Fallow Skills — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Fallow Skills (Plugin) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<p align="center"> <picture> <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/fallow-rs/fallow/main/assets/logo-dark.svg"> <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/fallow-rs/fallow/main/assets/logo.svg"> <img src="https://raw.githubusercontent.com/fallow-rs/fallow/main/assets/logo.svg" alt="fallow" width="290"> </picture><br> <strong>Agent skills for the fallow codebase intelligence layer for TypeScript and JavaScript.</strong><br><br> <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-blue.svg" alt="MIT License"></a> <a href="https://github.com/fallow-rs/fallow-skills/actions/workflows/validate.yml"><img src="https://github.com/fallow-rs/fallow-skills/actions/workflows/validate.yml/badge.svg" alt="CI"></a> <a href="https://agentskills.io"><img src="https://img.shields.io/badge/Agent_Skills-compatible-8A2BE2" alt="Agent Skills"></a> <a href="https://github.com/fallow-rs/fallow"><img src="https://img.shields.io/badge/fallow-v3.36.0-orange" alt="fallow v3.36.0"></a> </p>
Agent skills for fallow, codebase intelligence for TypeScript and JavaScript. The static layer reports quality, changed-code risk, cleanup opportunities, circular dependencies, code duplication, complexity hotspots, architecture boundary violations, and design-system styling drift in milliseconds. Fallow Cloud, the optional paid product, adds production coverage so agents can delete cold code and flag hot-path changes with proof. Broad framework plugin coverage, zero configuration. Works with any agent that supports the Agent Skills specification: Claude Code, Cursor, OpenAI Codex, Windsurf, GitHub Copilot, Gemini CLI, Amp, and 30+ more. See Fallow for coding agents for the visual overview and store links.
Linters enforce style. Formatters enforce consistency. Fallow enforces relevance. Linters work file by file. TypeScript works type by type. Neither builds the full module graph, so neither can see what nothing depends on. Fallow does, in milliseconds. These skills teach agents how to use fallow effectively: which commands to run, what flags to use, how to interpret output, and how to avoid common pitfalls.
npx skills add fallow-rs/fallow-skills/plugin marketplace add fallow-rs/fallow-skills
/plugin install fallow@fallow-skillscodex plugin marketplace add fallow-rs/fallow-skills
codex plugin add fallow@fallow-skillsIn the Codex desktop app, this install also adds the Fallow app: a code health dashboard in the sidebar, a Code Health tab beside each thread, @Fallow mentions for findings, a .fallowrc.json editor with an impact preview, a .sarif viewer, a branch audit, and a cleanup planner that asks you which findings to fix. Select findings to attach them to the composer, or send them to Codex with one click. The app runs the fallow CLI on your machine, inside the Codex sandbox of the thread when one is available. See codex-app/README.md for every extension it uses.
Claude Code users can add the compact Fallow Impact segment to their statusline:
/fallow:impact-statusline setup user composeThe command doc covers status, remove, and the project scope. Other agents render the same line with fallow impact statusline.
npx skills add fallow-rs/fallow-skills --agent windsurf
npx skills add fallow-rs/fallow-skills --agent amp
gemini skills install https://github.com/fallow-rs/fallow-skills.git<details> <summary>Other agents</summary>
Use npx skills add fallow-rs/fallow-skills --all for installer-managed discovery, or copy the directories under fallow/skills/ into your agent's skills location.
</details>
Fallow must be installed in the target project:
npm install -g fallow # prebuilt binaries
npx fallow # or run without installingSee the installation guide for all options including cargo install fallow-cli.
Analysis runs locally by default and telemetry is off unless the user opts in. The plugin README lists the exact network, telemetry, and statusline behavior for the Claude Code and Codex surfaces.
| Skill | Description | Trigger phrases |
|---|---|---|
| fallow | Codebase intelligence for JS and TS, code and styles: quality, changed-code risk, cleanup opportunities, circular deps, duplication, complexity, design-system drift, and runtime evidence | "check code health", "audit this PR", "find cleanup opportunities", "find duplicates", "what code actually runs" |
| fallow-review | Graph-grounded review of changed-code risk, blast radius, and consequential structural decisions | "review this branch", "review this PR", "check changed code before merge" |
| fallow-setup | Set up or modernize code-quality tooling: detect existing tools, configure and install Fallow, wire agents, and add a CI gate | "set up quality tooling for this repo", "make this repo agent-ready", "add a code-health gate to CI" |
| fallow-codex-onboarding | Codex only: set up the Fallow app after install, choose defaults, run the first analysis | "Set up" in the Codex plugin page, "set up the Fallow app" |
See AGENTS.md for repository structure and quality standards. Each skill listed in source-lock.json is vendored byte-for-byte from the fallow source repository at the pinned commit. CI checks that pin against a clean source checkout and rejects contract or privacy-boundary drift. Maintainers can find the versioning, packaging, and store update procedure in RELEASING.md.
A fresh clone runs no hooks. Turn them on once per clone:
git config core.hooksPath .githooksThe hook only checks manifest version agreement and the bump rule; see .githooks/pre-commit for why it stops there.
MIT. See LICENSE for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.