shutdown — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited shutdown (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Run .skills/shutdown/scripts/shutdown.sh from the project root.
.skills/shutdown/scripts/shutdown.sh # stop the proxy + let the monitor go quiet
.skills/shutdown/scripts/shutdown.sh --sessions # also SIGTERM clawback claude sessionsWith no flags this is identical to run_monitor.sh --stop: it stops the detached proxy via its pidfile (SIGTERM first so it flushes state and closes its logger, escalating to SIGKILL only if it does not exit within ~5s) and removes the pidfile. A foreground --attach follower then prints the synthetic "process exited" line and can be Ctrl-C'd; an agent's Monitor tool simply stops seeing new lines.
Under probe-then-decide, clawback claude sessions ATTACH to an already-listening proxy rather than spawning their own, so stopping the proxy already cuts their upstream. But the session processes — and any unsaved in-flight edit inside Claude Code — are yours to end deliberately, not something this script should kill out from under you. This is the soft-default (stop the proxy) plus an explicit escape knob (--sessions), not a hard teardown.
--sessions: full teardownAdds a pass that sends SIGTERM to every clawback claude wrapper process. It lists each match (pid + full command) before signaling, so nothing dies silently. Specifics:
pgrep -f 'clawback claude', which hits only the wrappers —the bare proxy is node …/bin/clawback.js (no "claude"), and neither this script nor run_monitor.sh contains the phrase.
claude CLI child is NOT signaled; if it lingers after itswrapper exits, end it yourself.
--log-file PATH / --pid-file PATH are forwarded to run_monitor.sh --stop so a non-default proxy can be targeted. To bring the proxy back, use the restart skill (or run_monitor.sh --detach).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.