business-operations-skills — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited business-operations-skills (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The BizOps surface is internal: how the company actually runs. This orchestrator forks its conversation context, routes your inquiry to one of six sub-skills, then returns a tight digest to the parent thread. The heavy ingestion (vendor catalogs, process interviews, multi-doc SOP intake) stays in the forked context.
| Symptom | Sub-skill to route to |
|---|---|
| "Where does the work spend most of its time waiting?" | process-mapper |
| "Is this vendor delivering against the SLA?" | vendor-management |
| "Do we have enough people to ship in Q3?" | capacity-planner |
| "I need to brief the company on a re-org" | internal-comms |
| "Write me a runbook for the incident response process" | knowledge-ops |
| "Why is our software spend up 40% YoY?" | procurement-optimizer |
The orchestrator classifies the inquiry by signals detected in the prompt. Two-signal threshold for confident routing; one-signal triggers a clarifying question.
| Signal class | Keywords | Sub-skill |
|---|---|---|
| PROCESS | bottleneck, cycle time, waiting, handoff, BPMN, process map, workflow | process-mapper |
| VENDOR | vendor, supplier, SLA, contract, third-party, MSA, SaaS subscription, renewal | vendor-management |
| CAPACITY | headcount, capacity, utilization, planning, hiring sequence, FTE | capacity-planner |
| COMMS | all-hands, internal newsletter, announcement, change management, FAQ, town hall | internal-comms |
| KNOWLEDGE | SOP, runbook, knowledge base, wiki, playbook, documentation, onboarding doc | knowledge-ops |
| PROCUREMENT | spend, procurement, purchase, supplier rationalization, software audit, SaaS sprawl | procurement-optimizer |
If signals are mixed (e.g., "vendor SLA + spend audit"), run the highest-confidence sub-skill first, then chain into the second one in a follow-up forked turn.
If no signal class scores ≥ 2, ask one clarifying question naming the two most likely candidates. Do NOT guess silently.
Derived from Matt Pocock's grill-with-docs pattern: explore-then-ask, one question per turn with a recommended answer, walk the decision tree depth-first, track dependencies, anchor every challenge in the documented canon (references/).
Before any clarifying question, check:
vendor-management, no question needed)?procurement-Q3.csv → procurement)?If the codebase resolves the lane, route silently. Don't ask.
Matt's rule: never bundle questions. Never default to "what do you think?". Always offer your recommendation.
Pattern:
Q1/1: [precise question naming the two candidate lanes]
Recommended: [Lane X, because <one-sentence rationale from the signal table>]
(Confirm, or override?)Wait for the user's response. Then route. Never guess silently after a turn that asked a question.
If the user's inquiry legitimately crosses two lanes (e.g., "vendor SLA + spend audit" = VENDOR + PROCUREMENT), walk the tree depth-first:
Do NOT chain silently. Each fork is an explicit user-confirmed step.
Each sub-skill is invoked with the original prompt + a digest of any structured inputs (file paths, JSON inputs). The fork keeps heavy ingestion (vendor catalog, process transcripts, SOP source documents) out of the parent context.
When the sub-skill completes, return a ≤ 200-word digest to the parent thread:
The parent agent can then ask follow-ups (each triggering new forked invocations).
When the user has provided enough context to enter a lane, the orchestrator may grill them on the decisions inside that lane before invoking the sub-skill. One question per turn, each with a recommended answer + canon citation. Examples:
Never run a sub-skill until the lane-defining decision is locked.
process-mapper is business process reliability, not system reliability.knowledge-ops is company-wide SOP authoring.Every sub-skill produces at least one artifact (markdown, CSV, or JSON) saved to the user's working directory. The orchestrator surfaces the file path in the digest.
c-level-advisor/coo-advisor for strategic COO framingdocumentation/implementation/bizops-commercial-expansion-plan.md~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.