new-cask — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited new-cask (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are orchestrating the creation of a new Homebrew cask. This skill coordinates multiple specialist agents and scripts to complete the workflow.
IMPORTANT: This skill runs in the main conversation context. You will use the Task tool to spawn agents for specialized work.
URL provided: $ARGUMENTS
If no URL was provided, ask the user for:
1. Pre-flight checks → Agent: pre-flight-checker
2. Download & inspect → Agent: app-inspector
3. Livecheck strategy → Agent: livecheck-advisor
4. Write cask file → Agent: cask-writer
5. Testing → Automated tests, install, createzap, uninstall
6. Submit PR → Agent: pr-submitterCreate a task list to track progress through these steps.
Before investing time, verify the app is suitable:
Use the Task tool:
- subagent_type: homebrew:pre-flight-checker
- prompt: Check if this app is suitable for homebrew-cask submission.
<include whatever info you have: URL, app name, homepage>The agent will derive any missing info (app name from URL, homepage via search, etc.) and include it in the output.
Capture from output: App name, homepage, download URL, description - you'll need these for later steps.
Decision point: If the agent returns REJECT, stop and explain why to the user. If CAUTION, inform the user and ask if they want to proceed.
Download and inspect the app in one step:
Use the Task tool:
- subagent_type: homebrew:app-inspector
- prompt: Download and inspect the app.
Download URL: <url>
Homepage: <homepage>The agent will download the file, compute the SHA256, extract all metadata, and run Homebrew's generate_cask_token tool to get the canonical token.
Capture from output: Suggested token, SHA256, version, bundle ID, app name, min macOS, auto-update info (framework, appcast URL if found), architecture.
Use the suggested token from app-inspector for subsequent steps. This token comes from Homebrew's tooling and handles naming conventions and collision detection.
Note on versioned URLs: If the download URL is unversioned (e.g., App.dmg), the livecheck-advisor may find a versioned URL in an appcast, release feed, or other source. If so, you'll need to re-download using the versioned URL to get the correct SHA256.
Determine how to check for updates:
Use the Task tool:
- subagent_type: homebrew:livecheck-advisor
- prompt: Recommend a livecheck strategy for <app-name>.
Download URL: <url>
Homepage: <homepage>
Update URL: <appcast-or-feed-url-if-found>
Current version: <version>Get the recommended livecheck block.
Synthesize everything into a cask file:
Use the Task tool:
- subagent_type: homebrew:cask-writer
- prompt: Write a cask for <app-name> with this metadata:
Token: <token>
Version: <version>
URL: <download-url>
SHA256: <checksum> (or :no_check if unversioned URL)
(If separate binaries per architecture, provide URL and SHA256 for each)
Name: <display-name>
Description: <one-line-desc>
Homepage: <homepage>
Bundle ID: <bundle-id>
App bundle: <app-name>.app
Min macOS: <min-version>
Auto-updates: <yes/no>
Livecheck: <livecheck-block>
Architecture: <arm64/intel/universal, only if not universal>Note: The zap stanza is added later after running createzap during testing.
#### Automated Tests
Run the validation script:
${CLAUDE_PLUGIN_ROOT}/scripts/test-cask.sh "<token>"If tests fail, review the output, fix the cask (often brew style --fix handles style issues), and re-run.
For unversioned URLs: Use --skip-livecheck flag.
#### Install and Validate
HOMEBREW_NO_INSTALL_FROM_API=1 brew install --cask <token> open -a "<App Name>"#### Zap Discovery
brew tap nrlquaker/createzap 2>/dev/null || true
brew createzap "<App Name>"
brew createzap "<bundle-id>" brew uninstall --cask <token>When ready to submit:
Use the Task tool:
- subagent_type: homebrew:pr-submitter
- prompt: Submit a PR for the <token> cask.
Version: <version>
Cask path: <path-to-cask-file>
All tests passed: yesIf any step fails:
For detailed guidance, agents can read these docs (at /opt/homebrew/docs/):
Acceptable-Casks.md - What's allowedCask-Cookbook.md - Stanza referenceBrew-Livecheck.md - Livecheck strategiesAdding-Software-to-Homebrew.md - Contribution processScripts are at ${CLAUDE_PLUGIN_ROOT}/scripts/:
download-checksum.sh <url> [filename] - Download and SHA256test-cask.sh <token> [--skip-livecheck] - Run audit/style/livecheck~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.