agent-pluginsSAFE
SetKernel's org-wide setup for AI coding agents: Claude Code plugin, marketplace, shared skills, subagents and rules. No secrets here.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
The org-wide layer for setkernel's AI agents. Public on purpose, so cloud sessions and every repo's CI can read it without credentials. Never put secrets, personal data or personas here.
Plan and decisions: setkernel/hq PR #41 (discussion setkernel/hq#40); its "Amendments accepted by Raghav" section overrides the rest. Releases ship from main; every merge needs Raghav's code-owner approval.
What is here
671718d9bb3aOBSERVED · 2026-10-13Install
Commands as the repository documents them. They are shown, not run.
uv sync
Host compatibility
What the documentation claims. We have not run a compatibility test.
| Host | Status | Notes |
|---|---|---|
| claude-code | mentioned |
What it tells the agent
The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.
--- name: review-blockers description: Review the current branch for merge blockers only, using the setkernel reviewer subagent, check each reported blocker yourself, then summarize for the owner. Use when asked to review a branch or PR. --- 1. Make sure the branch is committed and up to date with the default branch (`git fetch`, then compare with `origin/HEAD`). 2. Delegate to the `setkernel:reviewer` subagent: "Review this branch against the default branch. Merge blockers only, with file, line, why, and how to reproduce." 3. Check each reported blocker yourself before passing it on (open the file, run the repro). Drop any you can't confirm and say so. 4. Reply with: **Blockers** (confirmed), **Not confirmed**, **Checks** (the `verify` results).
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (6)
ln -s ../../.agents/skills/verify "$r/.claude/skills/verify"
other repos' CI fetches. Public on purpose so sessions and CI read it without credentials.
repo's CI can read it without credentials. **Never put secrets, personal data or personas here.**
- Never read, print, copy, edit or commit secrets: `.env*`, `.dev.vars*`, keys, certificates,
curl -fsSL https://raw.githubusercontent.com/setkernel/agent-plugins/main/check/check.sh | sh -s -- .
Gates applied: no_behavioural_pass, no_license.
671718d9bb3afull audit observations/trust-audit/skill/setkernel__agent-plugins.json · Report an issue / request a re-scanAudit history
Every audit this skill has had.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-13 | 671718d9bb3a | SAFE | B | 89 | first audit |
Questions
What does the agent-plugins skill do?
SetKernel's org-wide setup for AI coding agents: Claude Code plugin, marketplace, shared skills, subagents and rules. No secrets here.
Is agent-plugins safe to install?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.
What can agent-plugins access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
Which assistants does agent-plugins work with?
Its documentation mentions claude-code. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (671718d9bb3a), read on 2026-10-13. The repository is watched, and a new audit runs when it changes — this is the first audit.