envelope-team — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited envelope-team (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Design and generate .envelope.json AI agent team definition files — the open standard for building and deploying multi-agent teams on Envelope.
.envelope.json file for deployment.envelope.json fileBuild me an Envelope team for customer support triage — one supervisor,
two agents that read Zendesk tickets, and a Slack notifier for escalations.Create an Envelope team definition for outbound sales — an SDR manager
overseeing two SDRs who work HubSpot leads and a RevOps analyst.Build an Envelope team that drafts marketing emails and pauses for
human approval before sending.User: "Build me an Envelope team for content moderation — a supervisor and two reviewer agents that check posts against community guidelines."
Output:
{
"$schema": "https://schema.openenvelope.org/team/v1.json",
"name": "Content Moderation Team",
"slug": "content-moderation",
"version": "1.0.0",
"description": "A supervisor and two reviewer agents that check posts against community guidelines.",
"visibility": "team",
"category": "ops",
"requiredVariables": ["companyName"],
"requiredSecrets": ["MODERATION_API_KEY"],
"metadata": { "generatedBy": "Claude Code · openenvelope.org" },
"agents": [
{
"key": "supervisor",
"name": "Moderation Supervisor",
"role": "supervisor",
"capabilities": ["Route content to reviewer agents", "Aggregate decisions", "Escalate edge cases"],
"model": "anthropic:claude-sonnet-4-5",
"systemPrompt": "You supervise the content moderation team at {{companyName}}. Delegate each item to a reviewer and consolidate their verdicts."
},
{
"key": "policy-reviewer",
"name": "Policy Reviewer",
"role": "reviewer",
"capabilities": ["Check content against community guidelines", "Flag policy violations"],
"model": "anthropic:claude-haiku-3-5",
"systemPrompt": "You review content for policy violations at {{companyName}}. Return a verdict of approve, flag, or remove with a reason.",
"reportsToKey": "supervisor",
"accessPolicy": {
"accessPolicyVersion": "1",
"rules": [
{ "host": "api.moderation-service.com", "action": "allow" },
{ "host": "*", "action": "deny" }
]
}
},
{
"key": "spam-reviewer",
"name": "Spam Reviewer",
"role": "reviewer",
"capabilities": ["Detect spam, bot activity, and duplicate content"],
"model": "anthropic:claude-haiku-3-5",
"systemPrompt": "You detect spam and bot activity at {{companyName}}. Return a verdict of approve, flag, or remove with a confidence score.",
"reportsToKey": "supervisor"
}
]
}| Field | Required | Description |
|---|---|---|
$schema | yes | Always https://schema.openenvelope.org/team/v1.json |
name | yes | Human-readable team name |
slug | yes | URL-safe, lowercase, hyphens only |
version | yes | Semver e.g. "1.0.0" |
description | yes | What this team does |
visibility | yes | "public" · "team" · "private" |
requiredVariables | no | Non-sensitive config, interpolated via {{varName}} |
requiredSecrets | no | API keys, stored encrypted, injected as ${SECRET_NAME} |
schedule | no | Cron schedule { cron, timezone, task } |
agents | yes | Agent definitions |
gates | no | Human-in-the-loop checkpoints |
| Field | Required | Description |
|---|---|---|
key | yes | Unique identifier within this file |
name | yes | Display name |
role | yes | Free-form e.g. "supervisor", "analyst", "sdr" |
capabilities | yes | What this agent can do — used for delegation routing |
model | yes | e.g. anthropic:claude-sonnet-4-5, anthropic:claude-haiku-3-5 |
systemPrompt | yes | Agent instructions. Use {{varName}} and ${SECRET_NAME} |
reportsToKey | no | key of manager agent. Omit for the top-level supervisor |
accessPolicy | no | Outbound HTTP allowlist |
Exactly one agent should have no reportsToKey — this is the supervisor that receives the initial task. All others reference their manager's key.
"accessPolicy": {
"accessPolicyVersion": "1",
"rules": [
{ "host": "api.example.com", "action": "allow" },
{ "host": "*", "action": "deny" }
]
}"gates": [
{
"name": "approval-check",
"type": "approval",
"trigger": { "afterAgent": "drafter" },
"onApprove": "continue",
"onReject": "halt"
}
]anthropic:claude-sonnet-4-5 for supervisors and managers; anthropic:claude-haiku-3-5 for leaf agents doing repetitive workrequiredVariables{ "host": "*", "action": "deny" } for a strict allowlistnpx @openenvelope/schema validate ./team.envelope.json~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.