replay — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited replay (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Run .skills/replay/scripts/replay_load.sh from the project root. It pre-flights (proxy reachable? CLAWBACK_OAUTH_TOKEN bearer set?) and then forwards every argument to benchmark/bin/replay.js. Data is captured by the proxy's --turn-log, not by this driver — start the proxy (with its own turn-log) via .skills/monitor first.
There is no Anthropic API key here. A real run forwards Authorization: Bearer $CLAWBACK_OAUTH_TOKEN — the same OAuth credential claude sends (Claude Max) — which clawback then forwards upstream. If you'd rather not handle the bearer directly, drive real traffic through the PTY arm (.skills/drive), which uses your actual claude login.
A non---dry-run run sends real /v1/messages requests against your Anthropic limits — the very thing clawback stretches. Budget it (cap --turns, use the cheap Haiku fixture for plumbing). --dry-run needs no bearer and no proxy.
# inspect the fixture + planned gap schedule, no proxy/bearer, no spend:
.skills/replay/scripts/replay_load.sh --dry-run --profile L0 --turns 5
# real block (proxy must be up with a --turn-log; bearer forwarded as
# Authorization, never an API key):
CLAWBACK_OAUTH_TOKEN=… .skills/replay/scripts/replay_load.sh \
--profile L2 --turns 200 --fixture benchmark/fixtures/ccode.json \
--port 8787 --session-id A5-L2--profile L0|L1|L2|L3|L4 — inter-turn gap range (mirrors .skills/drive).--turns N, --gap-sec N (fixed-gap override for fast mechanics tests).--fixture PATH — the /v1/messages body to replay.--session-id ID — path-mode SESSION KEY; use a fresh one per block.Omitted → auto-minted per run.
--shared-cache — skip the per-block cache nonce (measure a warm startacross runs). Default is FRESH: a unique nonce is prepended to system so Anthropic's prefix cache starts cold for the block (carry-over control).
--anthropic-beta STR — defaults to a realistic value includingextended-cache-ttl-2025-04-11; required for arm A2 (1h-TTL) to be faithful, because clawback forwards but does not add this beta.
--stream, --model ID, --transcript PATH.The shipped benchmark/fixtures/ccode.json is a sanitized real capture (one Claude Code turn captured 2026-06-02 via .skills/capture; identifiers and personal context scrubbed, cache_control breakpoints and cch structure untouched). It is faithful in shape, but Claude Code's prompt evolves with every release — for headline numbers on today's build, mint a fresh body with .skills/capture (it drives one real claude turn through a --capture-body proxy and promotes the pristine dump to a fixture), then pass it here with --fixture. Or lean on .skills/drive (the faithful real-claude arm).
When both arms' turn-logs are collected, analyze with .skills/bench:
node benchmark/bin/analyze.js --out runs/report-$(date +%s) \
--label A0=runs/A0.ndjson --label A5=runs/A5.ndjson~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.