Your first ten minutes
What it catches
Four checks, in the order they matter. Each card gives you the exact sentence to say to your agent.
First, which one are you?
This decides what you can run today
You work in a terminal
Claude Code, Cursor, Antigravity, or your own setup. All four cards below work. The checks run on your machine, against a folder you point them at, and nothing is uploaded.
You work in the Claude app
The click-to-add connector, no terminal. Cards 1 to 3 will not run for you yet: they read a folder on your machine, and the hosted server cannot see your machine, so it refuses the call instead of guessing. What works today is skill_security_audit, which reads a skill you paste in.
Better to tell you now than to hand you a clean result that was never about your code.
Four checks, in order
Say this to your agent
Scan the code your agent wrote
code_pattern_audit
Flags known-bad shapes: shell and command injection, unsafe eval and new Function use, disabled TLS verification, weak crypto, and unsafe XML parsing that opens the door to XXE. These are exactly the shapes AI tends to copy from bad tutorials.
It runs against a local path, not a paste box: your agent runs the check on --root . (or the folder you point it at), and code_pattern_audit is not one of the tools the hosted remote transport can invoke.
Rules CP002, CP003, CP004, CP009–CP011, CP013–CP015, CP018
Say this to your agent
“Run the Jackdaws code_pattern_audit on this repo and explain each finding.”
Find the tests that can't fail
vacuous_guard_audit
Green checkmarks don't mean much if the tests behind them can't actually fail. It looks for assertions inside a loop over a collection that could be empty, parametrized cases computed without a guard for the empty case, and tests that report a pass when their input set is empty.
Same local-path model as card 1 — this runs against your tests folder on disk, and vacuous_guard_audit is likewise absent from the hosted remote transport's tool set.
Rules VG001–VG003
Say this to your agent
“Run the Jackdaws vacuous_guard_audit on my tests folder.”
Vet what you installed
plugin_manifest_audit
Before your agent reads your prompt, it reads whatever plugins and skills you've installed. This checks plugin manifests and commands for structural problems, malformed hooks, misconfigured .mcp.json server entries, and a secret-shaped string — an API key, a cloud access key, a private-key block — anywhere in the plugin's committed tree.
This one is also local-path only: point it at your .claude/plugins directory and it reads the files there — plugin_manifest_audit is not in the set of tools the hosted remote transport exposes.
Rules PM001–PM004, PM007–PM009
Say this to your agent
“Run plugin_manifest_audit on every plugin in your .claude/plugins directory.”
Antigravity users: check the workspace is wired to finish
agy_surface_audit
Antigravity's biggest failure mode isn't wrong code — it's an agent that claims “done” when it isn't. This checks a workspace's structural setup, including whether rules or skills live under .agent/ instead of .agents/.
Unlike cards 1-3, agy_surface_audit is in the set of tools the hosted remote transport can also invoke.
Rules AG001
Say this to your agent
“Run agy_surface_audit on this workspace's .agents/ rules and hooks.json.”
Works with
Claude Code, Antigravity, claude.ai, or your own harness
Cards 1–3 run only on the local path, in your agent, against a path on your machine. Card 4’s agy_surface_audit is also in the set of tools the hosted remote transport can invoke.
What’s next
Once the four above are clean
claude_md_audit
Catches a CLAUDE.md that has grown stale.
instruction_layer_audit
Catches instructions the model has stopped reliably following.
audit_merge_semantics
Looks for the shapes a silent revert takes in a merge resolution.
agy_stall_audit
Tells you which stall class ended a run that stopped early.
The catalog reads the live stats rather than a number typed into this page.
What this doesn’t catch
A clean scan is not a security guarantee
Every check above is a deterministic, read-only static scan against a fixed rule set — no model call in the loop. None of it tests runtime authorization, business-logic limits, or anything that only shows up when the app is actually running. A clean scan means your code doesn’t have these specific known-bad shapes in it — not that it’s secure.