Rundrill — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Rundrill (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The public install index for RunDrill's programming & professional courses. Each course ships as one plugin — a <subject>-coach skill backed by an MCP drill engine (curriculum, progress, mistake memory).
Natural-language courses (English, Kazakh, …) live in the sibling rundrill/rundrill-lang marketplace.
This repo holds only the catalogs; the course plugins live in their own repos under the rundrill org and are referenced by Git source. Two catalogs cover the two marketplace-based hosts (one entry per course in each):
.claude-plugin/marketplace.json — Claude Code / Desktop, github source..agents/plugins/marketplace.json — OpenAI Codex, url source.Authoring scaffolding (_template/) lives in the private development monorepo, not here.
Claude Code / Claude Desktop — via this marketplace:
/plugin marketplace add rundrill/rundrill # the org/repo of this index
/plugin install rundrill-python@rundrill # <plugin-name>@<marketplace-name>
/reload-plugins # → /python-coach is live@rundrill is the marketplace name field (set in marketplace.json), not the repo name. (Language courses install from the other index: rundrill-english@rundrill-lang.)
OpenAI Codex — via this marketplace too:
codex plugin marketplace add rundrill/rundrill # GitHub shorthand; reads .agents/plugins/marketplace.jsonThen open the plugin directory, pick the RunDrill marketplace, and install the course.
Google Antigravity — no marketplace; Antigravity scans plugin dirs. Drop a course folder in:
~/.gemini/config/plugins/rundrill-python/ (global, all workspaces), or<workspace>/.agents/plugins/rundrill-python/ (workspace-scoped).A course plugin lives in its own repo (e.g. rundrill/rundrill-python). Add one entry to each catalog, pinned to a released tag (ref, and optionally a full-commit sha) so users don't pull unfinished work.
.claude-plugin/marketplace.json (Claude — github source):
{
"name": "rundrill-python",
"source": { "source": "github", "repo": "rundrill/rundrill-python", "ref": "v0.2.11" },
"description": "Python coach — read and review code (incl. AI-generated) with drills, progress, and mistake memory."
}.agents/plugins/marketplace.json (Codex — url source; always include policy + category):
{
"name": "rundrill-python",
"source": { "source": "url", "url": "https://github.com/rundrill/rundrill-python.git", "ref": "v0.2.11" },
"policy": { "installation": "AVAILABLE", "authentication": "ON_INSTALL" },
"category": "Education"
}| Layer | Pattern | Example | Notes |
|---|---|---|---|
| Plugin (install unit) | rundrill-<subject> | rundrill-english | unique within the marketplace; the Antigravity plugin dir name too |
| Skill / slash command | <subject>-coach | /english-coach | subject-distinct so the bare command works; Claude falls back to /rundrill-english:english-coach on a clash |
| MCP server | rundrill-<subject> | server key in both .mcp.json and mcp_config.json | per-course name; one shared backend behind per-course endpoints |
Rules: lowercase kebab-case everywhere (not underscores); hyphenate multi-word subjects (system-design, soft-skills); lowercase acronyms (toefl, ielts, owasp). The SKILL.md name: field, its folder name, and the slash command must all match.
Planned regional bundles use a distinct word so they never collide with a single course: rundrill-pack-west, rundrill-pack-asia (thin meta-plugins listing course plugins as deps).
outside the plugin, because users install one plugin at a time. Shared harness logic lives server-side in the MCP backend, not in the plugin.
{ "type": "http", "url": … } in .mcp.json;Antigravity uses { "serverUrl": … } in mcp_config.json. If RunDrill's OAuth server supports dynamic client registration (DCR), Antigravity needs only serverUrl — it handles the OAuth flow itself. Otherwise add oauth: { clientId, clientSecret } and register https://antigravity.google/oauth-callback as a redirect URI.
Authoring a new course and the submodule layout: see the private monorepo's plugins/README.md and Plugin Packaging & Distribution.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.