report_smoke — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited report_smoke (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Run .skills/report_smoke/scripts/report_smoke.sh from the project root:
.skills/report_smoke/scripts/report_smoke.shEnvironment variables (optional):
CLAWBACK_REPORT_DIR — runs directory to serve (default ./runs)It needs at least one completed run on disk (a subdir with a parseable summary.json). The repo ships runs/smoke and runs/L0-tier1; the L0-tier1 run also contains the sensitive proxy.*.log + turns.*.ndjson siblings, which is exactly what the non-exposure assertions check against.
No upstream and no API key are required — report routes never proxy to Anthropic. The proxy boots over plain HTTP on a free high port and is torn down on exit. Exit code is the number of failed assertions (0 = all green).
What the script verifies:
/_proxy/report/ serves index.html with__BASE__ replaced by the real /_proxy/report/ base href (no literal __BASE__ leaks); report.js/report.css serve with correct MIME types.
/runs lists the on-diskruns newest-first; /data?run=L0-tier1 returns summary (carrying the tokens reclaim block) + charts + csvBytes; /chart/<id>/tokens_saved.svg serves that SVG by name (the same route also serves the bare tokens_saved.bg.svg share-card background); /csv/<id> serves a CSV download.
proxy.*.log / turns.*.ndjson siblings are unreachable, the data payload does not leak their bytes, and ?run=.. / encoded traversal are rejected 400.
Host 421s on a guarded endpoint(/_proxy/metrics) but the report viewer is exempt and still returns 200.
/_proxy/ui/ exposes the reportLink.--admin-path ctrl serves/ctrl/report/... (base href injected as /ctrl/report/) while the old /_proxy/report/ path 404s, proving the admin prefix is not hardcoded.
Complements test/report.test.js (unit-level, synthetic run dirs): this exercises the shipped bin/clawback.js boot path against real runs.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.