workos — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited workos (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Claude Code plugin with five skills for running a Cowork-style markdown workspace. Designed to compound context over time and keep CLAUDE.md / MEMORY.md lean.
In Claude Code:
/plugin marketplace add dylanmoo/workos-plugin
/plugin install workosThat's it. The five skills below become available as slash commands.
CLAUDE.md with routing map, MEMORY.md, ARCHIVE.md, plus per-domain and per-project CLAUDE.md + MEMORY.md. Detects group containers (folders like clients/ that bundle multiple projects) and routes through them via full relative paths. Tags every file it creates with a workos-init-scaffold sentinel. Never moves existing files.workos-init-scaffold sentinel, removes clean scaffold files automatically, and asks file-by-file what to do with edited ones. Never deletes any folder or any file without the sentinel.CLAUDE.md + MEMORY.md) and registers it in the right routing map (root or parent domain). Asks for name, identity, and routing condition.CLAUDE.md and MEMORY.md. Projects are the unit that compounds.personal/, clients/, research/.clients/ containing acme/, widgetco/). Groups are pure folder containers — they don't get their own CLAUDE.md. The domain's routing map points directly to grouped projects via paths like clients/acme/.| Skill | Cadence |
|---|---|
/init-workos | Once per workspace, on the first session in a new directory |
/uninit-workos | Only when you want to revert init-workos and get back to your pre-WorkOS structure |
/session-audit | End of every working session |
/create-project | When starting a new client engagement, recurring workflow, or area of work that deserves its own folder |
/workspace-audit | Weekly first month, monthly after — or any time output quality slips |
WorkOS gets sharper the more you use it. Every correction, decision, and fact has a home that future sessions automatically inherit. The loop:
/init-workos in your project directory. The scaffold lands on top of your existing files; nothing moves or gets renamed.MEMORY.md at the relevant scope. Say "remember this" mid-session to file a fact. End the session with "audit this session" to run /session-audit, which scans the conversation for corrections and decisions you didn't think to save and proposes where each belongs./create-project whenever a new client, effort, or recurring area emerges. Three questions, one new routable folder with its own CLAUDE.md and MEMORY.md./workspace-audit. Flags misplaced entries, oversized files, completed projects to archive, and content that should cascade to a more specific scope.| What you have | Where it lives |
|---|---|
A rule ("always do X", "never do Y") | CLAUDE.md — most-specific scope wins (project > domain > root) |
| A mutable fact (contact, status, decision) | MEMORY.md — same scoping |
| Durable knowledge true on a 6-month horizon | {domain}/resources/<topic>.md |
| Source material (transcripts, articles, raw notes) | {domain}/raw/ |
| Completed projects, aged-out facts | ARCHIVE.md — write-only, never read at session start |
Corrections given once become rules. Facts mentioned once stay recalled. Lessons distilled from experience accumulate in resources/. The agent grows into your specific working style instead of resetting every session. Most of this happens automatically — you just need to actually run /session-audit at the end and /workspace-audit on a cadence.
When a new version ships:
/plugin update workosClaude Code also checks for updates periodically on its own.
The slash command /create-workstation is renamed to /create-project. Same behavior, simpler name. Existing scaffolded files (which never used the term workstation outside of the description in older CLAUDE.md templates) are unaffected on disk — but if you have automation referencing /create-workstation, update it to /create-project.
workos-plugin/
├── .claude-plugin/
│ ├── marketplace.json ← lets you `/plugin marketplace add` this repo
│ └── plugin.json ← the plugin manifest
├── skills/
│ ├── init-workos/SKILL.md
│ ├── uninit-workos/SKILL.md
│ ├── create-project/SKILL.md
│ ├── session-audit/SKILL.md
│ └── workspace-audit/SKILL.md
└── README.mdBuilt from patterns in Jeff Su's Cowork tutorials and adapted for a more flexible multi-domain layout. The original Cowork terminology uses "workstation"; this plugin uses "project" for clarity.
MIT — see LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.