deploy-team-hub-262f7f — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited deploy-team-hub-262f7f (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Deploy a multi-agent team that coordinates through Thoughtbox Hub.
/deploy-team <issue-id-or-description>When the coordinator registers on the Hub before spawning agents, the spawn prompts naturally include Hub bootstrap instructions. When the coordinator skips Hub registration and goes straight to exploration, the spawn prompts omit Hub integration entirely. This command codifies the sequence that works.
The hub is exposed as tb.hub.* inside the thoughtbox_execute MCP tool (the only registered Thoughtbox MCP tools are thoughtbox_search, thoughtbox_execute, and thoughtbox_peer_notebook). Register once per MCP session; the returned agentId is implicit for every later hub call in that session. Submit at most ONE state-mutating hub call per thoughtbox_execute invocation; read-only calls (tb.hub.whoami, tb.hub.listWorkspaces, tb.hub.readChannel, tb.hub.workspaceStatus) may be freely chained.
Before spawning ANY agent, verify these are true:
# Every agent definition must have ToolSearch in tools:
grep ToolSearch .Codex/agents/*.mdIf ANY agent file is missing ToolSearch, add it and COMMIT the change. Do not proceed until committed. Uncommitted changes get lost.
Execute these steps in this order. Do not skip ahead to exploration or spawning.
// thoughtbox_execute
async () => tb.hub.register({ name: "Coordinator", profile: "MANAGER" })Do NOT re-register later in the session — coordinator role is bound to this agentId, and tb.hub.mergeProposal must run from this same session.
async () => tb.hub.createWorkspace({ name: "<branch-name>", description: "<what we're doing and why>" })Create Hub problems with dependency chains (one mutation per thoughtbox_execute call).
async () => tb.hub.createProblem({ workspaceId: "...", title: "...", description: "..." })async () => tb.hub.addDependency({ workspaceId: "...", problemId: "...", dependsOnProblemId: "..." })Now do technical analysis. The workspace already exists, so findings get recorded there.
Every agent spawn prompt MUST include the following as Step 1, before ANY implementation work:
## Step 1: Bootstrap Thoughtbox (DO THIS FIRST — before any code changes)
Use ToolSearch to load mcp__thoughtbox__thoughtbox_execute. All hub and thought
operations are JavaScript against the `tb` SDK inside thoughtbox_execute — one
state-mutating call per invocation. Run these in order:
1. async () => tb.hub.quickJoin({ name: "<agent-name>", workspaceId: "<ID>", profile: "<PROFILE>" })
Record the agentId from the result. You share the MCP session with the
team-lead and other agents — the FIRST registration in the session is the
implicit default identity, so you MUST pass your own agentId explicitly in
every later tb.hub call or your work is attributed to another agent.
2. Read the `thoughtbox://cipher` MCP resource for cipher notation.
3. async () => tb.thought({ thought: "Starting work on <task description>", thoughtType: "reasoning", nextThoughtNeeded: true })
4. async () => tb.hub.postMessage({ agentId: "<your agentId>", workspaceId: "<ID>", problemId: "<ID>", content: "Joined and starting work on <task>" })
DO NOT proceed to Step 2 until all four steps succeed. If any call fails, report
the error. Do NOT re-register — that creates a new agentId.Additionally, throughout their work agents MUST:
tb.thought(...)tb.hub.postMessage({ agentId, ... })tb.hub.claimProblem({ agentId, ... }), tb.hub.updateProblem({ agentId, ... }))After spawning all agents, wait 90 seconds, then verify hub integration (both calls are read-only and may be chained in one thoughtbox_execute):
async () => {
// Workspace overview — all agents should appear
const status = await tb.hub.workspaceStatus({ workspaceId: "<ID>" });
// Channel messages — each agent should have posted at least one
const channel = await tb.hub.readChannel({ workspaceId: "<ID>", problemId: "<first-problem-ID>" });
return { status, channel };
}If ANY agent has NOT posted to the hub within 90 seconds:
This gate is non-negotiable. The entire purpose of Agent Teams is hub coordination. An agent that isn't on the hub is not doing its job.
Post coordination decisions to channels. Create consensus markers for architectural decisions (tb.hub.markConsensus). Review proposals from other agents (tb.hub.reviewProposal).
Shut down the coordinator LAST. The coordinator orchestrates shutdown of other teammates. Shutting it down first strands everyone.
Order:
Before spawning, define testable hypotheses for what the run should produce. Document them on the branch.
tb.hub.markConsensus — thoughtRef is a thought number)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.