inspect — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited inspect (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Run .skills/inspect/scripts/inspect_breakpoints.sh [PATH] [--json] from the project root.
With no PATH, it inspects the most recently modified runs/*/state*.json. This is read-only — it touches only files already on disk, never the running proxy — so it is safe to run while a benchmark is in flight.
# inspect the newest run's captured state
.skills/inspect/scripts/inspect_breakpoints.sh
# inspect a specific captured body or fixture
.skills/inspect/scripts/inspect_breakpoints.sh benchmark/fixtures/ccode.json
# machine-readable model for tooling
.skills/inspect/scripts/inspect_breakpoints.sh runs/l2-haiku/state.A0.json --jsonA cache-ordered segment table (tools -> system -> messages), each row marked with its cache_control breakpoint (and TTL) and any ephemeral token it carries, followed by a verdict centered on cch (the per-request rotator).
Worked example, from a real Claude Code v2.1.145 body:
33 20 system[0] "x-anthropic-billing-header: cch=..." <-- cch
34 14 BREAK 1h system[1] "You are Claude Code, ..."
35 7304 BREAK 1h system[2] " You are an interactive agent ..." <-- iso-date
VERDICT:
cch sits BEFORE the earliest breakpoint (pos 34). Every cached prefix
includes it, so a new cch per request cold-starts 2/2 prefixes ... No
breakpoint isolates tools or anything ahead of cch, so nothing survives.Anthropic caches the cumulative prefix up to each breakpoint by exact match. So a token at cache-order position P invalidates every breakpoint at position >= P when it rotates. That single fact characterizes the whole structure: you do not need a 2^N probe to know what cold-starts. The inspector reads the breakpoint placement straight out of the captured body and applies that rule. This replaces, rather than approximates, an exhaustive dynamic sweep; the one thing it can't prove (that Anthropic honors the breakpoints as documented) is what the optional token-costing probe confirms.
A synthetic (hand-authored) fixture may carry a tools breakpoint that real Claude Code lacks, and no cch at all — so the inspector will (correctly) report "no cch ... rotation driven only by date/env." That is a property of the input, not a bug: only a body captured from a real session (see .skills/capture) reproduces the genuine cch + breakpoint structure. The shipped benchmark/fixtures/ccode.json is such a capture (sanitized of personal data, structure intact), but it ages as Claude Code releases move — inspect a fresh --capture-body dump or a live run's state*.json for a verdict on the current build.
State files and captured bodies contain your system prompt and tool definitions. Treat the inputs as sensitive; the inspector itself only prints positions, token estimates, ~60-char segment labels, and short ephemeral samples (e.g. cch=f1b84) — not full block contents.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.