vault-user — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited vault-user (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You have access to a HashiCorp Vault instance managed by this rig's environment.
http://127.0.0.1:8200openrig-dev-tokenX-Vault-Token: openrig-dev-tokenAlways set the token before making API calls. For curl, use -H "X-Vault-Token: openrig-dev-token".
curl -s http://127.0.0.1:8200/v1/sys/health | jq .A healthy response has "initialized": true and "sealed": false.
curl -s -X POST http://127.0.0.1:8200/v1/secret/data/<path> \
-H "X-Vault-Token: openrig-dev-token" \
-d '{"data": {"key": "value"}}' | jq .curl -s http://127.0.0.1:8200/v1/secret/data/<path> \
-H "X-Vault-Token: openrig-dev-token" | jq .The secret value is in .data.data.
curl -s -X LIST http://127.0.0.1:8200/v1/secret/metadata/ \
-H "X-Vault-Token: openrig-dev-token" | jq .List a subdirectory by appending the path: .../secret/metadata/<prefix>/.
curl -s -X DELETE http://127.0.0.1:8200/v1/secret/data/<path> \
-H "X-Vault-Token: openrig-dev-token"When asked to explain the current secret structure, list all paths and summarize what each contains. Use the list endpoint recursively if needed.
secret/ by default in dev moderig env status command to verify Vault health through OpenRig before direct probing~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.