rlm-init — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited rlm-init (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill requires Python 3.8+ and standard library only. No external packages needed.
To install this skill's dependencies:
pip-compile ./requirements.in
pip install -r ./requirements.txtSee ./requirements.txt for the dependency lockfile (currently empty — standard library only).
Initialize a new RLM semantic cache for any project. This is the first-run workflow — run it once per cache, then use rlm-distill-agent for ongoing updates.
Real-world examples of each config file are in references/examples/:
| File | Purpose |
|---|---|
manifest-index.json | Profile registry -- defines named caches and their manifest/cache paths |
rlm_manifest.json | Project docs manifest -- what folders/globs to include and exclude |
distiller_manifest.json | Tools manifest -- scoped to scripts and plugins only |
Ask this before anything else.
First, check what other plugins are installed:
ls .agents/skills/vector-db-init/ 2>/dev/null && echo "vector-db: INSTALLED" || echo "vector-db: NOT FOUND"
ls .agents/skills/obsidian-wiki-builder/ 2>/dev/null && echo "obsidian-wiki-engine: INSTALLED" || echo "obsidian-wiki-engine: NOT FOUND"Then ask:
RLM Factory works standalone with zero external dependencies. You can also combine it with
other plugins for a more powerful retrieval stack. What setup would you like?
A) RLM only (standalone)
- O(1) keyword search across dense file summaries
- No other plugins needed — works right now
B) RLM + vector-db Phase 2 [requires: vector-db in .agents/]
- RLM keyword pre-filter → vector semantic search
- Reduces noise, improves precision for large corpora
C) RLM as wiki distiller [requires: obsidian-wiki-engine in .agents/]
- Generates RLM summary layers per wiki concept node
- /wiki-query uses RLM Phase 1 before grep
D) Full Super-RAG [requires: vector-db + obsidian-wiki-engine]
- All three: RLM keyword → vector semantic → wiki concept nodes
Enter A, B, C, or D (default: A):If required plugins are NOT installed for the chosen mode:
[plugin-name] is not installed in .agents/.
To install it:
# Recommended (uvx — works on Mac, Linux, Windows)
uvx --from git+https://github.com/richfrem/agent-plugins-skills plugin-add richfrem/agent-plugins-skills
# npx (Mac/Linux)
npx skills add richfrem/agent-plugins-skills
# See full install guide
cat INSTALL.md
After installing, re-run /rlm-factory:init and choose your desired mode.
Continue with Mode A (standalone) for now? (y) or abort and install first? (n)For Mode D, also provision wiki and tools profiles automatically (see Step 2).
Before creating anything, gather requirements:
docs/, src/, plugins/).md, .py, .ts).agent/learning/ or config/rlm/plugins, project, tools)rlm_profiles.jsonEach cache is defined as a profile in rlm_profiles.json. This file is located at RLM_PROFILES_PATH or defaults to .agent/learning/rlm_profiles.json. If it doesn't exist, create it:
mkdir -p <profiles_dir>Create or append to <profiles_dir>/rlm_profiles.json:
{
"version": 1,
"default_profile": "<NAME>",
"profiles": {
"<NAME>": {
"description": "<What this cache contains>",
"manifest": "<profiles_dir>/<name>_manifest.json",
"cache": "<profiles_dir>/rlm_<name>_cache.json",
"extensions": [
".md",
".py",
".ts"
]
}
}
}| Key | Purpose |
|---|---|
description | Human-readable explanation of the profile's purpose |
manifest | Path to the manifest JSON (what folders/files to index) |
cache | Path to the cache directory location |
extensions | List of string file extensions to include |
The manifest defines which folders, files, and globs to index. Extensions come from the profile config.
Create <manifest_path>:
{
"description": "<What this cache contains>",
"include": [
"<folder_or_glob_1>",
"<folder_or_glob_2>"
],
"exclude": [
".git/",
"node_modules/",
".venv/",
"__pycache__/"
],
"recursive": true
}Make sure that the paths configured in rlm_profiles.json are properly created and empty arrays match where required. No .json databases are needed because the cache persists directly to .md files in a directory.
Scan the manifest against the cache to find uncached files:
python ./scripts/inventory.py --profile <NAME>Report: "N files in manifest, M already cached, K remaining."
For each uncached file:
---
hash: "agent_distilled_<YYYY_MM_DD>"
summarized_at: "<ISO timestamp>"
---
# Summary
<your summary>"✅ Cached: <path>"Run audit again:
python ./scripts/inventory.py --profile <NAME>Target: 100% coverage. If gaps remain, repeat Step 6 for missing files.
Every summary should answer: "Why does this file exist and what does it do?"
| ❌ Bad | ✅ Good |
|---|---|
| "This is a README file" | "Plugin providing 5 composable agent loop patterns for learning, red team review, triple-loop delegation, and parallel swarm execution" |
| "Contains a SKILL definition" | "Orchestrator skill that routes tasks to the correct loop pattern using a 4-question decision tree, manages shared closure sequence" |
rlm-distill-agent for ongoing cache updatesrlm-curator for querying, auditing, and cleanup.gitignored if they contain project-specific summaries~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.