A Claude skill that generates a context setup checklist at session start and checks for drift mid-session
SaferSkills independently audited session-router (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A session management skill with two modes: session start routing that generates a setup checklist before work begins, and mid-session checks that recommend adding or dropping context as the session evolves.
Always run at session start, before any substantive response.
Before generating any checklist, read the user's context map:
context-map.mdThis file lives alongside SKILL.md and defines the user's projects, associated files, skills, and connectors. If this file is missing or empty, tell the user:
"I don't have a context map set up yet. Would you like me to help you create one? It only takes a few minutes and makes every future session faster."
Then offer to build it interactively using the template in references/context-map-template.md.
Assess whether the opening message gives enough signal to route confidently.
Sufficient signal: project name, topic area, file mention, task type, or any phrase that maps clearly to an entry in the context map.
Insufficient signal: pure greetings ("hey"), ambiguous topics ("I need help with something"), or topics that could span multiple projects.
If signal is insufficient, ask up to 3 focused questions — no more. Example:
"Before I pull up the right tools and files, can you tell me: - What project or topic are we working on today? - Are you writing, building, researching, or something else?"
Do not ask questions the opening message already answers.
Once you have enough signal, output the checklist in this format:
Session Setup — [Project/Topic Name]
Enable these skills:
skill-name — reason it's relevantEnable these MCP connectors:
connector-name — reason it's relevantLoad these files into context:
path/to/file.md — what it contains and why<!-- SHOW_DISABLE_SUGGESTIONS: set to false to hide this section --> Consider disabling (not needed this session):
connector-name — why it's not relevant and frees up contextWhen you're set up, just say "ready" and we'll begin.
After delivering the checklist, stop. Do not begin the actual work until the user signals readiness. Accepted signals include: "ready", "done", "go", "let's go", "ok", "all set", or any equivalent.
When confirmed, acknowledge briefly and proceed:
"Got it — let's go."
Triggered when the user types /session-router check at any point during an active session.
Scan the conversation so far and compare what was loaded at the start against how the session has actually developed. Then output a concise adjustment checklist.
Deadweight — loaded but unused:
Gaps — needed but not loaded:
Session Check
You can probably turn these off (freeing up context):
connector-name — hasn't come up, not likely neededConsider adding these:
skill-name — would help with [what's emerged in the session]path/to/file.md — relevant to [current direction]No changes needed? Just ignore this and keep going.
Keep the check output short. If nothing meaningful has changed, say so in one line and move on. Don't manufacture suggestions.
The following behaviors can be controlled with HTML comments in this SKILL.md file. Set the value after the colon to enable or disable.
<!-- AUTORUN: true -->Default: true. When true, the skill runs automatically at the start of every session before any substantive response. Set to false to disable autorun — the skill will only activate when explicitly called with /session-router. Useful if you prefer manual control or only want routing for certain sessions.
<!-- SHOW_DISABLE_SUGGESTIONS: true -->Default: true. When true, the session start checklist includes a "consider disabling" section. Set to false to hide it.
<!-- REQUIRE_CONFIRMATION: true -->Default: true. When true, the skill waits for the user to say "ready" before proceeding after the session start checklist. Set to false to skip the confirmation gate and proceed immediately.
<!-- ALWAYS_ASK: false -->Default: false. Set to true to always ask clarifying questions at session start even when signal is sufficient. Useful during initial setup when your context map is new.
If AUTORUN is set to false, the skill runs only when the user types /session-router or a natural equivalent like "run session router" or "set up my session".
Manual invocation with a topic hint is also supported:
/session-router [topic or project name]Treat any text after /session-router as the opening message signal and route accordingly.
To trigger a mid-session check at any time:
/session-router checkreferences/context-map-template.md — Blank template for users setting up their own context mapreferences/example-context-map.md — Fully worked example based on a real creative/academic workflow~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.