieves past context at session start.
All commands use this exact pattern — no variations:
cd "$EYWA_REPO" && python -m eywa.cli <command> [args]Where $EYWA_REPO is the path to this repository (the directory containing the eywa/ package). If using a virtualenv, activate it first or use its Python binary directly.
# Get recent sessions (default 3)
cd "$EYWA_REPO" && python -m eywa.cli get
# Get by keyword search
cd "$EYWA_REPO" && python -m eywa.cli get "mcp routing"
# Get with options
cd "$EYWA_REPO" && python -m eywa.cli get "topic" --days-back 30 --max 5
# Extract current session (auto-detect)
cd "$EYWA_REPO" && python -m eywa.cli extract
# Extract specific session (8-char short ID or full UUID)
cd "$EYWA_REPO" && python -m eywa.cli extract 1b2f6f6b
# Rebuild index
cd "$EYWA_REPO" && python -m eywa.cli rebuild-indexOutput goes to stdout, errors to stderr. Exit code 0 = success, 1 = failure.
Why `cd` + `python -m`: The eywa package lives in the skill directory, not on PATH. The venv Python picks it up from CWD. Do not try bare eywa — it does not exist as a binary.
eywa get: Session start (no query), when user asks about past work (keyword query), when you need prior decisions.
eywa extract: Session end, after significant milestones, when user asks to save context.
Extract is a two-step protocol:
eywa extract, produce a concise session summary inline — what was built, what decisions were made, what's open. This is your own synthesis, not a tool call. Write it as a message to the user.eywa extract (or eywa extract <session_id>). The CLI independently parses the JSONL transcript. Your summary above becomes part of the transcript, enriching the handoff with an explicit recap.Summary format depends on channel:
Claude Code PC session (default):
Telegram session:
eywa rebuild-index: After manually editing handoff files, corrupt index, after bulk imports.
Without session_id: auto-detects via PID tracing → CWD-scoped mtime → global mtime. Requires JSONL modified within 30 seconds.
With session_id: explicit lookup only (8-char short ID or full UUID).
In multi-session environments, pass session_id explicitly.
| Path | What | When to load |
|---|---|---|
references/data-model.md | Handoff format, folder structure, index schema | When you need to understand where data lives or debug retrieval |
references/setup-guide.md | First-time setup, model config, env vars, batch indexing | When setting up eywa for the first time or configuring models |
eywa/cli.py | CLI entry point | When debugging CLI behavior |
eywa/extractors/handoff_schema.json | Handoff document JSON schema | When validating handoff output |
setup.sh | Idempotent setup script | First-time installation |
eywa get returns nothing useful.EYWA_DATA_DIR, EYWA_SESSIONS_DIR) for portability.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.