openai-agents — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited openai-agents (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Complete skill for building AI applications with OpenAI Agents SDK (JavaScript/TypeScript), covering text agents, realtime voice agents, multi-agent workflows, and production deployment patterns.
Install required packages:
npm install @openai/agents zod@3
npm install @openai/agents-realtime # For voice agentsSet environment variable:
export OPENAI_API_KEY="your-api-key"Supported runtimes:
LLMs equipped with instructions and tools:
import { Agent } from '@openai/agents';
const agent = new Agent({
name: 'Assistant',
instructions: 'You are helpful.',
tools: [myTool],
model: 'gpt-4o-mini',
});Functions agents can call, with automatic schema generation:
import { tool } from '@openai/agents';
import { z } from 'zod';
const weatherTool = tool({
name: 'get_weather',
description: 'Get weather for a city',
parameters: z.object({
city: z.string(),
}),
execute: async ({ city }) => {
return `Weather in ${city}: sunny`;
},
});Multi-agent delegation:
const specialist = new Agent({ /* ... */ });
const triageAgent = Agent.create({
name: 'Triage',
instructions: 'Route to specialists',
handoffs: [specialist],
});Input/output validation for safety:
const agent = new Agent({
inputGuardrails: [homeworkDetector],
outputGuardrails: [piiFilter],
});Type-safe responses with Zod:
const agent = new Agent({
outputType: z.object({
sentiment: z.enum(['positive', 'negative', 'neutral']),
confidence: z.number(),
}),
});import { run } from '@openai/agents';
const result = await run(agent, 'What is 2+2?');
console.log(result.finalOutput);
console.log(result.usage.totalTokens);const stream = await run(agent, 'Tell me a story', {
stream: true,
});
for await (const event of stream) {
if (event.type === 'raw_model_stream_event') {
const chunk = event.data?.choices?.[0]?.delta?.content || '';
process.stdout.write(chunk);
}
}Templates:
templates/text-agents/agent-basic.tstemplates/text-agents/agent-streaming.tsCreate specialized agents and route between them:
const billingAgent = new Agent({
name: 'Billing',
handoffDescription: 'For billing and payment questions',
tools: [processRefundTool],
});
const techAgent = new Agent({
name: 'Technical',
handoffDescription: 'For technical issues',
tools: [createTicketTool],
});
const triageAgent = Agent.create({
name: 'Triage',
instructions: 'Route customers to the right specialist',
handoffs: [billingAgent, techAgent],
});Templates:
templates/text-agents/agent-handoffs.tsReferences:
references/agent-patterns.md - LLM vs code orchestrationValidate input before processing:
const homeworkGuardrail: InputGuardrail = {
name: 'Homework Detection',
execute: async ({ input, context }) => {
const result = await run(guardrailAgent, input);
return {
tripwireTriggered: result.finalOutput.isHomework,
outputInfo: result.finalOutput,
};
},
};
const agent = new Agent({
inputGuardrails: [homeworkGuardrail],
});Filter responses:
const piiGuardrail: OutputGuardrail = {
name: 'PII Detection',
execute: async ({ agentOutput }) => {
const phoneRegex = /\b\d{3}[-. ]?\d{3}[-. ]?\d{4}\b/;
return {
tripwireTriggered: phoneRegex.test(agentOutput as string),
outputInfo: { detected: 'phone_number' },
};
},
};Templates:
templates/text-agents/agent-guardrails-input.tstemplates/text-agents/agent-guardrails-output.tsRequire approval for specific actions:
const refundTool = tool({
name: 'process_refund',
requiresApproval: true, // ← Requires human approval
execute: async ({ amount }) => {
return `Refunded $${amount}`;
},
});
// Handle approval requests
let result = await runner.run(input);
while (result.interruption) {
if (result.interruption.type === 'tool_approval') {
const approved = await promptUser(result.interruption);
result = approved
? await result.state.approve(result.interruption)
: await result.state.reject(result.interruption);
}
}Templates:
templates/text-agents/agent-human-approval.tsimport { RealtimeAgent, tool } from '@openai/agents-realtime';
const voiceAgent = new RealtimeAgent({
name: 'Voice Assistant',
instructions: 'Keep responses concise for voice',
tools: [weatherTool],
voice: 'alloy', // alloy, echo, fable, onyx, nova, shimmer
model: 'gpt-4o-realtime-preview',
});import { RealtimeSession } from '@openai/agents-realtime';
const session = new RealtimeSession(voiceAgent, {
apiKey: sessionApiKey, // From your backend!
transport: 'webrtc', // or 'websocket'
});
session.on('connected', () => console.log('Connected'));
session.on('audio.transcription.completed', (e) => console.log('User:', e.transcript));
session.on('agent.audio.done', (e) => console.log('Agent:', e.transcript));
await session.connect();CRITICAL: Never send your main OPENAI_API_KEY to the browser! Generate ephemeral session tokens server-side.
Voice agents support handoffs with constraints:
const specialist = new RealtimeAgent({
voice: 'nova', // Must match parent
/* ... */
});
const triageAgent = new RealtimeAgent({
voice: 'nova',
handoffs: [specialist],
});Templates:
templates/realtime-agents/realtime-agent-basic.tstemplates/realtime-agents/realtime-session-browser.tsxtemplates/realtime-agents/realtime-handoffs.tsReferences:
references/realtime-transports.md - WebRTC vs WebSocketimport { Agent, run } from '@openai/agents';
export default {
async fetch(request: Request, env: Env) {
const { message } = await request.json();
process.env.OPENAI_API_KEY = env.OPENAI_API_KEY;
const agent = new Agent({
name: 'Assistant',
instructions: 'Be helpful and concise',
model: 'gpt-4o-mini',
});
const result = await run(agent, message, {
maxTurns: 5,
});
return new Response(JSON.stringify({
response: result.finalOutput,
tokens: result.usage.totalTokens,
}), {
headers: { 'Content-Type': 'application/json' },
});
},
};Limitations:
Templates:
templates/cloudflare-workers/worker-text-agent.tstemplates/cloudflare-workers/worker-agent-hono.tsReferences:
references/cloudflare-integration.md// app/api/agent/route.ts
import { NextRequest, NextResponse } from 'next/server';
import { Agent, run } from '@openai/agents';
export async function POST(request: NextRequest) {
const { message } = await request.json();
const agent = new Agent({
name: 'Assistant',
instructions: 'Be helpful',
});
const result = await run(agent, message);
return NextResponse.json({
response: result.finalOutput,
});
}Templates:
templates/nextjs/api-agent-route.tstemplates/nextjs/api-realtime-route.tsError: Type errors with tool parameters.
Workaround: Define schemas inline.
// ❌ Can cause type errors
parameters: mySchema
// ✅ Works reliably
parameters: z.object({ field: z.string() })Source: GitHub #188
Error: "No existing trace found" with MCP servers.
Workaround:
import { initializeTracing } from '@openai/agents/tracing';
await initializeTracing();Source: GitHub #580
Error: Agent loops infinitely.
Solution: Increase maxTurns or improve instructions:
const result = await run(agent, input, {
maxTurns: 20, // Increase limit
});
// Or improve instructions
instructions: `After using tools, provide a final answer.
Do not loop endlessly.`Error: Tool execution fails.
Solution: Retry with exponential backoff:
for (let attempt = 1; attempt <= 3; attempt++) {
try {
return await run(agent, input);
} catch (error) {
if (error instanceof ToolCallError && attempt < 3) {
await sleep(1000 * Math.pow(2, attempt - 1));
continue;
}
throw error;
}
}Error: Output doesn't match outputType.
Solution: Use stronger model or add validation instructions:
const agent = new Agent({
model: 'gpt-4o', // More reliable than gpt-4o-mini
instructions: 'CRITICAL: Return JSON matching schema exactly',
outputType: mySchema,
});All Errors: See references/common-errors.md
Template: templates/shared/error-handling.ts
Agent decides routing autonomously:
const manager = Agent.create({
instructions: 'Analyze request and route to appropriate agent',
handoffs: [agent1, agent2, agent3],
});Pros: Adaptive, handles complexity Cons: Less predictable, higher tokens
Explicit control flow:
const summary = await run(summarizerAgent, text);
const sentiment = await run(sentimentAgent, summary.finalOutput);
if (sentiment.finalOutput.score < 0.3) {
await run(escalationAgent, text);
}Pros: Predictable, lower cost Cons: Less flexible
Run multiple agents concurrently:
const [summary, keywords, entities] = await Promise.all([
run(summarizerAgent, text),
run(keywordAgent, text),
run(entityAgent, text),
]);Template: templates/text-agents/agent-parallel.ts
References: references/agent-patterns.md
Enable verbose logging:
process.env.DEBUG = '@openai/agents:*';Access execution details:
const result = await run(agent, input);
console.log('Tokens:', result.usage.totalTokens);
console.log('Turns:', result.history.length);
console.log('Current Agent:', result.currentAgent?.name);Template: templates/shared/tracing-setup.ts
✅ Use when:
❌ Don't use when:
openai-api skill instead)OPENAI_API_KEY as environment secretmaxTurns to prevent runaway costsgpt-4o-mini where possible for cost efficiencyEstimated Savings: ~60%
| Task | Without Skill | With Skill | Savings |
|---|---|---|---|
| Multi-agent setup | ~12k tokens | ~5k tokens | 58% |
| Voice agent | ~10k tokens | ~4k tokens | 60% |
| Error debugging | ~8k tokens | ~3k tokens | 63% |
| Average | ~10k | ~4k | ~60% |
Errors Prevented: 9 documented issues = 100% error prevention
Text Agents (8):
agent-basic.ts - Simple agent with toolsagent-handoffs.ts - Multi-agent triageagent-structured-output.ts - Zod schemasagent-streaming.ts - Real-time eventsagent-guardrails-input.ts - Input validationagent-guardrails-output.ts - Output filteringagent-human-approval.ts - HITL patternagent-parallel.ts - Concurrent executionRealtime Agents (3):
realtime-agent-basic.ts - Voice setuprealtime-session-browser.tsx - React clientrealtime-handoffs.ts - Voice delegationFramework Integration (4):
worker-text-agent.ts - Cloudflare Workersworker-agent-hono.ts - Hono frameworkapi-agent-route.ts - Next.js APIapi-realtime-route.ts - Next.js voiceUtilities (2):
error-handling.ts - Comprehensive errorstracing-setup.ts - Debuggingagent-patterns.md - Orchestration strategiescommon-errors.md - 9 errors with workaroundsrealtime-transports.md - WebRTC vs WebSocketcloudflare-integration.md - Workers limitationsofficial-links.md - Documentation linksVersion: SDK v0.2.1 Last Verified: 2025-10-26 Skill Author: Jeremy Dawes (Jezweb) Production Tested: Yes
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.