Is Cairn Handoff-bcd7e7 safe to install?

SaferSkills independently audited Cairn Handoff-bcd7e7 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

.claude/skills/cairn-handoff/SKILL.md · 1 file

.claude/skills/cairn-handoff/SKILL.md2.0 KB · Markdown

name: Cairn Handoff

description: Trigger phrase "Cairn Handoff". Author a 7-bucket handoff brief from the current conversation and persist it via Cairn's `handoff` MCP tool (default account mode — no model call, nothing leaves the host). Use when the user says "Cairn Handoff", before /clear or a compaction, on a yellow/red context zone, or before switching model/host.

Cairn Handoff — persist this session as a 7-bucket brief

Trigger: the user says "Cairn Handoff" (or invokes /cairn-handoff), or you are about to /clear, hit a compaction, or switch model/host.

Do this:

Write a faithful 7-bucket brief from THIS conversation — nothing invented, nothing padded:

DECISIONS (mark superseded ones), EVIDENCE (each with a source ref: file:line, msg#,

url, or tool output), OPEN QUESTIONS, CONSTRAINTS, VERBATIM (code/IDs/values/paths byte-exact), NEXT STEPS, DISCARDED.

Call the `handoff` MCP tool (leave mode at its default account → no model call, no egress):

brief: the full brief text.
requiredVerbatim: every value that MUST survive byte-exact (IDs, exact numbers, file paths, flags).
decisions / evidence: the structured form when you can extract it.
host: the current model/provider; sourceZone: the current zone (green/yellow/red).

Report back: storedDecisionId, decisionsStored, and missingRequired. If missingRequired

is non-empty, fix the brief so those spans appear byte-exact and call handoff again.

Notes:

A new handoff supersedes the previous brief automatically, so the ledger stays lean — old briefs

do not pile up in decision_log view=current.

On Claude Code, prefer authoring the brief in a subagent (Task tool) so the compaction reasoning

tokens don't bloat the main context (ADR-0007).

Account mode persists locally only; nothing is sent to any model.
To pick the work back up later, use "Cairn resume" (skill cairn-resume).

Cairn Handoff-bcd7e7— agent skill

Is Cairn Handoff-bcd7e7 safe to install?

Cairn Handoff — persist this session as a 7-bucket brief

Audit the pieces. Scan the whole. Decide.