co-scientist-run-aa7911 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited co-scientist-run-aa7911 (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Goal:
Expected input:
runs/test1runs/test1/config.yamlExecution steps:
python -m tools.host.claude_project_cli run <run-target> --skill co-scientist-pipelineruns/<run_id>/state/HOST_AGENT_HANDOFF.jsonruns/<run_id>/dashboard/LINKS.mdruns/<run_id>/dashboard/LINKS.jsondashboardLinks:dashboard.status is running, return dashboardLinks.dashboard as the primary dashboard URL and include the deep links.dashboard.status is starting, immediately run: python -m tools.host.claude_project_cli dashboard <run-dir>runs/<run_id>/dashboard/LINKS.md.runtime.status is now running, return the refreshed links.dashboard URL as the primary dashboard URL and include the deep links.runtime.status is still starting, tell the user that the dashboard is still booting, point them to runs/<run_id>/dashboard/LINKS.md, and include the retry command: /co-scientist-dashboard <run-dir>skills/co-scientist-pipeline/SKILL.mdskills/shared-references/artifact-contract.mdskills/shared-references/state-contract.mdskills/shared-references/integration-contract.mdskills/shared-references/execution-modes.mdskills/shared-references/schema-index.mdrun_configuration, execute research-config and validate research_plan/RESEARCH_PLAN.json before any generation work. python -m tools.validation.contract_validation runs/<run_id> --skill co-scientist-pipelineRules:
SKILL.md files and dynamic context from canonical artifacts.runs/<run_id>/state/PIPELINE_STATE.json and CURRENT_STAGE.json as the authoritative resume state.Configuration rather than Generation; do not skip it when the routing plan requires run_configuration.iteration_policy = completion_driven and human_checkpoint = auto, do not ask whether to continue after each evolution round. Keep running until a real terminal route, checkpoint boundary, or blocking validator/safety state is reached.skills/ as canonical and .claude/skills/ as the Claude Code entry surface.runs/<run_id>/dashboard/LINKS.md as the human-readable dashboard receipt and runs/<run_id>/dashboard/LINKS.json as the machine-readable receipt.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.