Is agent-management safe to install?

SaferSkills independently audited agent-management (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/agent-management/SKILL.md · 1 file

skills/agent-management/SKILL.md2.2 KB · Markdown

name: agent-management

description: AI DevKit · Manage running AI agents with ai-devkit agent commands. Use when an agent needs to identify itself, list agents, start workers, inspect agent detail, assign work, group agents, resume sessions, stop agents, or delegate work to other agents.

Agent Management

Use ai-devkit agent ...; if unavailable, use npx ai-devkit@latest agent ....

Workflow

List agents: ai-devkit agent list --json.
Identify self: compare your current session id to sessionId from list --json
Inspect before acting: ai-devkit agent detail --id <name> --json --tail 20.
Reuse idle agents when suitable; otherwise start one with agent start.
Send self-contained assignments. Track each agent's task and last instruction.
Verify completed work before reporting it done. Use $agent-communication for agent-to-agent updates.

Commands

ai-devkit agent list --json
ai-devkit agent detail --id <name> --json --tail 20
ai-devkit agent start --type codex --name <name> --cwd <path>
ai-devkit agent send --id <name> "<single-line instruction>"
ai-devkit agent send --id <name> --wait --timeout 120000 --json "<single-line instruction>"
ai-devkit agent send --group <group> "<single-line instruction>"
ai-devkit agent sessions --cwd <path> --type codex --json --limit 20
ai-devkit agent rename <old-name> <new-name>
ai-devkit agent kill <name>

Use exact names from list --json. Partial matches are convenient but risk sending work to the wrong agent.

Assignment Rules

Do not send instructions to yourself unless intentional.
Prefer task names like auth-review, ui-tests, or docs-pass.
Include objective, scope/files, constraints, validation command, expected output, and whether to stop or continue.
Assign non-overlapping files or sequence dependent work.
Use groups only for broadcasts that truly apply to every member.
Ask before killing agents you did not start, destructive actions, production/shared-system actions, or product decisions.

Example:

ai-devkit agent send --id auth-review "Review auth middleware in /repo. Do not edit files. Report security findings with file/line references, ranked by severity."

agent-management— agent skill

Is agent-management safe to install?

Agent Management

Workflow

Commands

Assignment Rules

Audit the pieces. Scan the whole. Decide.