basho-outreach — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited basho-outreach (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Build: basho-outreach · 2026-09-26 · skill-text
One hand-crafted first-touch email to one specific person. It trades volume for hit rate: the recipient can tell from the first sentence that it was written to them and not to a list.
It is not a sequence, a follow-up, or a nudge. If that is what is wanted, say so and stop — basho is the wrong tool for it.
This skill runs standalone or inside someone's own repo, so it is explicit about which half is which:
the failure modes. These are properties of the method, they are the same for every sender, and the skill must work with nothing but this file.
appear, house voice rules — never hard-code any of it into this file. It is read at run time from the operator profile below. A skill that remembers an employer, a client name or a metric will still be repeating it a year after it stopped being true, in a first email, to someone who can check.
In this order, and stop at the first that exists:
its own files, read those. Repos that do this usually route them from a CLAUDE.md or equivalent at the root — read that routing and follow it rather than guessing filenames. Typical routing: who the operator is, what figures and claims are cleared, what is barred, and the voice files anything human-facing is written from.
are answered.
Precedence: repo canon beats CONFIG beats anything remembered. If this skill appears to disagree with the operator's canon, canon wins and the skill is stale — say so in the output.
What the profile has to supply: the sender's name, role and firm · what the firm does, in the sender's own words · who they typically write to · the proof points and figures they may cite, and any that are barred · which names — clients, employers, references — may appear, and which may not · voice preferences, including spelling convention and words to avoid · any house rules.
Failure mode — stop, don't improvise. If the profile cannot be read and the user cannot be asked, stop and say so. Never draft a credibility paragraph from memory or inference. A first email is the one artefact where being wrong is unrecoverable: it goes to a named stranger who can check, over the sender's name, and it cannot be retracted. No profile, no draft.
Default to anonymising other people's business. A client, customer or engagement is described by shape — a Series-B payments company, a Tier-1 bank's market-data function — not by name.
The sender's own employers, roles and record are the carve-out: those are their positioning proof and they are nameable, subject to whatever the profile clears.
A third party's name goes in only where the profile explicitly says it may. Silence is not permission — if the profile does not clear a name, it is not cleared. Say so, and use the shape instead. Where the profile bars a figure or a claim, it is barred here too; this skill never carries its own list of what is safe to say.
Before drafting, you need: the recipient's first name, firm and role; one specific, verifiable thing they have done, said, published or run; the sender's relevance angle — why this sender, to this person, now; and a concrete slot for the ask, with day, time and timezone.
If any of these is missing, ask. Do not invent specifics and do not guess at the recipient's focus. Filler is the failure mode: the user would rather answer three questions than receive a draft with [specific post about X] in it.
If the user says "just draft something", hold the line: if a variable cannot be filled, the recipient is not ready to be contacted yet.
Subject. Mirror something the recipient has publicly said or done. Not a pitch, not a teaser. If nothing specific enough exists for the subject line, that is the research gate failing, not a licence to generalise.
Paragraph 1 — the hook. One specific, verifiable thing, named precisely. A post, a placement, a panel, a deal, a number they quoted. Never your impressive work or your thought leadership. The test: if it could be true of anyone else in their role, it is not specific enough.
Paragraph 2 — credibility and why-now. Two jobs. Establish that the sender is worth the recipient's time — role, the kind of firm they serve, and proof cleared by the profile, named within the rules above. Then say why now, with a real reason rather than I'd love to connect.
Paragraph 3 — the ask. One CTA, low commitment, with a specific slot proposed. Twenty minutes Thursday at 3pm, or would early next week suit? beats let me know when works. A second ask halves the first one — if there are two, cut one.
Close with the sender's first name. No signature block, no disclaimer, no postscript.
Length: roughly 120–160 words. Longer means padding; much shorter means the credibility work was skipped. This is a framework parameter, not an operator preference — but if the profile sets its own, the profile wins.
their placements or their read of the market; the why-now is worth being explicit about — keeping a small group of trusted recruiters close, whether or not the sender is actively looking. Never ask about a specific vacancy in a first email.
— a regulatory change, a named peer they would recognise, an earnings-call remark, a hiring pattern, an acquisition. Their firm's public signals, not the sender's product.
a shared audience or a shared problem, and the ask is a conversation between peers, not a pitch. Being useful before being interesting is the whole play.
Where the operator profile sets a rule, it wins. Absent one:
unlock value, drive growth, game-changing, revolutionary.
possible place to be caught overstating.
[firm] would love to…*
Run the operator's voice check before handing the draft over. If the repo's canon names a pre-delivery voice check, such as a script or a checklist, run it on the draft in the register it names for writing sent as the operator. Fix what it fails, and say in the output that it ran. If no check is named, skip this step.
**Subject:** <subject line>
<paragraph 1 — hook>
<paragraph 2 — credibility + why-now>
<paragraph 3 — one ask, with a specific slot>
Best,
<sender's first name>Then two blocks beneath it, always:
cited and where the profile cleared them, the slot proposed. This is what lets the sender check the research before sending.
there are none, say so rather than dropping the block.
Draft only. This skill does not send, schedule or queue anything. Where the operator's canon gates outbound messages to a person, that gate applies here: show the exact text and wait.
the whole test; if it fails, the draft is not finished.
which check it failed.
Current as of: 26 Sep 2026. History: git.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.