symlink-manager — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited symlink-manager (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Git symlinks break across platforms because:
| Issue | macOS/Linux | Windows |
|---|---|---|
| Git setting | core.symlinks=true (default) | core.symlinks=false (default, unless Dev Mode enabled) |
| Link type | ln -s symlink | NTFS symlink or Junction Point or Hardlink |
| Permissions | Any user | Requires Developer Mode or admin elevation |
| Git behaviour | Stores as symlink object | Stores as plain text file containing the target path |
When core.symlinks=false, Git checks out a symlink as a plain text file whose contents are the target path. When you then git pull on the other machine, that text file arrives instead of a real link — silent, no error.
When core.symlinks=false and Developer Mode is disabled, symlinks can be accidentally replaced with hardlinks. Hardlinks cannot be committed as symlinks to Git, so they break the cross-platform workflow:
Solution: Always use real symlinks, never hardlinks. Enable Developer Mode on Windows first, then use /create-sym-link command to create proper symlinks that Git recognizes.
Run the diagnosis script first. It checks:
git config core.symlinks (local + global)python ./scripts/symlink_manager.py diagnoseOn Windows (needs Developer Mode enabled first, or run as admin):
git config core.symlinks true
git rm --cached -r . # unstage everything
git reset --hard # re-checkout with symlinks honouredOn macOS / Linux (usually already correct):
git config --get core.symlinks # should say "true"Add a .gitattributes line to lock symlinks in the repo:
* text=auto
*.symlink -textFor cross-platform teams: Use the Python script — it automatically handles OS differences without requiring bash, PowerShell, or .sh scripts.
Use the /create-sym-link command in Claude Code for an interactive workflow:
/create-sym-linkThis prompts for source and destination paths and uses the Python symlink manager.
Or use the Python script directly (works on Windows, macOS, and Linux):
# Create a single symlink (automatically detects OS)
python ./scripts/symlink_manager.py create --src plugins/plugin-manager/scripts/plugin_installer.py --dst plugins/plugin-manager/skills/plugin-installer/scripts/plugin_installer.py
# Re-create ALL links from the manifest
python ./scripts/symlink_manager.py restore
# Audit: list broken or missing links
python ./scripts/symlink_manager.py audit
# Full diagnosis of the environment
python ./scripts/symlink_manager.py diagnoseThe Python script automatically:
Critical: If symlinks were created as hardlinks or plain-text files:
rm plugins/plugin-manager/skills/*/scripts/plugin_installer.pygit config core.symlinks true/create-sym-link command or python ./scripts/symlink_manager.py create ...git add -A && git commit -m "fix: replace hardlinks with proper symlinks"If you have multiple text-file stand-ins in a folder hierarchy, use the bulk fixer:
# Scan folder, generate inventory, and fix all broken symlinks
python ./scripts/bulk_symlink_fixer.py plugins/plugin-manager/skills/maintain-plugins/scriptsThe bulk fixer:
symlink_manager.py create in a loop to fix each oneCommit symlinks.json to the repo. On a fresh checkout (or after a git pull breaks links on Windows), any developer runs:
python ./scripts/symlink_manager.py restore…and all links are recreated correctly for their platform.
git config --global core.symlinks true after enabling Developer Mode.core.symlinks=false inherited from a shared config.git config --list --show-origin | grep symlinks to see where the setting comes from.references/troubleshooting.md — Common error messages and fixesscripts/symlink_manager.py — The cross-platform Python script.agent/rules/symlink-cross-platform.md — Repository-wide symlink best practices and requirementsreferences/ADRs/. Always consult them for standards on shared scripts, cross-plugin dependencies, symlinking patterns and loose coupling to avoid repeating yourself.Read references/troubleshooting.md when the user reports specific error messages.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.