diagnose — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited diagnose (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Read-only support bundle. Aggregates everything a maintainer needs to reproduce or pinpoint a nyann bug into one paste-friendly output.
bin/diagnose.sh collects, in one structured JSON object:
.claude-plugin/plugin.jsonuname -srm, bash version, jq/git/gh versionsbin/explain-state.sh --json output (stack, profile, branching, hooks, CLAUDE.md, recent commits)bin/doctor.sh --json output (drift report + health score)git config --list lines + git status --porcelain, with embedded URL credentials redacted via nyann::redact_url.git/hooks/pre-commit, .git/hooks/commit-msg, .husky/pre-commit, .husky/commit-msg, .pre-commit-config.yaml (each null when absent)~/.claude/nyann/preferences.json + team_profile_sources[] with URLs redactedbin/check-prereqs.sh --jsonEvery field flows through redaction. The bundle is safe to paste into a public GitHub issue.
Tell the user: "I'll run bin/diagnose.sh against this repo. It collects state, drift, hooks, and configuration into one bundle. URL credentials and tokens are redacted before output."
Run bin/diagnose.sh --target . --json (default mode is human-readable; --json for the paste-into-issue version).
If the user wants to share publicly, suggest:
bin/diagnose.sh --target . --json > nyann-diagnose-$(date +%Y%m%d).jsonbin/diagnose.sh --target .) for a quick eyeball summaryBefore handing the bundle off, look at:
health.summary.broken_links > 0 → user has broken internal linkshealth.summary.missing > 0 → user has missing hygiene filesrepo.claude_md.bytes > 8192 → CLAUDE.md over the hard capprereqs[].status of missing for any kind: hard → nyann lacks a required toolMention the obvious ones; the maintainer will look at the bundle for the rest.
Direct the user to the right surface:
<details> blockSECURITY.md; do NOT open a public issuedoctor --json already does.nyann::redact_url before emission. Tokens never reach stdout.gh is missing, the bundle still emits with host.gh = "missing". If ~/.claude/nyann/preferences.json doesn't exist, nyann_config = null. If the target isn't a git repo, git, health, and repo are stub-empty but the bundle still emits.retrofit skill (targeted fixes)or doctor skill (audit first, then decide).
doctor skill.explain-state skill (lighter, nohealth or hook contents).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.