Install
$ agentstack add skill-zig999-siegard-code-u-worker-compliance ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
SKILL: Worker Compliance Validator
Purpose
Static analysis tool that validates worker agent .md files for protocol compliance before promotion to dist/. Eliminates the manual review gap that causes repeated critical issues on every worker audit cycle.
When to Use
- Before promoting any worker or orchestrator to
dist/ - When a new worker is created or an existing one is modified
- As a gate in the review phase — run
check_worker.pyon every.claude/agents/**/*.md
What It Checks
Rule W01 — Terminal event: task_completed
Every worker must contain a task_completed emit block with the required schema fields.
Required fields in --data: phase, artifacts
Detection: grep for --kind completed followed by --data containing "phase" and "artifacts".
Violation: worker emits completed but omits phase or artifacts.
Rule W02 — Terminal event: task_failed
Every worker must contain a task_failed emit block with the required schema fields.
Required fields in --data: phase, reason, retryable
Detection: grep for --kind failed followed by --data containing "phase", "reason", and "retryable".
Violation: worker emits failed but omits any of the three required fields.
Rule W03 — No terminal event
Worker contains no emit.py call with --kind completed or --kind failed.
Severity: CRITICAL — onsubagentstop.py will synthesize task_failed for every run, including successes.
Rule W04 — Non-canonical phase value
Worker hardcodes "phase":"default" in any emit call.
Valid values: any string except "default" (which signals missing implementation). Canonical values: sdd, dev, review, test.
Detection: grep for "phase":"default" or "phase": "default" in any emit.py call.
Rule W05 — register_worker missing phase argument
Orchestrator file calls register_worker(...) without phase= keyword argument.
Detection: grep for register_worker( lines that do not contain phase=.
Applies to: orchestrator files only (filename starts with orchestrator).
Violation: onsubagentstop.py falls back to full log replay to discover phase — unnecessary cost.
Rule W06 — emit.py not in skills frontmatter
Worker YAML frontmatter skills: list does not include orch-report.
Detection: parse frontmatter block; check skills list for orch-report entry.
Violation: emit.py may not be available in the worker's context.
Output Format
file:
status: pass | fail
violations:
- rule: W03
severity: critical
detail: "No --kind completed or --kind failed emit.py call found"
- rule: W04
severity: error
detail: 'Hardcoded "phase":"default" in emit call at line 55'
Exit code: 0 = all pass, 1 = any violation found.
Usage
Validate a single worker
python3 .claude/skills/u-worker-compliance/scripts/check_worker.py \
--file .claude/agents/dev/u-be-developer.md
Validate all workers in a directory
python3 .claude/skills/u-worker-compliance/scripts/check_worker.py \
--dir .claude/agents/
Validate and emit structured JSON report
python3 .claude/skills/u-worker-compliance/scripts/check_worker.py \
--dir .claude/agents/ \
--format json > compliance-report.json
Integration Points
- Run before any
git committhat touches.claude/agents/ - Can be wired as a Claude Code hook:
UserPromptSubmit→ run on changed.mdfiles - Orchestrator can call it as a pre-promotion gate before
phase_transitioned
Limitations
- Static analysis only — does not execute workers or simulate orchestration
- Cannot verify that
task_idandattemptare correctly interpolated at runtime - Does not validate the semantic correctness of
artifactspaths
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: zig999
- Source: zig999/siegard-code
- License: Apache-2.0
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.