create-agent — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited create-agent (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Create a subagent that earns its own context window: one clear role, a tightly curated tool allowlist, and a system prompt focused enough that the main agent knows exactly when to delegate to it. Then regenerate the derived files and validate.
Source layout is agents/<category>/<name>/AGENT.md. Agents are file-layout: the folder must contain only AGENT.md, because it installs as the single file .claude/agents/<name>.md. The category is the folder; the per-agent registry.json, the root registry.json, and the README catalog are all generated by pnpm gen. Never hand-edit generated files.
Bash unless it must run commands, omit write tools for a read-only reviewer. Inheriting everything defeats the purpose.pnpm gen rejects extra files because the agent installs as one file. Reference material for the agent goes in its system prompt, not a sidecar..claude/agents/<name>.md.pnpm gen.Pin down before writing a line:
description.opus for synthesis and hard judgment, haiku for cheap high-volume work, inherit (the default) when it should match the session.If the role is fuzzy or sounds like two jobs, sharpen or split it now.
From the repo root, let the scaffolder create the folder, stub, and regenerate in one step:
pnpm new --type agent --category <category> --name <name> --description "<what it does. Use when ...>"Current agent categories: engineering, research. Reuse one unless a genuinely new family is justified. The scaffolder enforces kebab-case and global name uniqueness, so a bad name fails fast.
Required: name, description. The rest are optional but shape behavior, cost, and UI. Full field table and valid values: reference/frontmatter.md.
: in the value; it is YAML).user / project / local for cross-session learning). pnpm validate rejects an invalid color, memory scope, or model, so typos fail in CI.The markdown body is the agent's system prompt. Address the agent in the second person, imperative. The shape that works:
Keep it focused. A subagent's prompt should be sharp, not a second copy of the whole repo's conventions.
pnpm gen # writes registry.json files and the README catalog
pnpm validate # checks frontmatter values + layout, then shadcn registry validateIf pnpm validate flags the frontmatter or layout, fix the source AGENT.md and rerun; never patch generated output.
description would actually get the agent delegated to on the intended situations, and not over-trigger.AGENT.md.color/memory/model are valid and pnpm validate passes.Report the agent's path, category, its tools and model, and the validation result. Leave committing to the user.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.