agent-collaboration-protocol — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited agent-collaboration-protocol (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Three roles collaborate through a shared workspace:
| Role | Responsibility |
|---|---|
| Orchestrator | Defines the contract, spawns both builders, verifies integration, merges |
| Backend Engineer | Writes API code, data models, infrastructure |
| Frontend Engineer | Writes UI components, templates, styles |
The contract lives in shared/build-{YYYYMMDD}/. Both builders write to the same directory. The orchestrator inspects and merges when both are done.
shared/build-{YYYYMMDD}/
SPEC.md ← Integration contract
backend/ ← Backend Engineer writes here
frontend/ ← Frontend Engineer writes here
integration.md ← Both update as they workWrite SPEC.md with these sections:
# SPEC: {Feature Name}
## Contract
- API base path, auth scheme, content type
- Data models (all entities, fields, types, relationships)
- Endpoints (method, path, request/response shapes)
- Error format
## Routes
Backend Engineer implements these. Frontend Engineer consumes them.
## UI Components
Frontend Engineer builds these. Backend Engineer doesn't touch them.
## Success Criteria
Observable behavior. Not "tests pass" — "user can log in and see calendar."Spawn two subagents with sessions_spawn:
Backend Engineer:
task: >
Implement the API spec in shared/build-{YYYYMMDD}/SPEC.md.
Write all backend code to shared/build-{YYYYMMDD}/backend/.
Update shared/build-{YYYYMMDD}/integration.md with progress.
Use {backend framework} (FastAPI, Express, etc.).Frontend Engineer:
task: >
Implement the UI for the spec in shared/build-{YYYYMMDD}/SPEC.md.
Write all frontend code to shared/build-{YYYYMMDD}/frontend/.
Use the API contract in SPEC.md for your fetch calls.
Update shared/build-{YYYYMMDD}/integration.md with progress.
Use {frontend stack} (HTMX+Tailwind, React, etc.).Set mode: "run" for one-shot completion.
Backend Engineer writes to shared/build-{YYYYMMDD}/backend/:
integration.md with progress and any blockersFrontend Engineer writes to shared/build-{YYYYMMDD}/frontend/:
integration.md with progress and any blockersintegration.md from both agentsbackend/ and frontend/Run once per project to initialize the collaboration structure:
scripts/init_collab.sh /path/to/projectCreates shared/ with template SPEC.md and .gitignore.
For deeper patterns and templates:
references/spec-template.md — Full SPEC.md template with examplesreferences/integration-log.md — integration.md status formatreferences/handoff-format.md — Task handoff message templatesessions_spawn tool (OpenClaw v1.0+)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.