add-team-source — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited add-team-source (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Wraps bin/add-team-source.sh. Updates ~/.claude/nyann/config.json to declare a new team-profile source. Idempotent — passing the same --name updates the entry in place.
^[a-z0-9][a-z0-9-]*$.Will also become the namespace prefix for team profiles (e.g. platform-team/base when name is platform-team). When the user gives a name with spaces or caps, propose a slug and confirm.
(https://, git@, file:// for testing).
main. Override when theteam pins a specific branch or tag.
24. How oftensync-team-profiles will re-pull from this source without --force. Decrease only when the user says "we update these often" or similar.
~/.claude/nyann/config.json. Overrideonly when the user explicitly names a different user root.
--name collision. Warn the user ifthey're replacing an existing source with a different URL — that's usually unintentional. Read current config first if unsure.
bin/add-team-source.sh \
--name <id> \
--url <git-url> \
[--ref <branch>] \
[--interval <hours>] \
[--user-root <dir>]Exit 0 on success; config path is logged to stderr.
/nyann:sync-team-profiles (or ask 'sync myteam profiles') to actually pull them". add-team-source only registers — the pull is a separate operation on purpose (no surprise network calls here).
sync-team-profiles skill.bootstrap-project withthe namespaced profile name (e.g. platform-team/base).
inspect-profile with thenamespaced name.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.