Emil_Shanaty/skills
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add trusted tooling and leverage guidance

Browse Source
This commit is contained in:
Emil Shanaty
2026-10-28 00:52:18 +03:00
parent 843974a58d
commit 051c49321b
3 changed files with 38 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agent-swarm/references/prerequisites.md
+20
View File
@@ -62,6 +62,26 @@ Do not ask "can I install dependencies?" without the exact package, scope and re
workers while the answer is pending. If the user declines, record the reduced scope and the checks
that will be `not_run`.
## Tool acquisition and trust
Build tools when they remove repeated work: a test runner, fixture generator, screenshot harness,
log parser or profiler wrapper. Keep them small, project-local, documented and tested; a tool that
nobody uses is just another dependency.
When installing something:
- prefer the existing toolchain, project-local installs and lockfiles;
- use official package managers/registries and pinned versions/commits;
- check the publisher, repository, license, release notes and checksum/signature where available;
- inspect install scripts before running them; never `curl | sh`;
- no unpinned “latest”, random binaries from chat/SEO pages, or packages whose source you cannot see;
- run untrusted tools in a disposable container/VM, without secrets or network if possible;
- global/system installs (`sudo`, `apt`, `dnf`, `brew`, global npm/pip) need explicit user approval;
- record the exact version/commit and install command in the brief or lockfile.
Workers do not install. If a worker needs a tool, it returns `blocked` with the exact command and
source; the lead verifies and installs it once.
## Record the result
Write `.swarm/prerequisites.md` and set `state.json.prerequisites` to `passed`, `needs_user`, or