adk — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited adk (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A focused, Claude-optimized engineering toolkit, packaged as a single-plugin Claude Code marketplace. Install it and you get six self-contained skills, a set of tailored sub-agents, and pre-wired (env-gated) MCP servers.
Every skill is self-contained (its whole contract lives in its own folder), ships its own phased workflow and tailored persona, and uses the Workflow tool to fan out the heavy steps (multi-dimension review, multi-source investigation) with adversarial verification.
In Claude Code:
/plugin marketplace add sujeet-pro/agents-devkit
/plugin install adk@agents-devkitThen invoke any skill with its namespaced command:
/adk:review <pr-url | . | path | doc>
/adk:pr-review <github-pr-url>
/adk:implement <jira | gh-issue | "build the X">
/adk:investigate <symptom | datadog-url | slack-alert>
/adk:document <intent> --type <runbook|adr|rca|pr-body|...>Skills also auto-trigger by intent (e.g. "review this PR", "why is checkout slow") — the namespaced command is just the explicit way.
| Skill | What it does |
|---|---|
review | Lightweight, polymorphic review of a PR / local diff / doc / thread. Six dimensions, severity-tiered findings with file:line evidence. Read-only by default; --fix applies + pushes after confirmation. |
pr-review | Heavyweight, GitHub-only deep PR review: a read-only git worktree at the PR head, cross-file context, a Workflow that fans out one agent per dimension + feature-flag tracing + adversarial verification, then posts inline comments via the gh CLI. Never merges. |
implement | Build a change from a Jira ticket / GitHub issue / Slack thread / freeform prose. Plans before it acts, writes the smallest correct change with tests, validates with the repo's own tooling. |
investigate | Read-only multi-source RCA: pins an explicit window, fans out one agent per data source (Datadog / Slack / Statsig / Mixpanel / Snowflake / Looker / deploys), requires ≥2 agreeing signals before naming a root cause. |
document | Draft any markdown artifact (runbook / ADR / RCA / PR body / migration guide / …), reader-first and cited. Drafts locally; never publishes. |
slack-post | Send a message to a Slack channel / DM / thread with an explicit identity: posts as you by default, as the bot only when the prompt asks, and always appends a Sent using Claude footer. |
Tailored sub-agents the skills' workflows spawn: code-reviewer, security-auditor, test-engineer, implementer, investigator, doc-writer, context-gatherer. Each is a sharp, single-role worker — see plugins/adk/agents/.
gh pr view/diff/review, gh api). Run gh auth login first.git) for commits, branches, worktrees.git clone [email protected]:owner/repo.git). No HTTPS clones.The plugin ships .mcp.json with these servers. Each is opt-in via environment variables — set the ones for the data sources you use; the rest stay dormant. None are required for the core code skills (review, pr-review, implement use gh/git).
| MCP server | Used by | Environment variables |
|---|---|---|
datadog | investigate | DATADOG_API_KEY, DATADOG_APP_KEY |
atlassian | implement, document, investigate, pr-review | ATLASSIAN_SITE, ATLASSIAN_USERNAME, ATLASSIAN_API_TOKEN (needs uvx) |
slack | investigate, implement, slack-post | SLACK_BOT_TOKEN, SLACK_USER_TOKEN — reads + posts as you (needs npx) |
slack-bot | slack-post | SLACK_BOT_TOKEN — posts as the app/bot; only the post tool (needs npx) |
statsig | pr-review, investigate | STATSIG_CONSOLE_API_KEY |
mixpanel | investigate | OAuth on first use — no env vars |
snowflake | investigate | SNOWFLAKE_CONNECTION_NAME, SNOWFLAKE_ACCESS_TOKEN, SNOWFLAKE_SERVICE_CONFIG_FILE, SNOWFLAKE_HOME (needs uvx) |
looker | investigate | LOOKER_BASE_URL, LOOKER_CLIENT_ID, LOOKER_CLIENT_SECRET (needs uvx) |
google | document, investigate | GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, USER_GOOGLE_EMAIL, GOOGLE_WORKSPACE_MCP_CREDENTIALS_DIR (needs uvx) |
Set these in your shell environment before launching Claude Code; .mcp.json expands ${VAR} at connection time. A server whose env vars are unset simply won't connect, and the skills degrade honestly (they mark the source as skipped).
gh (authenticated: gh auth login)git with an SSH key configured for GitHubuvx (from uv) for the Atlassian / Snowflake / Looker / Google MCP serversnpx (Node) for the Slack MCP server.claude-plugin/marketplace.json # the marketplace (one plugin: adk)
plugins/adk/
├── .claude-plugin/plugin.json # plugin manifest
├── .mcp.json # env-gated MCP servers
├── agents/ # tailored sub-agents
└── skills/<skill>/ # one self-contained folder per skill
├── SKILL.md # entry point + frontmatter
├── persona.md # the skill's tailored voice
├── workflow.md # phased process + Workflow orchestration
├── rules.md # hard rules, refusals, safety
└── … # dispatch / dimensions / types as neededThe previous Textual TUI andadkCLI (queue, embeddings/SCIP pipeline, multi-host installers) live on theadk-clibranch.mainis the marketplace.
MIT — see LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.