perseus — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited perseus (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
ignore/disregard/forget … previous instructions sentence.The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Perseus pre-resolves your entire workspace state — git, services, memory, team coordination — into a single markdown document every assistant reads at session start. Deterministic. Cacheable. Assistant-agnostic.
pip install perseus-ctx # or: uv tool install perseus-ctx
perseus init # scaffold .perseus/context.md
perseus render --format agents-md # render to AGENTS.md# Install Perseus
uv tool install perseus-ctx
# Set up Claude Code hooks — auto-injects Perseus context every session
cd your-project
perseus install --target claude-code
# Render your first briefing
perseus render .perseus/context.md --format claude-mdThis drops SessionStart + UserPromptSubmit hooks into .claude/settings.json. Every Claude Code session now starts with Perseus-resolved context injected automatically.
Write a .perseus/context.md file with @perseus as the first line, then use any of these 22 directives:
| Directive | What it does |
|---|---|
@query "command" | Run a shell command and embed stdout |
@services | Health-check listed services (HTTP, TCP, etc.) |
@read path=file | Embed file contents |
@env VAR | Embed environment variable |
@waypoint | Latest session checkpoint (crash recovery) |
@agora | Task board from tasks/*.md |
@inbox | Inter-agent messages |
@memory | Narrative project memory (federated across workspaces) |
@skills | List available agent skills |
@session | Recent session digests |
@health | Context maintenance report |
@date | Current date/time |
@include path=file | Include and render another file |
@if / @else / @endif | Conditional blocks |
@cache ttl=N | Cache directive output for N seconds |
@cache session | In-memory cache (session lifetime) |
@constraint | Constraint block for validation |
@validate schema= | Validate a rendered block |
@tree | Tree view of directory |
@list | List directory or structured data |
@perseus v1.0.6
# Project Context
## Git
@query git branch --show-current
@query git log --oneline -5
## Services
@services
## Session State
@waypoint
@session count=3
## Team Coordination
@agora
@inbox unread=truePerseus's strongest differentiator is multi-agent shared state. With @agora (task board), @inbox (inter-agent messaging), and @memory federation, every agent in your swarm reads the same resolved context at session start. The filesystem-based coordination protocol handles 150+ concurrent writers with zero collisions.
Perseus also runs as an MCP server, exposing all directives as native MCP tools:
perseus mcp serve --workspace /path/to/projectAny MCP-compatible assistant (Claude Desktop, Cursor, Continue) can call perseus_query, perseus_services, perseus_memory, etc. as tools.
perseus render before starting work. YourAI assistant gets the same briefing every time.
perseus render --format agents-md -o AGENTS.md in yourCI pipeline. Every PR gets Perseus-resolved context.
Reviewers (human and AI) see the same briefing.
policies. By default, dangerous operations are restricted.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.