agent-scaffolder — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited agent-scaffolder (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when:
The input should be an Agent Build Spec with at least these sections:
Generate a Python project with this layout:
your-agent/
src/
__init__.py
agent.py # Controller loop
tools.py # Tool contracts and executor stubs
state.py # Session state dataclass
permissions.py # Runtime permission policy
observability.py # Structured JSON logging
main.py # CLI entry point
requirements.txt
README.mdDefine a SessionState dataclass with:
session_id field (auto-generated UUID).turn_count integer.tool_history list for recording every tool call.completed boolean and failure_reason optional string.total_input_tokens and total_output_tokens.record_tool_call() method and a summary() method.Use dataclasses.dataclass with field(default_factory=...) for mutable defaults.
For each tool in the spec:
name, description, input_schema (JSON Schema), permission (from the spec), timeout_seconds, and side_effects._exec_{tool_name}(inp: dict) -> dict that returns realistic placeholder data.TOOL_CONTRACTS list._anthropic_tools() function that converts contracts to Anthropic API format.execute_tool(tool_name, raw_input) -> (json_result, latency_ms) function.Mark the mock executors clearly so users know where to plug in real integrations.
Define:
PermissionLevel enum: AUTO_ALLOW, ASK_FIRST, DENY.check_permission(tool_name) -> PermissionLevel function that reads from the tool contracts.request_human_approval(tool_name, tool_input) -> bool function using CLI input (with a comment noting this should be replaced with Slack, web UI, etc. in production).Define structured JSON logging functions:
log_event(event_type, data, session_id) — base logger to stderr.log_tool_call(session_id, turn, tool_name, latency_ms, success, error).log_approval(session_id, turn, tool_name, approved).log_turn(session_id, turn, input_tokens, output_tokens).log_session_end(session_id, summary).This is the core. Generate:
SYSTEM_PROMPT string that:{tool_names} and {state_summary} template variables._build_system_prompt(state) -> str function.run_agent(user_goal, **kwargs) -> SessionState function implementing:MAX_TURNS:client.messages.create() with system, tools, and messages.permissions.check_permission().request_human_approval(). On denial, stop.tools.execute_tool().observability.A simple CLI using argparse:
goal argument with a sensible default.--campaign, --repo, --ticket).run_agent() and print the session summary.anthropic>=0.42.0Include:
from __future__ import annotations in every file.agent.py clean and readable; push details into other modules.os.environ.get("ANTHROPIC_API_KEY").~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.