conductorscore

Savant verdict: Review advised

Security analysis or source-hub review identified patterns requiring attention.

Live evaluation

Not evaluated yet. Workspaces can request a live evaluation.

Security assessment

Scan pending.

Structure

• Ships 59 executable scriptsscripts/__init__.py, scripts/_http.py, scripts/agents/__init__.py, scripts/agents/base.py, scripts/agents/claude/__init__.py, …. Review what they do before enabling the skill for agents with tool access.
• No license declaredConfirm you may reuse this skill before importing it into your repository.
• The source hub's security checks flagged this skillGen Agent Trust Hub: warn (This skill measures AI agent performance by scanning local transcripts and uploading derived metrics to an external scoring service. It includes a persistence mechanism that adds a startup hook to the agent's configuration and requires broad read access to potentially sensitive chat history.)

SKILL.md

---
name: conductorscore
description: Score your Claude Code skill — measure agent leverage, craft, and anti-patterns from your local transcripts. Use when the user types /conductorscore.
---

ConductorScore reads your local coding-agent transcripts and uploads only the
resulting numbers (your score) — never transcript text.

## How to run

When the user invokes this skill, say **"Calculating your ConductorScore"** and,
on the next line, the skill version the script reports (its first output line is
`Version X.Y.Z`) — e.g. show `Version 0.5.0` beneath the heading. Run the
orchestrator from **this skill's own directory** — the folder that contains this
SKILL.md, with `run.py` in its `scripts/` subdirectory. Don't assume a fixed
location: depending on the agent and installer the skill may live under
`~/.claude/skills/conductorscore/`, `~/.codex/skills/conductorscore/`,
`~/.cursor/skills/conductorscore/`, or `~/.agents/skills/conductorscore/`.
Use the `scripts/run.py` next to this file:

```
python3 <this-skill-dir>/scripts/run.py --step
```

On Windows, if `python3` isn't found, use `python` or `py -3` instead. Always
pass `--step` when running `run.py` for a scan, including the re-runs below.

The script drives the flow. Don't narrate the steps. Your jobs are: (a) run the
script, (b) relay its progress (below), (c) handle the `CONDUCTORSCORE_ASK`
lines below, and (d) when the scan finishes, render the **final report** from
the `CONDUCTORSCORE_RESULT` line (see "Final report").

## Progress relay rule

The scan runs in the background, and each `run.py --step` call returns after a
few seconds. If the output ends with `CONDUCTORSCORE_PROGRESS <percent> "<text>"`,
the scan is still running: write `<text>` to the user as its own short message
(just that text, e.g. `Scanning your transcripts… 42%`, nothing else), then
immediately run `run.py --step` again with no other flags. Keep going until the
output has no `CONDUCTORSCORE_PROGRESS` line. Don't sleep between calls; the
script already waits.

## ASK relay rule

If a printed line starts with `CONDUCTORSCORE_ASK <id> "<question>" [opt A] [opt B] …`,
the script has STOPPED and is asking the user to decide. Present `<question>` as a
multiple-choice using the bracketed options (use the question UI; don't add extra
prose), then re-run `run.py` with the matching flag:

- `login` → the script printed a GitHub URL + code. Show them, let the user
  authorize in their browser, and when they confirm ("I've authorized") re-run
  `run.py --step` with NO new flag — it resumes the login and continues. On
  Cancel, stop.
- `providers` → re-run `run.py --step` with `--providers=all` (All),
  `--providers=claude` (Claude Code), `--providers=codex` (Codex), or
  `--providers=cursor` (Cursor). On Cancel, stop.
- `update` → asked BEFORE any scanning, when a newer ConductorScore is
  published. Present EXACTLY the two printed choices, **Update now** and
  **Not now**. On **Not now**, re-run `run.py --step --skip-update` (it scans
  with this version). On **Update now**:
  1. Run the command from the `CONDUCTORSCORE_UPDATE_CMD <command>` line
     exactly. Its output may mention other copies ("no GitHub metadata") —
     ignore that; don't judge success from the output.
  2. Read the `VERSION` file in this skill's directory (next to this SKILL.md).
  3. If it now shows the new version, re-run `run.py --step` (the updated
     script now runs the scan).
  4. Otherwise this copy isn't managed by `gh skill`, so the update can't
     reach it. Tell the user to reinstall it once with
     `gh skill install https://github.com/flatironconsulting/conductorscore conductorscore --agent <claude-code|codex|cursor> --scope user --force`
     (the agent you're running in), then re-run `run.py --step --skip-update`
     so they still get a score now.
- `daily` → present EXACTLY two choices, **Yes** and **No** (no Cancel, no other
  options). Re-run with ONLY `--daily=yes` or `--daily=no` — do NOT add
  `--providers`; this enables/declines the once-per-day hook and does NOT re-scan.

## Final report

When the scan finishes the script prints a single line:
`CONDUCTORSCORE_RESULT {"score":N,"url":"...","sessions":N,"verified_github":bool}`.
Don't show that raw line. The `--daily=yes|no` re-run prints it again with a
`"daily":true|false` field. Render the final report from that line **in the same
reply as the daily re-run, before anything else**.
Never end the run without showing the user the report and its URL. Use exactly
this shape (keep the ✓ and 📊 and the bullets):

```
✓ ConductorScore: <score>

📊 View your full breakdown: <url>

- Scanned <sessions> sessions from your local transcripts
- <Daily auto-refresh enabled — your score updates once per day | Daily auto-refresh not enabled>
- Only your score (the numbers) was uploaded — never any transcript text
```

## Debug / visualize a session — `/conductorscore debug`

`/conductorscore debug` renders a session locally as a self-contained HTML
timeline plus the Interactive / Background leverage table and opens it in the browser. It runs entirely on
the user's machine and **uploads nothing — not even the numbers a scan sends.**
Use this path when the user types `/conductorscore debug …`, or asks to
**visualize / view / debug a session**, show its **timeline**, or see the
**leverage breakdown** (Interactive / Background, HITL/AFK/Tool/Idle).

The slash interface IS the `session_viewer.py` interface: take whatever the user
put after `debug` and pass it **straight through** to the Python CLI — every
flag below maps 1:1, so `/conductorscore debug <ARGS>` runs
`session_viewer.py <ARGS>`.

```
python3 <this-skill-dir>/scripts/session_viewer.py [ARGS]
```

(`session_viewer.py` sits next to `run.py` in this skill's `scripts/`, wherever
the skill is installed. On Windows use `python` or `py -3` if `python3` isn't
found.)

Supported arguments (the full Python CLI surface):

- **(no args)** → the session the user is in. The SessionStart hook records the
  current transcript, so a bare run visualizes the active session. To inspect an
  earlier one, the user navigates to it first with the built-in picker
  (`claude --resume` / `/resume`, or `codex resume`), then runs
  `/conductorscore debug` — don't reinvent that navigation.
- **`<path.jsonl>`** → render that explicit transcript.
- **`--list`** → print discoverable local sessions (index, date, id, project) and
  exit.
- **`--pick N`** → render the Nth session from `--list` (newest first).
- **`--no-redact`** → show the real transcript text. Default is **redacted**:
  bubbles show the wire-equivalent view (hashes + token counts, tool names only —
  no raw text), matching exactly what a scan would upload, so the page is safe to
  share. `--no-redact` is safe locally (nothing leaves the machine) and best for
  hands-on debugging.
- **`--out <path>`** → write the HTML somewhere other than
  `~/.cache/conductorscore/`.
- **`--no-open`** → render without launching the browser.

The script prints a **local-only debug summary** — the source transcript, the
redaction mode, message/turn/streak/leverage counts, and an explicit
"nothing is uploaded" assurance — then writes the HTML and opens it. **Relay the
script's console summary and its `Rendered … → <path>` line as-is; don't
re-narrate or restate the numbers.**

## Device-flow login

First run prints a `https://github.com/login/device` URL and a code, then STOPS
(it does not poll in the background). Show the URL and code to the user, let them
authorize in their browser, and once they confirm, re-run `run.py --step` — it resumes
the pending login, finishes authentication, and proceeds to the scan.

## Privacy & data handling

ConductorScore runs entirely on your machine. It reads your local coding-agent
transcripts to compute metrics, then uploads only:

- **Numbers** — counts, token totals, timing, and derived scores.
- **Names you already surface by using them** — the skills, slash-commands, MCP
  servers, plugins, and model IDs invoked in your sessions (these appear on your
  public profile). Just the names — no arguments, no contents.

It never uploads transcript or message text, prompts, code, file contents, or file
paths. Message and file text is reduced on-device to a truncated SHA-256 hash (used
only for dedup/similarity) before any metric is computed. The exact wire payload is
documented and inspectable in `WIRE_FORMAT.md` (`wire_format_sample.json` is a real
sample). Uploads happen only after you pair this device, only for the agents you
consent to scan, and never on an unpaired machine.