agent-rig-system — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited agent-rig-system (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A rig is a collection of _riglets_ that provide knowledge and tools for AI agents. Rigs and riglets are packaged as Nix flake outputs, so they can both be used inside the project defining them and by other projects depending on it.
A riglet is executable knowledge packaged with its dependencies, as a Nix module:
references/*.md files documenting processes and recipesA project-level structure that declares which riglets are active:
buildRig to compose riglet modulesA Nix library and CLI tool: http://github.com/YPares/rigup.nix
#### rigup Nix library
Main functions:
buildRig: evaluates riglet modules and ensures they comply with the riglet schema used by rigup. Returns the rig as an attrset: { toolRoot = <derivation>; meta = { <riglet> = {...}; }; docAttrs = { <riglet> = <derivation>; }; docRoot = <derivation>; home = <derivation>; shell = <derivation>; }resolveProject: inspects the riglets/ folder of a project and its rigup.toml to find out which riglets and rigs it defines. It calls buildRig for each rig in the rigup.tomlgenManifest: generates a markdown+XML manifest file describing the contents of a rig, primarily for AI agent's consumptionmkRiglib: creates a set of utility functions to be used to define riglet Nix modulesDefined in {{repoRoot}}/lib/default.nix.
#### rigup CLI tool
A Rust app. It provides convenient access to rig outputs, via commands like rigup build and rigup shell, and project scaffolding via rigup new. This tool is meant for the user primarily. Agents should not have to call it directly.
Defined in {{repoRoot}}/packages/rigup
Riglets are Nix modules with access to riglib helpers
# First argument: the defining flake's `self`
# Gives access to `self.inputs.*` and `self.riglets.*`
# Use `_:` if you don't need it
self:
# Second argument: module args from evalModules
{ config, pkgs, lib, riglib, ... }: {
# Riglet-specific options (optional)
options.myRiglet = {
myOption = lib.mkOption {
type = lib.types.str;
description = "Example option";
};
};
# Riglet definition
config.riglets.my-riglet = {
# Dependency relationship/Inheritance mechanism: if B imports A, then whenever B is included in a rig, A will automatically be included too
imports = [ self.riglets.base-riglet self.inputs.foo.riglets.bar ... ];
# Tools can be:
# - Nix packages: pkgs.jujutsu, pkgs.git, etc.
# - Script paths: ./scripts/my-script (auto-wrapped as executables)
tools = [
pkgs.tool1
pkgs.tool2
./scripts/helper-script # Becomes executable "helper-script"
];
# Metadata for discovery and context
meta = {
description = "What this riglet provides";
mainDocFile = "SKILL.md"; # Where to start reading the docs (SKILL.md by default)
intent = "cookbook"; # What the agent should expect from this riglet
whenToUse = [
# When the AI Agent should read/use this riglet's knowledge, recipes and tools
"Situation 1" # or
"Situation 2" # or
...
];
keywords = [ "keyword1" "keyword2" ];
status = "experimental"; # Maturity level
version = "x.y.z"; # Semantic version of riglet's interface (configuration + provided methods, procedures, docs...)
disclosure = lib.mkDefault "lazy" # How much to show about riglet in manifest
# mkDefault makes it possible for end users to override this in their rigup.toml
};
# Documentation file(s) (Skills pattern: SKILL.md + references/*.md)
docs = riglib.writeFileTree {
"SKILL.md" = ...; # A main documentation file
references = { # Optional. To add deeper knowledge about more specific topics, less common recipes, etc.
# SKILL.md MUST mention when each reference becomes relevant
"advanced.md" = ...;
"troubleshooting.md" = ...;
};
};
# Files can be defined either as inlined strings or nix file derivations/paths.
# Folders can be defined either as nested attrsets or nix folder derivations/paths,
# so if you have a ready to use folder you can do:
#docs = ./path/to/skill/folder;
# Configuration files (optional) for tools following the
# [XDG Base Directory Specification](https://specifications.freedesktop.org/basedir/latest/)
configFiles = riglib.writeFileTree {
# Built from a Nix attrset
myapp."config.toml" = riglib.toTOML {
setting = "value";
};
# Read from existing file
myapp."stuff.json" = ./path/to/stuff.json;
# Inlined as plain text
myapp."script.sh" = ''
#!/bin/bash
echo hello
'';
};
# EXPERIMENTAL: Prompt commands (slash commands for harnesses like Claude Code)
promptCommands.my-cmd = {
template = "Do something specific with $ARGUMENTS";
description = "What this command does";
useSubAgent = false;
};
};
# EXPERIMENTAL: MCP (Model Context Protocol) servers
mcpServers.some-local-mcp.command = pkgs.my-mcp-server;
mcpServers.some-remote-mcp = {
url = "https://...";
useSSE = true; # false by default
};
}The full Nix module schema of a riglet is defined in {{repoRoot}}/lib/rigletSchema.nix.
Examples of actual riglets: {{repoRoot}}/riglets.
When defining a riglet, the meta section specifies its purpose, maturity, and visibility. See references/metadata-guide.md for comprehensive details on:
See references/riglib-utilities.md for details on helper functions available via riglib:
riglib is defined in {{repoRoot}}/lib/mkRiglib.nix
WARNING: These features are still experimental and their schema may change.
#### Prompt Commands
Riglets can define reusable prompt templates (slash commands) for agent harnesses like Claude Code:
promptCommands.analyze = {
template = "Analyze $1 for potential issues";
description = "Perform code analysis";
useSubAgent = false; # Whether to run in a sub-agent
};Templates use standard Claude command syntax: $ARGUMENTS for all args, or $1, $2, etc. for specific positional arguments.
#### MCP Servers
Riglets can provide MCP (Model Context Protocol) servers to extend agent capabilities:
mcpServers.my-tools = {
command = pkgs.my-mcp-server; # Package that starts the server
};WARNING: API still experimental.
Advanced patterns for composing riglets together and sharing configuration. See references/advanced-patterns.md for:
configimportsAdd a rigup.toml file to your project root:
[rigs.default.riglets]
self = ["my-riglet"]
rigup = ["git-setup"]
[rigs.default.config.agent.identity]
name = "Alice"
email = "[email protected]"Then use rigup.lib.resolveProject in your flake.nix:
{
inputs.rigup.url = "github:YPares/rigup.nix";
outputs = { self, rigup, ... }@inputs:
# Using the rigup flake directly as a function is equivalent to calling
# `rigup.lib.resolveProject`, as `rigup` defines the __functor attr.
#
# rigup follows the same pattern as the 'blueprint' flake (https://github.com/numtide/blueprint):
# - exposes one main "entrypoint" function, callable through the flake "object" itself
# - inspects user flake's inputs and repository's contents
# - constructs (part of) user flake's outputs
rigup {
inherit inputs;
# A unique name, used in error messages, to make it more explicit where mentioned riglets come from
projectUri = "some-username/some-project-name";
}
}For config not representable in TOML:
{
inputs.rigup.url = "github:YPares/rigup.nix";
outputs = { self, rigup, nixpkgs, ... }@inputs:
let
system = "x86_64-linux";
pkgs = import nixpkgs { inherit system; };
in
pkgs.lib.recursiveUpdate # merges both recursively, second arg taking precedence
(rigup.lib.resolveProject {
inherit inputs;
projectUri = "...";
})
{
rigs.${system}.custom = rigup.lib.buildRig {
name = "my-custom-rig";
inherit pkgs;
modules = [
# A module from rigup:
rigup.riglets.git-setup
# A module defined directly inline:
{
# Complex Nix expressions
agent.complexOption = lib.mkIf condition value;
}
];
};
};
}resolveProject outputsriglets.<riglet> - Auto-discovered riglet modulesrigs.<system>.<rig> - Output of buildRig for each discovered rig:toolRoot - Folder derivation. Tools combined via nixpkgs buildEnv function (bin/, lib/, share/, etc.) and wrapped (when needed) to fix their XDG_CONFIG_HOMEconfigRoot - Folder derivation. The combined config files for the whole rig, with config files for all rig's _wrapped_ tools.meta.<riglet> - Attrset. Per-riglet metadata, as defined by the riglet's moduledocAttrs.<riglet> - Folder derivation. Per-riglet documentation folder derivationsdocRoot - Folder derivation. Combined derivation with docs for all riglets (one subfolder for each)home - Folder derivation. All-in-one directory for the rig: RIG.md manifest + .local/ + docs/ + .config/ foldersshell - Shell derivation (via pkgs.mkShell) exposing ready-to-use RIG_MANIFEST and PATH env varsextend - Nix function. Adds riglets to a pre-existing rig: takes {newName, extraModules} and returns a new rigmanifest - A manifest for this rig, overridable with options to shorten included paths to avoid repeatedly including long explicit paths into the Nix storeresolveProject is defined in {{repoRoot}}/lib/resolveProject.nix.
The user decides how they and their agent should use the rig: either via its _shell_, _home_ or _entrypoint_ output derivations. In any case, the agent's focus should be is the RIG.md manifest file. This file lists all available riglets with:
Agents should read this file first to understand available capabilities.
buildRig output derivationsbuildRig outputs a Nix attrset ("object") that notably contains several "all-in-one" derivations which all allow an AI agent to access the rig's tools and documentation. Which derivation to use depends on what is the most convenient given the user's setup. This section lists how and when to use each.
buildRig is defined in {{repoRoot}}/lib/buildRig.nix
#### shell output
The AI agent runs in a subshell: a $RIG_MANIFEST env var is set that contains the path to the RIG.md manifest the agent should read. Also, $PATH is already properly set up by the subshell so all tools are readily usable.
# Start a rig as a sub-shell (the user should do that)
rigup shell ".#<rig>" [-c <command>...] # Does `nix develop ".#rigs.<system>.<rig>.shell" [-c <command>...]`
# Read the rig manifest
cat $RIG_MANIFESTAdvantages of using `shell`:
#### home output
The AI agent reads from a complete locally-symlinked "home-like" folder. The RIG.md manifest and an activate.sh script will be added _at the root_ of this folder. The activate.sh, once sourced, provides the needed PATH.
# Build complete home directory with tools + docs + config as a `.rigup/<rig>` folder at the top-level of the project (the user should do that)
rigup build ".#<rig>" # Does `nix build ".#rigs.<system>.<rig>.home"`
# Read the rig manifest to see what's available
cat .rigup/<rig>/RIG.md
# Source the activation script to use the tools
source .rigup/<rig>/activate.sh && git --version && other-tool ...
# Read documentation (paths shown in RIG.md)
ls .rigup/<rig>/docs/
cat .rigup/<rig>/docs/<riglet>/SKILL.mdAdvantages of using `home`:
#### entrypoint output
The entrypoint output is special in that it does not exist unless some riglet sets it, by defining config.entrypoint. It is mainly used to provide direct integration with common coding agent harnesses. Similar to home and shell, entrypoint packages the whole rig as a Nix derivation, but this time as a wrapper shell script that starts the harness with the proper config files and CLI args.
rigup run <flake>#<rig> executes a rig's entrypoint. Internally it just runs nix run <flake>#rigs.<system>.<rig>.entrypoint.
Claude Code integration is currently available via the claude-code riglet. See references/harness-integration.md for more details.
Advantages of using `entrypoint`:
extract-md-tocThis riglet (agent-rig-system) comes with extract-md-toc. This is the tool that renders the inline table of contents of the rig manifests (for riglets with disclosure = "{shallow,deep}-toc";). It can also be used to extract a similar ToC out of ANY Markdown file: e.g. extract-md-toc foo.md --max-level 3 will show all headers from # to ### with their line numbers. It can also read from stdin: extract-md-toc - < foo.md
Defined in {{repoRoot}}/packages/extract-md-toc
In the project defining the riglets OR in another one importing it as an input flake, either add riglets and their config to the rigs defined in the top-level rigup.toml file, or directly edit the flake.nix if more advanced configuration is needed. In both cases, the flake should call rigup.lib.resolveProject (or just rigup, which contains a __functor attr which defers to resolveProject) to discover rigs and riglets, and the rigs should be under the rigs.<system>.<rig-name> output.
In some project:
riglets/my-riglet.nix, or riglets/my-riglet/default.nix for riglets with multiple supporting filesflake.nix that uses rigup.lib.resolveProject as mentioned above, so all the riglets will be exposed by the flakeIf your rig contains riglet-creator, consult it for more detailed information about writing proper riglets.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.