create-squad — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited create-squad (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use a Squad only when multiple focused assistants improve the design. Default to a payload or implementation plan unless the user explicitly requests live Vapi mutations.
Prefer one assistant when one focused prompt and one compatible tool set can handle the use case reliably. Use a Squad for genuine boundaries such as:
Do not create one assistant per conversational step. Keep related steps in one member and make each handoff boundary earn its latency and operational cost.
handoff tool.VAPI_API_KEY.GET /assistant; create missing assistants first with the create-assistant skill.type: "assistant" plus a verified assistantId for saved cross-assistant destinations.POST /tool, then attach them to the source assistants with the configuration-preserving procedure in the create-tool skill.contextEngineeringPlan on a handoff destination: all, lastNMessages, userAndAssistantMessages, previousAssistantMessages, or none when supported by the current schema.variableExtractionPlan.schema only for specific structured values needed downstream. Do not invent values or claim extraction occurred before a real handoff.members from verified assistant IDs in explicit order.assistantVersion only to a version returned by the public assistant API when the user wants an immutable pin. Omit it to follow latest.POST /squad only after explicit live-create intent.400, correct a documented field placement or limit before at most one justified retry.401 or 403, stop for authentication or permission issues. On 404, report the missing assistant, tool, or Squad. On 5xx, report the service failure.Use verified IDs only:
{
"name": "Support Squad",
"members": [
{ "assistantId": "<verified-triage-assistant-id>" },
{ "assistantId": "<verified-billing-assistant-id>" },
{ "assistantId": "<verified-technical-assistant-id>" }
]
}The first member is the entry assistant. Handoff tools belong on the relevant source assistants; Squad membership alone does not define every transition.
{
"type": "handoff",
"function": { "name": "handoff_to_billing" },
"destinations": [
{
"type": "assistant",
"assistantId": "<verified-billing-assistant-id>",
"description": "The caller needs billing, invoice, or payment help.",
"contextEngineeringPlan": {
"type": "userAndAssistantMessages"
},
"variableExtractionPlan": {
"schema": {
"type": "object",
"properties": {
"accountNumber": { "type": "string" }
}
}
}
}
]
}Placeholders are acceptable in templates, never in live requests. Read Squad Configuration for transient Squads, context transfer, version pins, and safe Squad updates. Read Squad API Examples when the user requests TypeScript, Python, or cURL implementation code.
Send only the changed top-level fields to PATCH /squad/{id}. Omit members for a name-only or other non-member update. When the requested change affects member order, membership, version pins, assistant overrides, or handoff destinations:
GET /squad/{id}.members array and current membersOverrides when it must also change.assistantId or inline assistant, assistantVersion, assistantOverrides, and any documented destination fields already present.members array plus only the other changed top-level fields.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.