claude-vigil — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited claude-vigil (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 4 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
File recovery. Saves checkpoints before dangerous operations, diffs changes, restores files safely.
| Hook | When | Action |
|---|---|---|
| PreToolUse(Bash) | Destructive command detected | Auto-quicksaves affected files (rm, mv, git reset, etc.) |
Token cost: 0 on safe commands, ~30-50 on destructive. The regex matches: rm, rmdir, mv, sed -i, perl -i, git checkout/reset/clean/restore, output redirects.
| Command | Description |
|---|---|
/save-vigil <name> [files] | Create a named file checkpoint |
/restore-vigil [name] | Restore files from a checkpoint |
vigil_save(name: "before-refactor", files: ["src/auth.ts", "src/middleware.ts"])vigil_restore(name: "before-refactor")vigil_save(name: "before-refactor", files: [...])praetorian_compact(type: "decisions", ...) to save the reasoningvigil_restore(name: "before-refactor") — restore filespraetorian_restore("before-refactor") — restore contextvigil_list() — see available checkpointsvigil_diff(name: "checkpoint") — preview what would changevigil_restore(name: "checkpoint") — restore filesvigil_delete(name: "checkpoint") — clean upvigil_list() — see available checkpointsvigil_diff(name: "checkpoint") — preview changesfind_file_context("filename") to understand what changed and whyvigil_restore(name: "checkpoint") — restore files| Sibling | Value | How |
|---|---|---|
| Praetorian | Context saved alongside files | Pair vigil checkpoints with praetorian compactions for full state recovery |
| Historian | File change context from history | find_file_context() explains what happened between checkpoint and now |
| Tool | Purpose |
|---|---|
vigil_save | Create named checkpoint (SHA-256 + gzip dedup) |
vigil_list | List available checkpoints with metadata |
vigil_diff | Preview changes since checkpoint |
vigil_restore | Restore files from checkpoint |
vigil_delete | Remove a checkpoint and free storage |
Content-addressable at .claude/vigil/. 3 named slots + 1 rotating ~quicksave.
claude mcp add vigil -- npx claude-vigil-mcp~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.