openrig-installer-0f513d — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited openrig-installer-0f513d (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill teaches the operator agent how to install + upgrade OpenRig cleanly. The V0.3.1 upgrade is the one with the migration ceremony (substrate kernel → daemon-managed kernel); other upgrades follow the same install / setup / start shape with no migration.
npm install -g @openrig/cli
rig setuprig setup is idempotent — safe to re-run if a step fails. It probes host prereqs (tmux present, Node version, writable state path, optional cmux), then invokes rig daemon start per the L2 factoring (OQ-B). The daemon's start path auto-boots the kernel rig per the V0.3.1 slice 05 kernel-rig-as-default logic.
rig ps --nodes --rig kernel --jsonShould report 4 members (advisor.lead + operator.agent + operator.human + queue.worker) all ready. If a runtime is unavailable the daemon picks the matching variant (rig-claude-only.yaml or rig-codex-only.yaml); the topology stays the same shape with the unavailable runtime omitted from the agent membership.
Entry point for chatting with the rig:
rig capture advisor-lead@kernelOr click the CMUX button on the topology graph in the UI at /topology.
Operators with a kernel spec stored outside the daemon-managed location (any pre-V0.3.1 layout, typically wherever you kept your own rigs/kernel/ directory) must migrate to ~/.openrig/specs/rigs/kernel/ as a one-time step during the V0.3.1 upgrade. The V0.3.1 upgrade IS the migration moment; it's not a separate ceremony.
kernel so the migration is reversible:
rig snapshot kernelrunning rig):
rig down kernel --snapshotlocation:
mkdir -p ~/.openrig/specs/rigs/kernel
cp -r /path/to/old/kernel-spec/* ~/.openrig/specs/rigs/kernel/ npm install -g @openrig/[email protected]
rig daemon stop
rig daemon startAt this point the new daemon detects ~/.openrig/specs/rigs/kernel.yaml exists and skips the V0.3.1 builtin-kernel boot (the already-managed-rig branch). The substrate-rooted topology continues to run under daemon management.
rig ps --nodes --rig kernel --jsondaemon-managed copy works):
rm -rf /path/to/old/kernel-specThe pre-step snapshot is the rollback. rig restore <snapshot-id> --rig kernel revives the prior topology. Then npm install -g @openrig/[email protected] rolls the CLI back and you can retry later.
The operator agent shepherds operators through these steps when the user asks "how do I upgrade?" or "what's the V0.3.1 ceremony?". The agent reads this skill on demand via find-skills — it does not need to memorize the steps; it consults the canonical reference (this file) and walks the operator through.
| What failed | Why it matters | Fix |
|---|---|---|
npm install -g @openrig/cli permission denied | Global install needs writable npm prefix; macOS Homebrew default is usually writable; some custom Node installs aren't | Either fix the npm prefix permissions or use sudo npm install -g; check npm config get prefix |
rig setup host prereq fail | tmux, Node version, or writable state path missing | rig doctor lists each missing piece + the install command; run those, retry rig setup |
rig daemon start auth-block error | Neither Claude Code nor Codex authenticated; kernel rig requires at least one | Run claude auth login OR codex login; then retry rig daemon start |
rig daemon start "kernel already managed" | An existing managed rig named kernel exists; the daemon skips builtin-boot per design | This is the expected path after migration — no action needed |
rig ps --rig kernel --json returns empty | Daemon healthy but no kernel rig managed; likely the migration step copied content but did not boot | rig up kernel from inside ~/.openrig/specs/rigs/kernel/; or invoke the daemon's cold-boot path explicitly |
openrig-user skill.
that's openrig-operator.
up <spec>` after the kernel is in place.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.