hivemind-goals-be58e0 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited hivemind-goals-be58e0 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Track goals and KPIs as Markdown files inside the Deeplake virtual filesystem. Each file is one row in a dedicated team-shared table — the path encodes the structural metadata, the file body holds the human-readable description.
Activate when the user expresses any of:
hivemind tasks CLI — there is no separate task store)For "list my goals" → run ls ~/.deeplake/memory/goal/<userName>/opened/ and ls ~/.deeplake/memory/goal/<userName>/in_progress/. If empty, ask the user if they want to create one.
~/.deeplake/memory/goal/<owner>/<status>/<goal_id>.md
~/.deeplake/memory/kpi/<goal_id>/<kpi_id>.md<owner> — user identifier (use the userName from hivemind whoami or the credentials)<status> — one of opened, in_progress, closed<goal_id> — UUIDv4 you generate at create time<kpi_id> — short slug like k-prs or k-demosPath encoding is the source of truth. The owner, status, goal_id, and kpi_id come from the path — NOT from the file body. Do NOT write owner/status/goal_id/kpi_id inside the file content.
Goal file body — plain markdown, free form:
ship the goals-graph feature
Notes: focus on KPI tracking via VFS, no separate CLI.
Due: 2026-05-30.KPI file body — markdown with a few mandatory key:value lines so the commit-driven auto-progress worker can parse and bump:
PRs merged
- target: 5
- current: 2
- unit: countThe target:, current:, unit: lines must stay on a single line each. The first line is the human-readable name. Anything else is free notes.
When the user expresses a new goal:
hivemind whoami (use the userName, e.g. emanuele.fenocchi).uuidgen (do NOT use node -e — Node is not available under the VFS path). cat > ~/.deeplake/memory/goal/<owner>/opened/<uuid>.md <<'EOF'
<goal description here, multiple lines OK>
EOFFor a single-line goal, echo '<text>' > ~/.deeplake/memory/goal/<owner>/opened/<uuid>.md is equivalent.
Do NOT auto-generate KPIs. A goal is created with zero KPI files by default. Generate KPIs ONLY when the user explicitly asks you to ("aggiungi KPI per …", "add metrics for this goal", "track these metrics: …"). When the user asks, write each KPI as a separate file at ~/.deeplake/memory/kpi/<goal_id>/<kpi-slug>.md with the body format documented above.
Use this when the user parks a tangential task mid-session — "save this for later", "remind me to …", "don't let me forget …", "let's do X later", "capture this in Hivemind". The value is NOT the one-liner — it's storing enough context to resume cold in a future session without the user re-explaining anything.
Write it via the CLI (not the VFS heredoc) so the row is tagged agent: capture, which separates parked side-tasks from hand-made goals:
hivemind goal add --agent capture "Add rate-limiting to the webhook handler
Start here: add a per-IP token bucket on the handler entry path
Files: src/webhook/handler.ts:120-160, src/webhook/limits.ts
Branch: feat/webhook-hardening
Run: pnpm test webhook
Why: bursty clients hammer the endpoint; agreed to defer until the retry-backoff work lands"goal list and the SessionStart banner show.Start here / Files / Branch / Run / Why from the live conversation — you already know the files you just touched and the branch. Include only the lines you can fill; omit the rest. `Start here:` is the most important — the concrete first action.When the user says "let's work on that task / that goal", "let's start the <X> task", or "pick up the parked <X>", pull its stored context back into the session and continue — the user should NOT have to re-explain anything.
hivemind goal list --mine and match the user's reference to a goal_id (by label / topic). If ambiguous, show the candidates and ask which one.hivemind goal get <goal_id> prints the full package (Start here / Files / Branch / Run / Why). Read it as your working context — goal list only shows the first line, so always use goal get for the full body.mv ~/.deeplake/memory/goal/<owner>/opened/<uuid>.md ~/.deeplake/memory/goal/<owner>/in_progress/<uuid>.mdFiles:, switch to the Branch: if given, and begin from Start here:. You are now resumed — continue as if the context was never lost. Close it (section 5) when the work is done.ls ~/.deeplake/memory/goal/<owner>/opened/
ls ~/.deeplake/memory/goal/<owner>/in_progress/Then cat each <uuid>.md to read the body. Optionally ls ~/.deeplake/memory/kpi/<uuid>/ and cat each KPI to surface progress.
# Read the existing body, then overwrite via Bash heredoc. Edit / Write
# tools are denied on memory paths in claude-code (the hook can only
# rewrite Bash). The VFS handles version-bumping — every overwrite
# produces a fresh row in the hivemind_goals table.
cat ~/.deeplake/memory/goal/<owner>/opened/<uuid>.md # read current
cat > ~/.deeplake/memory/goal/<owner>/opened/<uuid>.md <<'EOF'
<new body here>
EOFmv ~/.deeplake/memory/goal/<owner>/opened/<uuid>.md ~/.deeplake/memory/goal/<owner>/in_progress/<uuid>.mdmv between status folders is an atomic version-bump. The file body carries over unchanged.
Two equivalent ways:
# Explicit mv to closed (recommended — clearest intent)
mv ~/.deeplake/memory/goal/<owner>/in_progress/<uuid>.md ~/.deeplake/memory/goal/<owner>/closed/<uuid>.md
# Or: rm (the VFS interprets rm on a goal path as a soft-close)
rm ~/.deeplake/memory/goal/<owner>/opened/<uuid>.mdImportant: rm does NOT actually delete the goal. It is a soft-close — the VFS writes a new version with status=closed. The goal remains in the team-shared table for audit. There is no hard-delete in v1.
cat > ~/.deeplake/memory/kpi/<uuid>/<kpi-slug>.md <<'EOF'
<KPI name>
- target: <N>
- current: 0
- unit: <unit>
EOFRead the KPI file, increment the current: line, write it back via Bash. The Edit tool is denied on memory paths — overwrite the full file via heredoc:
cat ~/.deeplake/memory/kpi/<uuid>/<kpi-slug>.md # read current
cat > ~/.deeplake/memory/kpi/<uuid>/<kpi-slug>.md <<'EOF'
<KPI name>
- target: 5
- current: 3
- unit: count
EOFA surgical sed -i 's/^- current: .*/- current: 3/' also works since sed is an allowed builtin under the VFS path.
mv ~/.deeplake/memory/goal/<old-owner>/<status>/<uuid>.md ~/.deeplake/memory/goal/<new-owner>/<status>/<uuid>.mdGoal ownership lives in the path. KPI files do NOT have an owner segment — they are linked to the goal by <uuid>, so they need no change when a goal is reassigned.
owner, status, goal_id, or kpi_id inside the file body. The path is the source of truth — duplicating in the body causes drift.opened, in_progress, closed.mv. The VFS rejects goal_id renames.nohup … &).git commitA PostToolUse hook listens for git commit. When it fires, it spawns the agent's native LLM in the background with the commit diff + the list of the current user's open goals. The LLM reads each goal + its KPIs, judges whether the commit advanced any KPI, and edits the relevant KPI file to bump current:. This is fire-and-forget; the user does not block on it.
To disable globally: HIVEMIND_AUTO_KPI_FROM_COMMITS=false.
Every write goes to a team-shared table on Deeplake (hivemind_goals or hivemind_kpis). Other team members see your goals in their SessionStart context and via direct ls / cat on the same paths in their own VFS. No explicit sharing step needed.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.