datarobot-agent-assist — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited datarobot-agent-assist (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill covers agent design, coding, battle-testing, and deployment with an optional dress-rehearsal simulation before any code is written.
A first message of 1–4 selects the corresponding category. If free text clearly maps to one category (e.g. "I want to build an agent" → Design), state the inference briefly and proceed. If ambiguous, ask which option applies — do not guess.
Follow this skill sequentially. These rules apply to every phase — design, coding, deployment, and every referenced checklist.
agent-assist-build/references/, read that file first, then execute every step in that file in order. Do not substitute a summary, shortcut, or a later menu for steps defined in the reference.<prerequisites_passed> is true, or Frontend Check when frontend.type is already set).Present the four options clearly:
Welcome! I help you design, code, battle-test, and deploy AI agents.
What would you like to do?
1. Design an AI agent → Describe your idea (optional dress rehearsal before coding)
2. Code an AI agent → Load and implement an existing agent_spec.yaml
3. Battle-test the agent → Run adversarial swarm simulation on an implemented agent
4. Deploy → Deploy an implemented agent to DataRobotShow this menu first. After the user selects an option (1, 2, 3, or 4), run the [Pre-requisite Check](#pre-requisite-check) (once per session) and then the [Script Path Resolution](#script-path-resolution).
agent-assist-simulate/SKILL.md and jump to Pre-flight Check (Pre-requisite Check and Script Path Resolution still apply first).Before invoking any helper script, resolve <skill_scripts_dir> once for the session:
<skill_scripts_dir> is the agent-assist-build/scripts/ subdirectory of the directory containing this SKILL.md file.ls <path_to_this_skill_dir>/agent-assist-build/scripts/. If the directory is missing, tell the user the skill installation is incomplete and stop.<skill_scripts_dir>/... reference in this skill.Track these for the conversation:
<target_dir> — project root. Set during Workspace Resolution or the Pre-deployment Checklist. Reuse across phases. Change only on explicit user request, pre-coding Bootstrap step 2 (spec path recovery), pre-coding step 7 (subdir recovery), or a new session.<prerequisites_passed> — false until the Pre-requisite Check completes successfully once this session.<workspace_resolved> — false until Workspace Resolution completes for menu options 1 or 2.<workspace_resolved_target_dir> — the <target_dir> set when workspace resolution last completed.<design_to_code> — false until the user chooses Code the agent from Post-design next steps in the same session after design.<design_messy_cwd> — false until design runs in cwd with files other than agent_spec.yaml / .env (see workspace-resolution).<dependency_check_passed> — false until a passing dr dependency check in <target_dir>.<dependency_check_target_dir> — the <target_dir> value when the last check passed..env placementProject credentials and config live only at <target_dir>/.env — never in cwd when <target_dir> is a subdirectory. This includes DataRobot CLI credentials, LLM config, and tool/service secrets. Pulumi reads these from the environment at deploy time (os.environ); a secret missing from .env means the corresponding credential and runtime parameter are not created.
.env file.--target-dir <target_dir> to helper scripts that read or create .env (list_llm_models.py, rehearsal.py, setup_template.py). Do not run dr dotenv setup in cwd.agent_spec.yaml or source code — only env var names belong in infra; values stay in .env.Always write new or updated specs to <target_dir>/agent_spec.yaml. When reading or locating a spec, check agent_spec.yaml first and fall back to the legacy <target_dir>/agent_spec.md; if both exist, agent_spec.yaml is authoritative. Do not write updates to the legacy file.
Before running dependency validation:
<dependency_check_passed> is true and <target_dir> equals <dependency_check_target_dir>, skip validation.<target_dir>.Invalidate <dependency_check_passed> (set to false) when:
<target_dir> changesclone_template.py, select_framework.py, or setup_template.py runs in <target_dir>When showing the welcome menu again (e.g. user declined pre-coding step 7): set <workspace_resolved> = false, clear <workspace_resolved_target_dir>, <design_to_code> = false, and <design_messy_cwd> = false. Keep <prerequisites_passed> true.
Read and follow agent-assist-build/references/workspace-resolution.md after menu options 1 or 2.
If <prerequisites_passed> is true, skip this section.
Otherwise, run in order before proceeding:
git --version. If missing, tell the user to install from https://git-scm.com and stop.python --version. If missing or below 3.11, tell the user to install Python 3.11+ from https://python.org and stop.python <skill_scripts_dir>/check_codespace.py (no-op outside a Codespace). On non-zero exit, relay its message and stop; otherwise relay any exposed-ports warning it prints.On success, set <prerequisites_passed> = true.
When either <target_dir>/agent_spec.yaml or the legacy <target_dir>/agent_spec.md exists, read and follow resume-design.md after workspace resolution or when returning from Spec issues. Prefer the YAML file if both exist. Start at Clarification Phase only when neither file exists.
frontend field and write frontend.type to agent_spec.yaml — do not defer or wait for Frontend Check.<target_dir> from workspace resolution — see .env placement): python <skill_scripts_dir>/list_llm_models.py \
--json \
--target-dir <target_dir>CRITICAL: Always pass --target-dir <target_dir>. In case the script fails due to any reason, do not proceed. Instead, return the error message to the user and ask how they want to proceed.
gateway and deployed) and record the choice.Skip this section if frontend.type is already captured — either written to <target_dir>/agent_spec.yaml, or held in working memory from Clarification Phase before the first draft exists.
Before the first spec draft, if frontend.type is not yet set, always ask:
"The template includes a default chat UI — is that sufficient, or would you like a custom frontend such as a dashboard, data visualization, or multi-page app?"
Then set frontend in the spec (write to <target_dir>/agent_spec.yaml when the file exists, or hold the value for the first draft in Spec Display):
frontend.type: "chat"frontend.type: "multi-page" or "custom" with pages and optional requirementsfrontend.type from Frontend Check (or clarification).When spec refinement is complete, read agent-assist-build/references/dress-rehearsal.md and present the Initial prompt (design phase) using that file's exact wording — in its own turn, with no spec-refinement question in the same message.
Then follow dress-rehearsal.md for the user's reply (yes → rehearsal; no → Post-design next steps).
After the user declines the initial rehearsal prompt — or after a dress rehearsal session ends and <target_dir>/rehearsal_report/rehearsal_report.md has been written — present this menu (exact wording):
What would you like to do next? 1. Code the agent — start implementation fromagent_spec.yaml2. Review / edit spec — refineagent_spec.yaml3. Run dress rehearsal — simulate the agent before coding 4. Review rehearsal report — openrehearsal_report/rehearsal_report.md
Wait for their choice. Do not assume a default or proceed without a reply.
| Choice | Action |
|---|---|
| 1 or "code" / "implement" | Set <design_to_code> = true. Follow [2. Coding an AI Agent](#2-coding-an-ai-agent) — read and follow pre-coding-checklist.md. This does not authorize cloning or subdirectory creation; if the workspace is not spec-only, complete pre-coding step 7 and wait for explicit confirmation first. |
| 2 or "review" / "edit spec" | Display <target_dir>/agent_spec.yaml as YAML, invite changes, update the file, then show this menu again |
| 3 or "rehearsal" / "simulate" | Follow [Dress Rehearsal](#dress-rehearsal) |
| 4 or "review report" / "rehearsal report" | If <target_dir>/rehearsal_report/rehearsal_report.md exists, read it and present a structured summary (metadata, notes, conversation highlights, suggested changes). If missing, say no report exists yet and offer option 3. Then show this menu again. |
If the user's reply is unclear, re-display the menu and wait. Never skip straight to framework selection after a rehearsal decline.
Read and follow agent-assist-build/references/dress-rehearsal.md end to end.
On Windows: coding is not supported. STOP and do NOT proceed with the next steps!
Read and follow agent-assist-build/references/pre-coding-checklist.md end to end before writing or editing implementation code. Do not write or edit implementation code until the checklist is complete.
<target_dir> and its subdirectories.env files (.env.template files are OK)auth_spec in agent_spec.yaml:SCREAMING_SNAKE_CASE env var name (e.g. PERPLEXITY_API_KEY).VAR_NAME= to <target_dir>/.env without reading the file.<target_dir>/.env in their editor — never in chat, agent_spec.yaml, or committed code.<target_dir>/AGENTS.md to find the local test command.<target_dir> to test the agent locally."Read agent-assist-simulate/SKILL.md and jump directly to Pre-flight Check — skip its On Activation menu. Also trigger directly when the user says "simulate my agent", "run swarm", "adversarial testing", "harden my agent", or "test my agent".
Swarm requires an implemented agent; if none exists, explain and offer option 2. If code exists and no option is chosen, proactively offer: "I can also battle-test your agent before deploying — want to run swarm simulation?"
After deploy, offer datarobot-gap-analysis to score enterprise readiness.
Read and follow agent-assist-deploy-workload/references/deploy-path.md. It picks the Workload API or the Pulumi deploy. If <target_dir> is unset, resolve it first as in step 1 of the Pre-deployment Checklist.
Helper-script failures during pre-coding are governed by the CRITICAL rule in pre-coding-checklist.md.
Write specs as YAML to <target_dir>/agent_spec.yaml. Fields are optional while the spec is evolving.
Field definitions: agent-assist-build/references/agent-spec-schema.md. Complete examples: agent-assist-build/references/agent-spec-examples.md.
1–4; for clear free-text intent, infer and state the category then proceed; if ambiguous, ask which option appliesoutput_file verbatim; on DONE always run --report before any summary or menu; write <target_dir>/rehearsal_report/rehearsal_report.md before showing Post-design next stepsFor helper script commands, see helper-scripts.md. For plugin tool mapping, see tool-mapping.md.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.