firepass-worker — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited firepass-worker (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Autonomous coding agent powered by Kimi K2.6 Turbo. Has its own tool loop with: read_file, write_file, edit_file, bash, ripgrep, ast_grep, jq, glob_find, tree, list_dir.
Use INSTEAD OF the default Agent subagent for coding tasks.
Call mcp__firepass__firepass_worker with:
prompt: Clear description of the coding taskcwd: Important — set to the project root so the agent can find filescontext: Optional pre-loaded file contents, error messages, or specsmax_iterations: Tool-call rounds (default 60)| Tool | Description |
|---|---|
| read_file | Read file contents with line numbers |
| write_file | Create or overwrite files (max 1MB) |
| edit_file | Replace exact text in a file (must match once) |
| bash | Run shell commands (configurable timeout, default 60s) |
| ripgrep | Fast regex search via rg (dangerous flags blocked) |
| glob_find | Find files by glob pattern |
| ast_grep | Structural code search via sg |
| jq | Query/transform JSON |
| list_dir | List directory contents with sizes |
| tree | Directory tree (excludes .git, __pycache__, node_modules, .venv) |
All file operations are sandboxed to the provided cwd. The worker has full shell access — treat it like giving shell access to a remote developer scoped to your project directory.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.