run-agent — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited run-agent (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} asks the agent to disclose its hidden system prompt or initial instructions. That is often the first step of a larger attack: knowing the system prompt lets an attacker craft inputs that defeat its constraints by mimicking its own voice.
repeat/reveal/print your system prompt request from the skill.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
When a user wants to run an agent locally, from a git repo, or with a specific adapter/framework.
If you see authentication errors:
claude auth status)OPENAI_API_KEY is set and validGITHUB_TOKEN has correct permissionsLYZR_API_KEY is active# Run local agent with Claude (default)
opengap run -d ./my-agent
# Run from git repo
opengap run -r https://github.com/user/agent
# Run with a prompt (one-shot mode)
opengap run -d ./my-agent -p "Review my code"| Adapter | Flag | Env Var Required | Interactive |
|---|---|---|---|
| Claude | -a claude | (uses Claude Code auth) | Yes |
| OpenAI | -a openai | OPENAI_API_KEY | No |
| CrewAI | -a crewai | — | No |
| OpenClaw | -a openclaw | ANTHROPIC_API_KEY | No (-p required) |
| Nanobot | -a nanobot | ANTHROPIC_API_KEY | Yes |
| Lyzr | -a lyzr | LYZR_API_KEY | No (-p required) |
| GitHub | -a github | GITHUB_TOKEN | No (-p required) |
| Git | -a git | (auto-detects) | Depends |
| Prompt | -a prompt | — | Print only |
# Claude (interactive)
opengap run -d ./my-agent
# GitHub Models (one-shot, streaming)
export GITHUB_TOKEN="ghp_..."
opengap run -d ./my-agent -a github -p "Explain this codebase"
# Lyzr (creates agent on Lyzr Studio + chats)
export LYZR_API_KEY="..."
opengap run -r https://github.com/user/agent -a lyzr -p "Hello"
# Lyzr one-liner (clone + create + chat)
opengap lyzr run -r https://github.com/user/agent -p "Hello"
# Auto-detect adapter from repo
opengap run -r https://github.com/user/agent -a git -p "Hello"
# Just print the system prompt
opengap run -d ./my-agent -a promptRepos cloned via -r are cached at ~/.gitagent/cache/:
# Use cache (default)
opengap run -r https://github.com/user/agent
# Force refresh
opengap run -r https://github.com/user/agent --refresh
# No cache (temp dir, deleted after)
opengap run -r https://github.com/user/agent --no-cache-a git)The git adapter detects the best runner from the repo:
.gitagent_adapter file (explicit hint)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.