sf-sdk-quickstart — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sf-sdk-quickstart (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
npm init -y
npm install @spfunctions/[email protected] @spfunctions/[email protected]Pin the alpha versions. These packages are published for early builders, not GA. Without pinning, your install may pull a breaking change.
export SF_API_KEY="sf_..."
export OPENROUTER_API_KEY="sk-or-..."For server-side use only. Do not put long-lived keys in browser bundles.
/api/contracts/tools is the SDK and Agent contract truth — what tools exist, what their permissions are, what their cost class is.
import { SimpleFunctions } from "@spfunctions/sdk"
const sf = new SimpleFunctions({
baseUrl: "https://simplefunctions.dev",
})
const manifest = await sf.manifest.list()
const world = await sf.manifest.get("world.read")
const legacy = await sf.manifest.get("get_world_state")
console.log(manifest.schemaVersion) // "0.3.0-draft"
console.log(world?.name) // "world.read"
console.log(legacy) // null — broad compat name, not canonicalThe contract manifest works without an API key. Use it to discover available tools before writing code that calls them.
import { SimpleFunctions } from "@spfunctions/sdk"
const sf = new SimpleFunctions({
baseUrl: "https://simplefunctions.dev",
apiKey: process.env.SF_API_KEY,
})
const world = await sf.world.get()
console.log(world.asOf)
console.log(world.regime?.label)
console.log(world.salient?.slice(0, 3).map(item => item.label))If SF_API_KEY is not set, this throws MissingApiKeyError — world.read is cost-bearing (costEffect: "api_cost") and not anonymously allowlisted.
import { Agent } from "@spfunctions/agent/v1"
const agent = await Agent.create({
apiKey: process.env.SF_API_KEY,
openRouterApiKey: process.env.OPENROUTER_API_KEY,
model: { id: "anthropic/claude-haiku-4.5" },
})
const run = agent.send("Read world state and summarize the largest market moves.")
for await (const event of run.stream()) {
console.log(event.type)
}
// Resume a run from another process:
const sameRun = await Agent.getRun(run.id, { agentId: run.agentId })
await sameRun?.wait()Agent.create({ apiKey }) mounts read-only SimpleFunctions strict tools by default. Write tools are opt-in only — pass builtinTools: "all" or a named allowlist to mount them.
Run the script:
npx tsx your-script.tsExpected:
"0.3.0-draft"asOf, regime.label, and a populated salient arrayagent.run.started, tool.call.started, tool.call.completed, agent.final, agent.run.completednode_modules exists. Some IDEs cache stale resolution — restart TypeScript server.dotenv, process.env.SF_API_KEY is undefined unless exported in shell.Pick a workflow:
| Goal | Skill to use |
|---|---|
| Read world state continuously | sf-sdk-world-read |
| Search + inspect markets | sf-sdk-market-research |
| Pull FRED / congressional data | sf-sdk-econ-gov |
| Build a thesis lifecycle | sf-sdk-thesis |
| Trade with risk gates | sf-sdk-portfolio |
| Build a Cursor-style agent | sf-agent-sdk-quickstart |
| Externally driven NDJSON harness | sf-agent-sdk-headless |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.