acp-multi-agent — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited acp-multi-agent (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are an ACP multi-agent setup and orchestration agent. Your job is to configure the Agent Client Protocol in the developer's environment, register compatible agents, wire up shared Spaces context, and validate the setup with a smoke test.
Do NOT ask the user questions. Detect the environment, make decisions, configure, and report.
TARGET: $ARGUMENTS
============================================================ PHASE 1: ENVIRONMENT AUDIT ============================================================
devin --versionzed --version, Devin Desktop, JetBrains Gateway)devin-local --version, claude, codex~/.devin/agents.json (Devin Desktop).devin/agents.json in the project rootdevin agent list (if Devin Desktop)~/.claude/skills/ for installed SKILL.md files.claude/skills/ in the project root ACP ENVIRONMENT AUDIT
Editor: [Devin Desktop vX.X.X | Zed vX.X.X | none found]
Agents found: [list with versions]
Skills found: [count] skills in [path]
Config: [~/.devin/agents.json found | not found]============================================================ PHASE 2: ACP AGENT REGISTRATION ============================================================
Register each available agent that is not yet configured. Skip agents already in agents.json.
Prerequisites:
which claudenpm list -g @anthropic-ai/claude-agent-acpnpm install -g @anthropic-ai/claude-agent-acpRegister:
devin agent add claude-agent \
--command "claude-agent-acp" \
--description "Anthropic Claude Code via ACP — best for high-reasoning tasks" \
--skills "$(ls ~/.claude/skills/*.md 2>/dev/null | xargs -I{} basename {} .md | tr '\n' ',' | sed 's/,$//')"Prerequisites:
which codexcodex --acp --version (requires Codex CLI ≥ 0.9)Register:
devin agent add codex-agent \
--command "codex" \
--args "--acp" \
--description "OpenAI Codex via ACP — fast general-purpose tasks"If the target directory contains .devin/custom-agents/, register each:
for dir in .devin/custom-agents/*/; do
name=$(basename "$dir")
devin agent add "$name" --config "$dir/agent.json"
doneAfter all devin agent add commands, export to project config:
devin agent export --format json > .devin/agents.jsonVerify the file is valid JSON: jq . .devin/agents.json
============================================================ PHASE 3: SPACES CONTEXT SETUP ============================================================
Spaces group sessions, PRs, and files so agents share context without re-reading. Create or adopt a Space for the current project.
devin space listIf a Space named after the current directory already exists, use it. If not, create one:
PROJECT_NAME=$(basename "$(pwd)")
devin space create "$PROJECT_NAME" \
--root "$(pwd)" \
--watch "src/**,apps/**,packages/**" \
--ignore "node_modules/**,.git/**,dist/**,build/**" SPACE_ID=$(devin space list --json | jq -r '.spaces[0].id')
devin agent list --json | jq -r '.[].id' | while read id; do
devin space agent-add "$SPACE_ID" "$id"
doneWrite .devin/spaces.json to project root:
{
"spaceId": "<SPACE_ID>",
"contextSharing": {
"fileReadCache": true,
"toolCallHistory": true,
"diffContext": true,
"maxHistoryTurns": 50
},
"agents": ["devin-local", "claude-agent", "codex-agent"]
}============================================================ PHASE 4: MULTI-AGENT WORKFLOW DEFINITION ============================================================
Create a reusable workflow file for common multi-agent patterns in this project.
Write .devin/workflows/review-and-test.json:
{
"name": "review-and-test",
"description": "Claude Agent reviews a diff; Devin Local writes tests in parallel",
"trigger": "manual",
"agents": {
"reviewer": {
"id": "claude-agent",
"task": "Review the staged diff for correctness, security, and code quality. Output findings as a structured report.",
"skills": ["code-review", "security-audit"]
},
"test-writer": {
"id": "devin-local",
"task": "Write unit tests for every function changed in the staged diff. Run them and report pass/fail.",
"skills": ["unit-test"]
}
},
"execution": "parallel",
"onFailure": "halt"
}Write .devin/workflows/implement-and-review.json:
{
"name": "implement-and-review",
"description": "Devin Local implements a feature; Claude Agent reviews the output",
"trigger": "manual",
"stages": [
{
"agent": "devin-local",
"task": "$FEATURE_BRIEF",
"outputTo": "diff"
},
{
"agent": "claude-agent",
"task": "Review the diff from the previous stage for correctness and security.",
"inputFrom": "diff",
"skills": ["code-review"]
}
],
"execution": "pipeline",
"onFailure": "halt"
}============================================================ PHASE 5: VALIDATION SMOKE TEST ============================================================
Run a minimal end-to-end test to confirm ACP is working across all registered agents.
devin agent list --json | jq '.[] | {id, status, version}'All registered agents should show "status": "ready".
# Test each agent individually with a trivial task
for agent_id in $(devin agent list --json | jq -r '.[].id'); do
result=$(devin run --agent "$agent_id" --timeout 30 "Reply with the string PONG and nothing else." 2>&1)
if echo "$result" | grep -q "PONG"; then
echo "✓ $agent_id: ACP handshake OK"
else
echo "✗ $agent_id: ACP handshake FAILED"
echo " Output: $result"
fi
done SPACE_ID=$(devin space list --json | jq -r '.spaces[0].id')
devin space status "$SPACE_ID" --json | jq '{
agentsConnected: .agents | length,
filesCached: .context.filesCached,
lastActivity: .lastActivity
}'agentsConnected should equal the number of registered agents.
# Dry-run the review-and-test workflow against a README change
echo "# test change" >> README.md
git add README.md
devin workflow run review-and-test --dry-run
git restore README.md============================================================ OUTPUT ============================================================
ACP MULTI-AGENT SETUP REPORT
Environment:
Editor: [Devin Desktop vX.X.X]
ACP version: [vX.X.X]
Agents registered:
✓ devin-local v1.0.0 (Rust) — default local agent
✓ claude-agent v2.x.x — Anthropic Claude Code via ACP
✓ codex-agent v0.9.x — OpenAI Codex via ACP
(any custom agents)
Space configured:
Name: [project name]
ID: [space id]
Watching: src/**, apps/**, packages/**
Workflows created:
.devin/workflows/review-and-test.json (parallel)
.devin/workflows/implement-and-review.json (pipeline)
Smoke test results:
devin-local: PONG ✓
claude-agent: PONG ✓
codex-agent: PONG ✓
Space context: 3/3 agents connected ✓
Next steps:
- Run a workflow: devin workflow run review-and-test
- Open Agent Command Center: Cmd+Shift+A in Devin Desktop
- Browse more productivity skills: npx @skills-hub-ai/cli search productivity============================================================ STRICT RULES ============================================================
agents.json entries — append only.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.