smolagents-code-agents — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited smolagents-code-agents (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use code actions when an agent benefits from loops, variables, data transforms, and multi-call tool composition. Treat generated code as untrusted unless it runs in a real sandbox.
transformers, or Ollama.CodeAgent and ToolCallingAgent.CodeAgent when actions need Python control flow; choose ToolCallingAgent for simple structured tool calls.Never treat LocalPythonExecutor as a security boundary for untrusted code. Use it only for trusted local experiments.
Generate a starter safety scaffold:
python skills/agent-design/smolagents-code-agents/scripts/smolagent_safety_scaffold.py --name research_agentReview sandboxing-checklist.md before running any agent that executes model-written code.
| Requirement | Choose |
|---|---|
| Agent writes Python actions | CodeAgent |
| Strict JSON-like tool calls | ToolCallingAgent |
| Untrusted tasks or web data | Sandboxed executor |
| Local model experiments | TransformersModel or Ollama-compatible provider |
| Hosted provider flexibility | InferenceClientModel, LiteLLMModel, or OpenAI-compatible model |
| Mistake | Fix |
|---|---|
| Running untrusted code locally | Use Docker or managed sandbox |
| Exposing broad filesystem access | Mount a temporary workspace only |
| Giving tools vague docstrings | Make inputs, outputs, and side effects explicit |
| Letting agents import anything | Whitelist imports per task |
| Shipping without trace logs | Persist steps, code snippets, tool outputs, and final answer |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.