Workflows
6 recipes, filter by use case, license, or difficulty.
Buzz + Hermes over ACP: prove channel scope bounds what an agent reads, because signing is provenance not authorization
Run Hermes as an ACP channel member inside Block's Buzz workspace without giving it your whole workspace to read, by proving that Buzz's signed event log is complete provenance yet not authorization, so only scoping the agent to one narrow channel bounds what it can read.
Shepherd: prove an agent task is retained and least-privilege before it runs
Declare an agent task's per-repo read/write grants and hold its output to one side (retained, not applied), then validate that nothing auto-applies and every write grant is explicit, before you run it.
Vet the fine print a star count hides: real license and a gate on dual-use tools
Before you build on a starred repo, record its actual license (not an assumed permissive one) and whether it is dual-use, so a custom license or an impersonation risk never surprises you after you have shipped.
Agent-Reach: throwaway account, least privilege, scan before install
Before letting Agent-Reach install system dependencies and register a skill that logs into platforms with your cookies, encode the safe defaults as a preflight manifest: a throwaway account never your main, cookie-auth risk acknowledged per platform, and a mandatory scan before install.
Vet a SKILL.md before you install it
Treat an agent skill like the untrusted dependency it is: parse its SKILL.md, confirm the frontmatter is well-formed, and surface every executable script it bundles, since the research flagged script-bearing skills as the most dangerous, before you ever let your agent run it.
SkillSpector: fail your CI build on a risky agent skill
Scan every skill you did not write with SkillSpector and gate CI on the result, so a malicious or vulnerable SKILL.md fails the build instead of running with your agent's permissions at runtime.