dev-agent — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited dev-agent (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this as the single native entry skill for Dev Agent. The detailed workflow skills, personas, commands, references, templates, and gates live in the installed dev-agent-runtime/ folder.
For existing project work, do not start by reading workflow Markdown. Locate the runtime and run:
bin/dev-flow status <project-name>
bin/dev-flow next <project-name>Treat next as the execution brief and load only the command, skill, references, and project files it names. Use bin/dev-flow autonomy <project-name> for the standalone heartbeat/continue decision and bin/dev-flow delegate <project-name> for optional host subagent task packets. Use bin/dev-flow ui-polish <project-name> to record the single UI runtime visual pass before moving P2/P3 details to UI debt.
Prefer the visible entry:
/dev agent flow <flow-name> [project-name]/dev agent next <project-name>/dev agent check <gate-name> <project-name> [phase-or-options]/dev agent role <role-name> [task]Compatibility alias:
/dev-agent <action> ...Primary lifecycle flows are idea, spec, design, build, qa, and ship. qa and ship are optional unless the user or project applicability requires them.
Focused auxiliary flows include figma-design, figma-library, debug, ui, api, security, and code-simplify.
Supported roles are code-reviewer, product-designer, security-auditor, test-engineer, and ui-quality-reviewer. Invoke roles only on explicit user request or when the current risk needs that specialist view; lifecycle phases do not auto-require personas.
When command snippets are unavailable, locate the installed runtime in one of:
.codex/dev-agent-runtime/${CODEX_HOME:-$HOME/.codex}/dev-agent-runtime/.claude/dev-agent-runtime/$HOME/.claude/dev-agent-runtime/Then use bin/dev-flow status <project-name> and bin/dev-flow next <project-name> to load the current execution brief. Use bin/dev-flow manifest, bin/dev-flow command <flow-name>, and bin/dev-flow agent <role-name> only when the brief or maintenance task calls for them. Installed runtime commands manage <project-name>/ in the active workspace/current shell directory, or in DEV_FLOW_WORKSPACE_ROOT when set.
Do not copy project-specific work into the install directory. Project artifacts belong under <project-name>/ in the active workspace.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.