ash-guide — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ash-guide (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Quick reference for all Rune plugin agents, their roles, and invocation patterns.
All Rune agents are plugin agents. Invoke with the rune: namespace prefix:
Agent rune:review:ward-sentinel("Review these files for security")
Agent rune:review:ember-oracle("Check performance bottlenecks")
Agent rune:utility:runebinder("Aggregate review findings")Common mistake: Using agent name without namespace prefix.
# WRONG - agent not found
Agent ward-sentinel(...)
# CORRECT - full namespace
Agent rune:review:ward-sentinel(...)The /rune:appraise and /rune:audit commands use general-purpose subagents with composite Ash prompt templates from agents/. Each Ash embeds multiple agent perspectives into a single teammate. This is intentional — composite Ashes don't map 1:1 to individual agent files.
Agent({ subagent_type: "general-purpose", team_name: teamName, name: "ash-name", prompt: /* from ../../agents/{category}/{role}.md */ })The agent file allowed-tools are not enforced at runtime for composite Ashes. Tool restriction is enforced via prompt instructions (defense-in-depth).
Note: Agents listed below withrune:review:*,rune:testing:*, orrune:utility:*types may live inregistry/rather thanagents/. Registry agents cannot be spawned directly viaAgent({ subagent_type: "rune:review:blight-seer" })— the plugin-namespaced type won't resolve. Instead, usesubagent_type: "general-purpose"and inject the agent body via theagent_detail(name)MCP call orRead("registry/{category}/{name}.md"). Agents inagents/(e.g.,ward-sentinel,ember-oracle,flaw-hunter) ARE directly spawnable via their listed type names.
Review-style agents (in agents/review/; an additional set lives in registry/review/ and is loaded on-demand):
| Agent | Role | Perspective |
|---|---|---|
rune:review:ward-sentinel | Security review | Vulnerabilities, auth, injection, OWASP, prompt injection |
rune:review:ember-oracle | Performance review | Bottlenecks, N+1 queries, async patterns, memory |
rune:review:rune-architect | Architecture review | Layer violations, DDD, dependency direction |
rune:review:simplicity-warden | Simplicity review | YAGNI, over-engineering, premature abstraction |
rune:review:flaw-hunter | Logic review | Edge cases, race conditions, null handling, off-by-one |
rune:review:mimic-detector | Duplication review | DRY violations, copy-paste code, similar patterns |
rune:review:pattern-seer | Pattern review | Naming consistency, convention adherence |
rune:review:void-analyzer | Completeness review | Missing error handling, incomplete implementations |
rune:review:wraith-finder | Dead code & unwired code review | Unused functions, DI wiring gaps, orphaned routes/handlers, AI orphan detection |
rune:review:phantom-checker | Dynamic reference check | Reflection, string-based imports, meta-programming |
rune:review:type-warden | Type safety review | Type hints, mypy strict, Python idioms, async correctness |
rune:review:trial-oracle | TDD compliance review | Test-first order, coverage gaps, assertion quality |
rune:review:depth-seer | Missing logic review | Error handling gaps, state machines, complexity hotspots |
rune:review:blight-seer | Design anti-pattern review | God Service, leaky abstractions, temporal coupling, observability |
rune:review:forge-keeper | Data integrity review | Migration safety, reversibility, lock analysis, transaction boundaries, PII |
rune:review:tide-watcher | Async/concurrency review | Waterfall awaits, unbounded concurrency, cancellation, race conditions |
rune:review:refactor-guardian | Refactoring completeness review | Orphaned callers, incomplete extractions, missing dependency moves, stale test refs |
rune:review:reference-validator | Reference integrity review | Import paths, config-to-source refs, frontmatter schema, version sync |
rune:review:reality-arbiter | Production viability truth-telling | Integration honesty, production readiness, data reality, error path honesty |
rune:review:assumption-slayer | Premise validation truth-telling | Problem-solution fit, cargo cult detection, complexity justification |
rune:review:entropy-prophet | Long-term consequence truth-telling | Complexity compounding, dependency trajectory, lock-in, maintenance burden |
rune:review:ux-flow-validator | User flow completeness | Loading states, error boundaries, empty states, confirmation dialogs, undo, graceful degradation (UXF-). Conditional: ux.enabled + frontend files |
rune:review:ux-cognitive-walker | Cognitive walkthrough | First-time user simulation, discoverability, learnability, error recovery, progressive disclosure (UXC-). Conditional: ux.enabled + cognitive_walkthrough: true |
v3.0.0-alpha.1+alpha.2 removed:design-system-compliance-reviewer,ux-heuristic-reviewer,ux-interaction-auditor,design-implementation-reviewerwere retired with their consumers. UX/design review now uses the survivingux-flow-validator,ux-cognitive-walker, andaesthetic-quality-reviewer.
In /rune:appraise, agents are grouped into 7 built-in Ashes (extensible via talisman.yml):
| Ash | Agents Embedded | Scope |
|---|---|---|
| Forge Warden | rune-architect, ember-oracle, flaw-hunter, mimic-detector, type-warden, depth-seer, blight-seer, forge-keeper | Backend code (.py, .go, .rs, .rb, .java) |
| Ward Sentinel | ward-sentinel | ALL files (security always) |
| Veil Piercer | reality-arbiter, assumption-slayer, entropy-prophet | ALL files (truth-telling always) |
| Pattern Weaver | simplicity-warden, pattern-seer, wraith-finder, phantom-checker, void-analyzer, trial-oracle, tide-watcher, refactor-guardian, reference-validator | ALL files (quality patterns) |
| Glyph Scribe | Inline perspectives (TypeScript safety, React performance, accessibility) | Frontend code (.ts, .tsx, .js, .jsx) |
| Knowledge Keeper | Inline perspectives (accuracy, completeness, consistency) | Docs (.md files, conditional) |
Note: Forge Warden, Ward Sentinel, Veil Piercer, and Pattern Weaver embed dedicated review agent files. Glyph Scribe and Knowledge Keeper use inline perspective definitions in their Ash prompts (no dedicated agent files).
| Agent | Role |
|---|---|
rune:utility:runebinder | Aggregates review/audit outputs → writes TOME.md |
rune:utility:truthseer-validator | Audit coverage validation (Phase 5.5) |
rune:utility:flow-seer | Spec flow analysis |
rune:utility:scroll-reviewer | Document quality review |
rune:utility:decree-arbiter | Technical soundness review for plans |
rune:utility:mend-fixer | Parallel code fixer for /rune:mend findings |
rune:utility:knowledge-keeper | Documentation coverage reviewer for plans |
rune:utility:veil-piercer-plan | Plan-level truth-teller (Phase 4C plan review) |
| Agent | Role |
|---|---|
rune:research:practice-seeker | External best practices research |
rune:research:repo-surveyor | Codebase/repo exploration |
rune:research:lore-scholar | Framework documentation research |
rune:research:git-miner | Git history archaeology |
rune:research:wiring-cartographer | Maps integration points where new code connects to existing system |
rune:research:activation-pathfinder | Traces activation and migration paths for new features |
| Agent | Role |
|---|---|
rune:work:rune-smith | Code implementation (TDD-aware) |
rune:work:trial-forger | Test generation |
These agents live inregistry/testing/and are spawned indirectly by the/rune:testingskill during arc Phase 7.7. They cannot be passed to theAgent()tool'ssubagent_typeparameter directly.
| Agent | Role |
|---|---|
registry:testing:unit-test-runner | Diff-scoped unit test execution (Sonnet) |
registry:testing:integration-test-runner | Integration test execution with service management (Sonnet) |
registry:testing:e2e-browser-tester | E2E browser testing via agent-browser (Sonnet) |
registry:testing:test-failure-analyst | Read-only failure analysis and fix suggestions (Opus inherit) |
The /rune:appraise command selects Ash based on file extensions (Rune Gaze):
| File Pattern | Ash Selected |
|---|---|
**/*.py | Forge Warden + Ward Sentinel + Pattern Weaver + Veil Piercer |
**/*.{ts,tsx,js,jsx} | Glyph Scribe + Ward Sentinel + Pattern Weaver + Veil Piercer |
**/*.md (>= 10 lines changed) | Knowledge Keeper (conditional) |
| Mixed code + docs | All applicable Ash |
Ward Sentinel, Pattern Weaver, and Veil Piercer are selected for every review regardless of file types.
See roundtable-circle skill for full Ash architecture and prompts.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.