oma-coordination — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited oma-coordination (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Guide manual multi-agent coordination for complex work that spans PM, frontend, backend, mobile, and QA responsibilities.
oma agent spawn and progress/result memory conventions| Action | SSL primitive | Evidence |
|---|---|---|
| Read request and domains | READ | User prompt and project context |
| Select agent plan | SELECT | PM decomposition and priority tiers |
| Spawn agents | CALL_TOOL | oma agent spawn |
| Monitor progress | READ | injected task/run-scoped progress, claims, and receipts |
| Validate contracts | VALIDATE | API/data model alignment |
| Notify coordination status | NOTIFY | Final coordination summary |
oma agent spawn, PM/frontend/backend/mobile/QA agents../_shared/core/code-intelligence.md# If planning is required, dispatch the declared PM task first; otherwise reuse the current plan.
oma agent spawn pm <pm-prompt-file> <session-id> --task-id <plan.pm_task.id> -w ./pm
oma agent spawn backend <backend-prompt-file> <session-id> --task-id <plan.backend_task.id> -w ./backend &
oma agent spawn frontend <frontend-prompt-file> <session-id> --task-id <plan.frontend_task.id> -w ./frontend &
waitWhen native runtime dispatch is available (per-agent target vendor equals the current runtime vendor), prefer the runtime's native subagent path and use oma agent spawn as the cross-vendor fallback — same resolution rule as oma-orchestration.
Useful agent spawn options: --vendor <vendor> (CLI vendor override), --isolation worktree (git worktree per spawn, prevents file conflicts), --read-only (non-destructive tools only, e.g. for review/QA passes).
| Scope | Resource target |
|---|---|
LOCAL_FS | Progress/result files and workspaces |
PROCESS | Agent spawn commands |
MEMORY | Session state and task board |
CODEBASE | Shared contracts and implementation areas |
--isolation worktree for a git worktree per spawn)../_shared/core/code-intelligence.md: discover configured tools, do not auto-install or track, and use native search only for paths outside this project or ignored paths when unavailable or timed out#### Step 1: Plan with PM Agent
Reuse an existing valid plan. Otherwise, PM analyzes requirements and creates the task breakdown, acceptance checks, contracts, and priorities. Preserve injected session/task/run IDs; do not regenerate a plan already frozen by dispatch.
#### Step 2: Spawn Agents by Priority
Resolve the dispatch path per agent, then spawn:
agents: override, else model_preset)oma agent spawn for that agent# Example: spawn backend and frontend in parallel
oma agent spawn backend backend-prompt.md session-id --task-id plan.backend_task.id -w ./backend &
oma agent spawn frontend frontend-prompt.md session-id --task-id plan.frontend_task.id -w ./frontend &
wait#### Step 3: Monitor & Coordinate
../_shared/core/execution-policy.md for the execution deadline, resource ownership, and cancellation. Prefer host completion notifications; otherwise use one coordinator with bounded polling backoff. Cancellation or deadline exhaustion stops new dispatch, review, and recovery; use bounded termination checks and report survivors or unsupported cancellation in the handoff.{memoryConfig.basePath}/progress-{agentId}-{taskId}-{runId}-{sessionId}.md and the corresponding result- name; see ../_shared/runtime/memory-protocol.md. Keep the structured claim path unchanged.#### Step 4: QA Review
Review the coordinated deliverables with QA. Resolve blocking defects and required verification gaps through the responsible agents; rerun affected checks before finalizing.
For fully automated execution without manual spawning, use the orchestrator skill instead.
../_shared/core/collaboration-policy.md (before assigning parallel work or coordinating peer issues, ownership handoffs, and result collection)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.