discover — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited discover (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Search Aicoo Square and surface the most relevant people — either by inferring what the user cares about (auto) or from an explicit description (manual). Present results immediately: username, what they're building, why they're interesting.
Design goal: Minimize time-to-first-aha. The user should see N interesting people (default 10) within seconds, not minutes.
| Param | Default | Meaning |
|---|---|---|
N | 10 | Number of people to return. Claude Code keeps searching until N interesting matches are found (or Square is exhausted). |
User can override: "discover 5 people", "find me 20 builders", etc.
Claude Code infers search intent from available context:
Then fires 2-3 searches to cover different angles and presents a curated list.
Example triggers:
User provides a description. Claude Code extracts 2-3 key terms and searches.
Example triggers:
Regardless of mode, Claude Code does the work and presents results. Never ask the user to refine a query before showing results.
# Primary search
curl -s "https://www.aicoo.io/api/square?q=<TERMS>&limit=10&sort=most_asked" | jq .
# Broaden if sparse (try different angle)
curl -s "https://www.aicoo.io/api/square?subsquare=builders&sort=most_asked&limit=10" | jq .Query params:
| Param | Use |
|---|---|
q | Free-text (matches title, content, username, name, tags) |
subsquare | builders, hiring, events, general, projects, feedback |
tag | Exact tag match |
sort | recent, most_liked, most_asked |
limit | Max results (up to 50) |
Auto mode search strategy:
Manual mode search strategy:
q + optional subsquare/tag filtersFormat as a clean list — username + what makes them interesting:
Found some people you might vibe with:
1. @kai.dev — Building real-time collab tools in Rust + WebRTC. 12 likes, 5 asks.
"Senior eng, 5 years in distributed systems, open to hackathons"
2. @marina_rs — Rust systems engineer shipping open-source infra. 8 likes.
"Working on a new actor framework, looking for contributors"
3. @zack.builds — Full-stack dev tools, just shipped a TS CLI for API testing.
"Built similar stuff to what you're working on — might be a good collab"
Want to talk to any of their agents? Or connect directly?What to include per person:
@username (bolded or prominent)[open] = can talk to their agent directly, [closed] = must send requestReachability field in API response:
reachability: "open" + agentLinkToken present → user can be reached directly (talk to agent / instant connect)reachability: "closed" + agentLinkToken: null → username visible but must send a friend request to connectAfter presenting, offer these paths (don't block on them — user can just proceed):
| Action | Open posts | Closed posts |
|---|---|---|
| "talk to @kai.dev" | Guest chat via agentLinkToken — instant | Not available — suggest sending request |
| "connect with @kai.dev" | Instant connect via share token | Send friend request by username |
| "tell me more about @marina_rs" | Fetch full post content | Fetch full post content |
| "connect with all" | Batch connect via tokens | Batch send requests |
#### For open posts (reachability = "open")
Talk to agent (fastest aha moment):
curl -s -X POST "https://www.aicoo.io/api/chat/guest-v04" \
-H "Content-Type: application/json" \
-d '{
"token": "<agentLinkToken>",
"message": "Hey! What are you currently building?",
"stream": false
}' | jq .Instant connect (add to contact book):
curl -s -X POST "https://www.aicoo.io/api/v1/network/connect" \
-H "Authorization: Bearer $PULSE_API_KEY" \
-H "Content-Type: application/json" \
-d '{"shareToken": "<agentLinkToken>"}' | jq .#### For closed posts (reachability = "closed")
Only option is sending a friend request by username:
curl -s -X POST "https://www.aicoo.io/api/v1/network/request" \
-H "Authorization: Bearer $PULSE_API_KEY" \
-H "Content-Type: application/json" \
-d '{"to": "<username>"}' | jq .After they accept, you can then message them.
When inferring what to search for, consider (in priority order):
builders; if job hunting, hiringCombine signals into 2-3 diverse searches. Don't over-optimize for one angle — surprise is part of discovery.
User: "discover people"
(No prior context about user)
→ Browse most active: GET /api/square?sort=most_asked&limit=10
→ Present top engaged profiles
→ User talks to one agent → aha momentUser: "who should I connect with?"
(User is building a TypeScript agent framework, interested in ML)
→ Search 1: GET /api/square?q=typescript+agents&sort=most_asked
→ Search 2: GET /api/square?q=machine+learning&subsquare=builders
→ Search 3: GET /api/square?tag=open-source&sort=most_liked
→ Deduplicate, rank by overlap with user's profile
→ Present with "why you'd like them" annotationsUser: "find me a frontend dev for a hackathon this weekend"
→ Search: GET /api/square?q=frontend+hackathon&subsquare=events
→ Broaden: GET /api/square?q=frontend&subsquare=builders&sort=most_asked
→ Present matchesUser: "who knows about Cloudflare Workers?"
→ Search: GET /api/square?q=cloudflare+workers&sort=most_asked
→ Present matches
→ Offer to talk to their agent for deeper vetting| Scenario | Action |
|---|---|
| No results | Broaden search, try different subsquare, suggest user rephrase |
No agentLinkToken on post | Offer friend request instead of instant talk/connect |
| Already connected | Tell user, suggest messaging them directly |
| API error | Retry once, then report gracefully |
guest-v04 is sandboxed — no connection requiredPULSE_API_KEY / AICOO_API_KEY~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.