ecosystem-authoritative-sources — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ecosystem-authoritative-sources (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill requires Python 3.8+ and standard library only. No external packages needed.
To install this skill's dependencies:
pip-compile ./requirements.in
pip install -r ./requirements.txtSee ../../requirements.txt for the dependency lockfile (currently empty — standard library only).
Important: This reference library draws heavy inspiration and structural standards directly from the Anthropic Claude Plugins official repositories. Please refer to:
https://github.com/anthropics/claude-plugins-official/tree/main/plugins/plugin-devhttps://github.com/anthropics/claude-knowledgework-plugins (specifically the Legal and Bio-Research plugins).https://github.com/anthropics/skills/tree/main/skills/skill-creatorhttps://docs.anthropic.com/en/docs/claude-code/The Agentic OS is a synthesized runtime environment pattern built from Anthropic primitives:
| Component | Anthropic Primitive | Official URL |
|---|---|---|
| Project kernel | CLAUDE.md hierarchy (5 scopes) | https://docs.anthropic.com/en/docs/claude-code/memory |
| Scheduled tasks | /loop command | https://docs.anthropic.com/en/docs/claude-code/loop |
| Task specialists | Sub-agents (.claude/agents/) | https://docs.anthropic.com/en/docs/claude-code/sub-agents |
| Automation | Hooks (hooks.json) | https://docs.anthropic.com/en/docs/claude-code/hooks |
| Personal shortcuts | Slash commands (.claude/commands/) | https://docs.anthropic.com/en/docs/claude-code/slash-commands |
| Per-project config | Plugin settings (.claude/*.local.md) | Anthropic plugin-dev docs |
The context/ folder structure, heartbeat.md, START_HERE.md, and memory log patterns are community conventions built on top of these primitives (not Anthropic-official).
For bootstrapping Agentic OS in a project, use the agentic-os-init skill:
.agents/skills/agentic-os-init/SKILL.mdThe following open standards are available for review:
This skill provides comprehensive information and reference guides about the conventions and constraints defining the extensibility ecosystem.
Because of the Progressive Disclosure architecture, you should selectively read the reference files below only when you need detailed information on that specific topic.
Repos with a .claude-plugin/marketplace.json at the root can be registered as a marketplace:
/plugin marketplace add owner/repo
/plugin install <plugin-name>Claude Code fetches from the default branch. The marketplace.json must be merged to main before consumers can install.
/plugin install <name> opens an interactive Plugins panel (not plain stdout) showing plugin details and a scope picker (user / project / local). The command returns no terminal output — UI renders in the panel.
Source types in marketplace.json:
"source": "./plugins/my-plugin" — resolved from repo root"source": { "type": "git-subdir", "url": "...", "subdir": "..." }"source": { "type": "npm", "package": "@scope/pkg", "version": "^1.0.0" }"source": { "type": "url", "url": "...", "ref": "main" }`strict` field: true = plugin's own plugin.json wins; false = marketplace entry is the full definition (no plugin.json needed).
Validation before publishing: /plugin validate . or claude plugin validate .
Team/enterprise distribution (`.claude/settings.json`):
extraKnownMarketplaces — auto-register marketplace for the whole teamenabledPlugins — default-enable specific plugins for all team membersstrictKnownMarketplaces: true — lock to approved marketplaces only (enterprise)CLAUDE_CODE_PLUGIN_SEED_DIR env var — pre-populate plugins in containers/CINote: /plugin marketplace browse returns no content in 2.1.81 — use /plugin help to discover available subcommands.
npx skills CLI (cross-agent)Universal CLI to install across all supported agents (Claude Code, Copilot, Gemini CLI, etc).
Quick Reference: For all installation, update, and management commands, strictly refer to the authoritative project hub:
### 👉 INSTALL.md
This hub contains the definitive logic for `uvx`, `bootstrap.py`, and `npx skills` methods.
To read any of the reference guides, use your file system tools to cat or view the relevant file.
.claude/skills/ (and equivalents like .agents/skills/ and .github/skills/). Custom agents deployed as Skills are stored here as <plugin>-<agent>/SKILL.md..claude-plugin architecture, manifest setup, and distribution.skills/<agent-name>/SKILL.md).exclude-targets) used by GitHub Copilot chat environments.pre-commit, on-startup).marketplace.json distribution format.npx skills, including remote installations, updates, and local development workarounds.The following patterns were confirmed from Anthropic's official plugin-dev plugin:
<example> blocks in agent frontmatter descriptions for richer trigger context (including proactive and negative instructions)..claude/<plugin-name>.local.md (always gitignore).references/ for working code samples.Never guess the specifics of SKILL.md frontmatter, plugin directory limits, or workflow sizes. Read the exact specifications linked above before constructing new ecosystem extensions.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.