co-scientist-resume-b03f46 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited co-scientist-resume-b03f46 (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Goal:
Expected input:
runs/test1Execution steps:
input.md and state/ artifacts exist. python -m tools.host.claude_project_cli resume <run-dir> --skill co-scientist-pipelineruns/<run_id>/state/PIPELINE_STATE.jsonruns/<run_id>/state/CURRENT_STAGE.jsonruns/<run_id>/state/HOST_AGENT_HANDOFF.jsonruns/<run_id>/dashboard/LINKS.mdruns/<run_id>/dashboard/LINKS.jsondashboardLinks:dashboard.status is running, return dashboardLinks.dashboard as the primary dashboard URL and include the deep links.dashboard.status is starting, immediately run: python -m tools.host.claude_project_cli dashboard <run-dir>runs/<run_id>/dashboard/LINKS.md.runtime.status is now running, return the refreshed links.dashboard URL as the primary dashboard URL and include the deep links.runtime.status is still starting, tell the user that the dashboard is still booting, point them to runs/<run_id>/dashboard/LINKS.md, and include the retry command: /co-scientist-dashboard <run-dir> python -m tools.validation.contract_validation <run-dir> --resume --skill co-scientist-pipelineskills/co-scientist-pipeline/SKILL.md flow. If the persisted route returns run_configuration, resume or rerun research-config before any generation work.Rules:
research_plan/RESEARCH_PLAN.json is missing or invalid, expect resume routing to return run_configuration instead of skipping directly to generation or evolution.run_review resumes only review, run_insights resumes only insights, run_proximity resumes only proximity, run_ranking resumes only ranking, and continue_evolution may create at most one child before closing that child through review, proximity, ranking with ranking update receipt coverage, convergence, and one appended round receipt.HYPOTHESIS.json into an earlier EVOLUTION_ROUNDS.jsonl record.iteration_policy = completion_driven and human_checkpoint = auto, do not ask for per-round confirmation during resume. Continue until a true terminal route, configured checkpoint boundary, or blocking state is reached.runs/<run_id>/dashboard/LINKS.md as the human-readable dashboard receipt and runs/<run_id>/dashboard/LINKS.json as the machine-readable receipt.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.