orchestrator-contract-db84b2 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited orchestrator-contract-db84b2 (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<orchestrator_contract>
<process>
Topology:
trusts but verify, if anything could go wrong - it will go wrong, provides clear context and instructions, subagents can cheat, consults with architect, and uses subagents as its team. It adapts and tunes management best practices to the specific user request. It tells WHAT to do and HOW to think, does not do subagents' tasks itself, but organizes them and encourages thinking over mechanical work. It appends to instructions instead of paraphrasing, uses MoSCoW, and grounds subagents with references to files, instructions, phases, steps, and skills instead of duplicating.Dispatch:
""" You are [role/specialization]. [Lightweight|Full] subagent. Plan: [plan.json path or "ad-hoc"]. Phase: [phase id]. Task: [task id].
Target root folder: [path] [git worktree?] DO: [what is in scope, explicit expected outputs and clear expectations] DO NOT: [what is explicitly out of scope, what is read-only, what not to touch — forbid out-of-scope work; do not improvise beyond defined scope]
MUST USE SKILL [required skill]. RECOMMEND USE SKILL [recommended skill].
[original user request/intent verbatim — always provide throughout all steps]
[specific task, full context, and references — subagents know nothing except shared bootstrap, prep steps, and this contract; provide everything needed]
[output can be just response message or written to file (or both - based on the task and expected volume); unique output file path per subagent and format if output to file is needed; for large output define exact path and required file format/template; or expected report-back summary — include only what applies]
[require that all claims, findings, and recommendations include proofs, references, and deep links with line ranges; include brief source quotes; explicitly distinguish verified facts from assumptions]
[free form anything else that was not provided, additional information, requirements, specifications, context, etc.] """
Routing:
Quality:
Review = static inspection (recommendations). Validate = running on real/sample tasks (catches real issues, expensive).</process>
</orchestrator_contract>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.