apw-research — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited apw-research (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when asked to research, investigate, evaluate options, or understand a problem space before committing to an implementation. It is the upstream companion to apw-implement: research produces a durable artifact that an implementation can then build on. Follow the steps below strictly and in order.
Before consulting any source, write down what the research must actually answer:
Present this framing to the user and confirm it before going further.
If anything about the framing is genuinely ambiguous, ask up to 5 targeted questions that would change how the research is conducted. Skip if the framing is already clear — do not ask for the sake of asking.
In this same round, assess parallelism: if the sub-questions are independent and non-overlapping — different domains, sources, or codebase areas that can be investigated without one depending on another — tell the user this research could be split across several parallel agents, and ask whether they want to spawn them.
Explore for codebase sweeps, general-purpose for open-ended investigation). Give each agent its sub-question, the sources to consult, and instruct it to report findings with references (file paths, line numbers, URLs). Synthesize their results yourself in Step 6.List, before spending time:
Present the plan and ask: "Ready to proceed?"
Wait for the user to confirm or correct the plan before gathering evidence. This gate exists to avoid burning a session down a rabbit hole.
Work the plan one sub-question at a time. For every finding, capture three things:
verified, likely, or unconfirmed.Track which sub-questions are answered and which are still open. Prefer primary sources (the actual code, the official spec) over secondary ones (blog posts, recollection).
Do not let an important claim rest on a single source or on memory:
The goal is the root cause / ground truth, not a plausible-sounding answer.
If the evidence contradicts the framing — the core question was wrong, an assumed constraint does not exist, or the scope is larger than agreed — stop and tell the user. Re-frame with them rather than quietly answering a different question than the one they asked.
apw-work-with-work-item-artifacts for where work-item artifacts live — using .claude/skills/apw-research/RESEARCH_TEMPLATE.md as the structure. The artifact must include the references collected in Step 4 so any reader can verify every claim without redoing the work. This file is what apw-implement Step 1 consumes.When done, report:
Be honest. Do not present a confident answer where the evidence is thin.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.