restart — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited restart (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Run .skills/restart/scripts/restart.sh from the project root. It is exactly run_monitor.sh --stop followed by run_monitor.sh --detach: it stops the currently detached proxy (graceful SIGTERM, then SIGKILL after ~5s) and starts a fresh one in the background, printing the new PID and log path.
.skills/restart/scripts/restart.sh # restart with current config
.skills/restart/scripts/restart.sh -- --port 8090 --log-level debug
.skills/restart/scripts/restart.sh --log-file data/other.log # target a non-default log/pidfile--watch).skills/restart/scripts/restart.sh --watch restarts once now, then keeps restarting automatically whenever a source file under src/ or bin/ changes — handy when another clawback claude session is editing the code and you want the proxy to pick it up hands-free.
.skills/restart/scripts/restart.sh --watch # auto-restart on src/ + bin/ edits
.skills/restart/scripts/restart.sh --watch -- --port 8090 # passthrough is forwarded to every restartIt runs in the foreground and prints each restart as it happens. Ctrl-C stops watching but leaves the proxy running (restarts are spawned in their own session, so the signal can't reach them) — same survivability as a plain --detach.
Mechanics, in case you need to reason about it:
src/ and bin/ are watched, recursively. The proxy's own writeslive under data/, which is deliberately not watched, so there is no restart loop.
.js/.mjs/.cjs files; editor swap/backup files(.swp, ~, vim's 4913 probe) and node_modules/.git are ignored, so a single :w triggers exactly one restart.
serialized: a change arriving mid-restart queues exactly one more once the current one finishes, so two restarts never race on the pidfile.
.skills/restart/scripts/watch.mjs (zero deps, built-in recursivefs.watch). It is a general debounced run-on-change runner — restart.sh just points it at src/+bin/ with the restart command.
--detach truncates and reuses the same log file (data/clawback.run.log by default). A follower started with tail -n +1 -F re-opens the recreated file on its own, so:
.skills/scripts/run_monitor.sh --attach keeps streaming across therestart — no need to stop and relaunch it;
with a brief gap while the proxy is down.
Under clawback's probe-then-decide model, interactive clawback claude sessions ATTACH to this proxy rather than running their own. A restart drops their upstream for the ~1s the proxy is down: in-flight requests fail and Claude Code retries, while session state is reloaded from the state file on boot (look for resumed N session(s)), so the sessions continue afterward. Restart when that brief blip is acceptable.
--log-file PATH / --pid-file PATH are forwarded to BOTH phases, so the stop targets the same proxy the detach replaces. Anything after -- is forwarded verbatim to the new clawback (the stop phase ignores it). See the monitor skill for the full option set and the highlighting/agent-usage notes that apply to the recreated log.
.skills/scripts/run_monitor.sh --status # should report RUNNING with the new pid~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.