blueprint — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited blueprint (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Turn a one-line objective into a step-by-step plan any coding agent can execute cold.
Blueprint is for multi-session, multi-agent engineering projects where each step must be independently executable by a fresh agent that has never seen the conversation history. Install it once, invoke it with /blueprint <project> <objective>.
/blueprint myapp "migrate database to PostgreSQL"/blueprint antbot "extract providers into plugins"Do not clone a moving branch directly into an active skills directory. Inspect the named immutable revision in a separate review directory using the existing task/network authorization. Host activation or installation still needs the applicable explicit instruction; do not ask again if it was already granted:
review_dir="$(mktemp -d)"
git clone --filter=blob:none https://github.com/antbotlab/blueprint.git "$review_dir/blueprint"
git -C "$review_dir/blueprint" checkout --detach 07c5b305cf2d95d584a0d0398c390e839fec5954
git -C "$review_dir/blueprint" ls-files
git -C "$review_dir/blueprint" status --shortRead SKILL.md and every bundled file at that exact commit. Check for scripts, hooks, symlinks, network calls, credential access, and instructions that request commands or elevated permissions. Only within explicit user approval for host installation, copy the reviewed files into the selected host's skills directory. Re-review a newer revision instead of silently updating this pin.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.