co-scientist-start-06189a — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited co-scientist-start-06189a (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Goal:
Expected input:
notes/drug_resistance_brief.mdGuided intake:
/co-scientist-start, ask at most four short questions:num_debaters, elo_k_factor, or ucb_exploration_constant.review override for critique depth without replacing the iteration-strategy question or disabling any review stage.Execution steps:
--goal "<goal>".--brief <path>. --exploration <value> --generation-bias <value> --review <value> --budget <value> --evolution <value> --stop-policy <value> --iteration-policy <value> --iteration-band <value> --human-checkpoint <value>Convert Claude-style key: value controls into real CLI flags before execution. For example:
exploration: aggressive -> --exploration aggressivereview: strict -> --review strictiteration policy: capped -> --iteration-policy cappediteration band: 6 10 -> --iteration-band 6_10human checkpoint: before overview -> --human-checkpoint before_overview python -m tools.host.claude_project_cli start --goal "<goal>" --skill co-scientist-pipeline --summary-onlyor the equivalent brief-based variant.
runs/<run_id>/dashboard/LINKS.mdruns/<run_id>/dashboard/LINKS.json/co-scientist-dashboard <run-dir> is the ready-link follow-up when the background bootstrap has not finished yet. python -m tools.host.claude_project_cli start --goal "<goal>" --skill co-scientist-pipelineor the equivalent brief-based variant.
runs/<run_id>/state/HOST_AGENT_HANDOFF.jsonruns/<run_id>/dashboard/LINKS.mdruns/<run_id>/dashboard/LINKS.jsondashboardLinks:dashboard.status is running, return dashboardLinks.dashboard as the primary dashboard URL and include the deep links.dashboard.status is starting, immediately run: python -m tools.host.claude_project_cli dashboard <run-dir>runs/<run_id>/dashboard/LINKS.md.runtime.status is now running, return the refreshed links.dashboard URL as the primary dashboard URL and include the deep links.runtime.status is still starting, tell the user that the dashboard is still booting, point them to runs/<run_id>/dashboard/LINKS.md, and include the retry command: /co-scientist-dashboard <run-dir>skills/co-scientist-pipeline/SKILL.mdskills/shared-references/artifact-contract.mdskills/shared-references/state-contract.mdskills/shared-references/integration-contract.mdskills/shared-references/execution-modes.mdrun_configuration, execute research-config before any generation work. python -m tools.validation.contract_validation runs/<run_id> --skill co-scientist-pipelineRules:
co-scientist-start when the user wants the system to create the run directory, input.md, and the canonical start artifacts.co-scientist-params or summarize ../../shared-references/start-parameters.md.co-scientist-run only when the user already has a run directory or a compatibility config.yaml.--interaction-mode guided when the run came from a question-driven intake.--interaction-mode brief_import when the run is anchored by an imported brief without a separate free-form goal.Configuration stage first so research-config can materialize research_plan/RESEARCH_PLAN.json.iteration_policy = completion_driven and human_checkpoint = auto.completion_driven + auto, keep running until the routing plan reaches overview or inspect_state, or a validator/safety stop requires intervention. Final complete comes from the completion verifier after overview work.key: value text straight into claude_project_cli; convert it to explicit flags first.SKILL.md files and dynamic context from canonical artifacts.skills/ as canonical and .claude/skills/ as the Claude Code entry surface.runs/<run_id>/dashboard/LINKS.md as the human-readable dashboard receipt and runs/<run_id>/dashboard/LINKS.json as the machine-readable receipt.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.