Is the Agent Comms skill free?

Yes. The skill itself is free from komluk/scaffolding. SkillProof publishes the install command and an independent test verdict at no cost.

What is the Agent Comms SkillProof Score?

8.8/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 8/10, docs & honesty 4/5.

How do I install Agent Comms?

Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.

Can I use Agent Comms with Cursor, Copilot, Gemini CLI, Codex or other AI tools?

The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.

Agent Comms

Two-stage recipient whitelist check + symlink-safe worktreePath validation for multi-agent SendMessage.

by komluk · komluk/scaffolding

Tested · Works

Install — copy the command Download source ↗

Test report

Verdict: Tested · Works
Score: 8.8/10
Tested: Jul 16, 2026
Environment: Claude Code 2.x (agent harness)
Upstream re-checked: Aug 10, 2026 · 84f7c86

Coded up both the naive baseline matcher and the skill's documented two-stage algorithm and ran them against the skill's own 7 test cases: naive substring/startswith matching let 'evil-developer' and 'developer-evil-extra' through (5/7 correct), the skill's exact-then-single-strip algorithm got all 7/7 right, exactly as claimed. Only ding: the worktreePath check's `realpath -e <path>` command as written errors out on macOS/BSD realpath (no -e flag, GNU-only) -- portable `realpath` (no flag) has to be substituted for the canonicalization to actually run.

Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works

Installs cleanly 5/5
Triggers reliably 5/5
Output vs. baseline 8/10
Docs & honesty 4/5

What Agent Comms does

A narrow, self-contained security reference for orchestration frameworks: validates a SendMessage `to:` recipient against an agent-name whitelist (exact match, then a single trailing-suffix strip) and validates a worktreePath from another agent (absolute, no `..`, not a symlink escaping repo root, registered in `git worktree list`) before acting on it. Triggers specifically on those two validation moments and explicitly defers routing topology, git ops, and worktree recovery to sibling skills.

How to install Agent Comms

git clone https://github.com/komluk/scaffolding.git
cd scaffolding
mkdir -p ~/.claude/skills
cp -r skills/agent-comms ~/.claude/skills/agent-comms

Skills live in ~/.claude/skills/ (global) or .claude/skills/ (per-project). Restart Claude Code after installing.

Commands — how to trigger Agent Comms

/agent-comms Two-stage recipient whitelist check + symlink-safe worktreePath validation for multi-agent SendMessage.

It also activates on plain-language prompts like these:

Check whether this SendMessage recipient name is actually whitelisted
Validate this worktreePath before another agent is allowed to act on it
Make sure 'developer-evil-extra' can't sneak past our agent name check

Frequently asked questions

Is the Agent Comms skill free?: Yes. The skill itself is free from komluk/scaffolding. SkillProof publishes the install command and an independent test verdict at no cost.
Does Agent Comms work with Claude Code?: We tested it with Claude Code 2.x (agent harness) on Jul 16, 2026. Verdict: Tested · Works. Coded up both the naive baseline matcher and the skill's documented two-stage algorithm and ran them against the skill's own 7 test cases: naive substring/startswith matching let 'evil-developer' and 'developer-evil-extra' through (5/7 correct), the skill's exact-then-single-strip algorithm got all 7/7 right, exactly as claimed. Only ding: the worktreePath check's `realpath -e <path>` command as written errors out on macOS/BSD realpath (no -e flag, GNU-only) -- portable `realpath` (no flag) has to be substituted for the canonicalization to actually run.
What is the Agent Comms SkillProof Score?: 8.8/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 8/10, docs & honesty 4/5.
How do I install Agent Comms?: Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
Can I use Agent Comms with Cursor, Copilot, Gemini CLI, Codex or other AI tools?: The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.