Han — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Han (Plugin) and scored it 65/100 (yellow). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 16 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 17 flagged
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
ignore/disregard/forget … previous instructions sentence.The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
Score fell 35 points between these scans.
The primary manifest — the file an agent reads to learn what this artifact does.
<img src="images/han-banner.png" alt="Han: your agentic ally for solo product engineers">
Han is a suite of AI skills and agents for solo (or small-team) product engineers. It combines evidence-based planning, test-driven implementation, full documentation maintenance, deep code review, and architectural analysis into a team of specialists you can dispatch from Claude Code.
Han turns planning, implementation, review, and documentation work that would normally take a team into a set of deterministic skills you run from Claude Code.
Each skill dispatches specialist agents, such as project managers, adversarial reviewers, investigators, architectural analysts, and testing and security specialists, to do the judgment-heavy work. It then folds their findings into an artifact you can trust.
The skills are designed to compose. You can plan a feature, then plan its implementation, then iterate on the plan, then build it test-first, then review the resulting code, then write the PR description. All through named skills that hand off to each other cleanly.
Read Concepts for the skill-and-agent model that runs through the whole plugin.
Han is purpose-built for solo product engineers and small teams, instead of large teams or enterprise. This does not mean it can't work in larger teams, though. Read about why Han's focus is solo product engineers and small teams to understand Han's positioning and what it does not bring to the table.
Add the Test Double skills marketplace to Claude Code, then install the plugin:
/plugin marketplace add testdouble/han
/plugin install han@hanHan ships as multiple plugins:
| Plugin | Type | What it brings |
|---|---|---|
| `han` | parent | the parent plugin that brings in han-communication, han-core, han-documentation, han-research, han-planning, han-coding, han-github, and han-reporting |
han-communication | bundled | the foundational plugin beneath every other: the shared readability standard and writing-voice profile, plus the skills and agent that apply them |
han-core | bundled | the shared specialist agent roster, the project-discovery skill, the /pairing collaborative working mode, and the canonical rule files |
han-documentation | bundled | documentation skills: project docs, architectural decision records, and runbooks |
han-research | bundled | pre-planning knowledge-work skills: research, gap analysis, and issue triage, plus the research-analyst agent |
han-planning | bundled | planning skills you reach for before implementation |
han-coding | bundled | coding skills you reach for while working in code |
han-github | bundled | GitHub-facing skills like posting a code review on a PR |
han-reporting | bundled | reporting skills like the stakeholder summary |
han-feedback | opt-in | skill for capturing post-session feedback on Han skill runs |
han-atlassian | opt-in | skills for publishing docs and work items to Atlassian products |
han-linear | opt-in | skill for publishing work items to Linear (requires a Linear MCP server) |
han-ddd | opt-in | strategic Domain-Driven Design analysis: bounded context discovery and an evidence-backed domain and context map |
han-plugin-builder | opt-in | carries the guidance and skills for building your own skills, agents, and plugins |
Installing han@han pulls in the bundled suite (the meta-plugin plus han-communication, han-core, han-documentation, han-research, han-planning, han-coding, han-github, and han-reporting), and is the right choice for most people. If you want only one slice of Han, install a single layer such as han-documentation@han or han-coding@han instead (each brings the shared han-core agents along), and add other specific plugins as desired.
For the full picture and a quick "which one do you need?" guide, see Choosing a Han plugin.
Add this repo as a Codex marketplace:
codex plugin marketplace add testdouble/hanCodex does not yet support meta-plugins like han@han (see openai/codex#23531,) and it resolves no dependencies, so install the Han packages directly — starting with the foundational han-communication, which the prose-producing packages depend on:
codex plugin add han-communication@han
codex plugin add han-core@han
codex plugin add han-documentation@han
codex plugin add han-research@han
codex plugin add han-planning@han
codex plugin add han-coding@han
codex plugin add han-github@han
codex plugin add han-reporting@hanInstall han-feedback, han-atlassian, han-linear, han-ddd, or han-plugin-builder separately when you want those opt-in packages. Because Codex resolves no dependencies, install han-communication alongside han-atlassian (its wrapped prose-producing skills source the shared readability standard from it).
full suite vs. a single layer, the layer dependencies on han-core, and a quick guide to which one to install.
.han/config.md files, one personal and one per project, thatset an output base directory, a default swarm size, a writing-voice profile, and extra agents for Han skills.
dispatch.
skill applies.
when no evidence exists at all.
its human-facing deliverable leads with the main point and reads consistently across skills.
starts, accelerating your understanding of unfamiliar code, triaging and investigating a bug, running an effective code review, and researching a decision. Pick one when you want the full walkthrough, not only the path.
skill or agent run.
of Han.
on Han's skills and agents.
/skill-builder.
/agent-builder.Han is an open source product of Test Double, and maintained by the following people:
Copyright 2026 Test Double, Inc. Distributed under the MIT license.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.