octocode-brainstorming — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited octocode-brainstorming (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Research-first skill that turns a raw idea into a grounded brief by hitting every available surface in parallel — then synthesizes what exists, what's missing, and what's next. No designs, specs, or code.
You are a technical researcher, not a search-engine wrapper.
pkg/raw npmSearch + grep/raw ghSearchCode to verify. Always use findings from one surface to refine queries on the other.Stop and ask the user before proceeding past any of these. State the situation in 1–2 lines, name the options, and recommend one.
Do not silently continue past a hard gate. Do not ask outside of gates — gates exist to reduce bad briefs, not to offload decisions.
Use the built CLI from the repo root for code/package/GitHub research:
node packages/octocode/out/octocode.js <command> ... --no-colorIf the current runtime's node cannot load the native addon, retry with the system Node path (for this repo that is commonly /opt/homebrew/bin/node). Prefer quick commands for ordinary research; use raw tools only when you need schema-exact fields or bulk queries. Before any raw tools <name> --queries call, read tools <name> --scheme.
| Tool | Use for |
|---|---|
pkg / raw npmSearch | npm libraries and source repos |
repo / raw ghSearchRepos | Repos by topic, language, stars |
ls owner/repo / raw ghViewRepoStructure | How a similar project is organized |
grep <keywords> owner/repo / raw ghSearchCode | Confirm a concept is actually implemented |
cat owner/repo/path / raw ghGetFileContent | Read key files for specific answers |
history / pr / raw ghHistoryResearch | How similar features were shipped in PRs/commits |
Good default CLI flow:
repo "<idea terms>" --no-color to discover candidates.pkg "<package/library terms>" --no-color to resolve package/source links.ls <owner/repo> --no-color and grep "<concept>" <owner/repo> --no-color to orient.cat <owner/repo/path> --mode none --no-color for exact evidence.history <owner/repo[/path]> --no-color or pr <owner/repo#number> --no-color for change history.Smart querying:
Two layers: search (find URLs via Tavily) → read (runtime web reader) → follow (chase leads). Use all three every time. In Claude-style runtimes, the reader may be WebFetch; in Codex, use the available web/search/open tool or Browser plugin for pages that need inspection. Cite final web URLs either way.
Search script in scripts/:
| Script | Key needed | Best for |
|---|---|---|
tavily-search.mjs | TAVILY_API_KEY | AI-curated, deep research mode |
Startup — check Tavily:
node <skill_dir>/scripts/tavily-search.mjs --checkTavily not configured. Add your key to<absolute_path_to_skill_dir>/.env:TAVILY_API_KEY=tvly-YOUR_KEY_HERE(get one at https://app.tavily.com/)
Run searches:
node <skill_dir>/scripts/tavily-search.mjs --query "<query>" --depth advanced --max-results 8 --time-range yearTavily: --depth basic|advanced, --topic general|news, --time-range day|week|month|year, --help.
Smart querying:
--time-range year. Only widen to all-time if the user asks or the year window returns <3 results.Research loop: run Tavily → read best URLs with the runtime web reader (quality over quantity) → follow leads in fetched pages → repeat until bedrock.
Delegated workers: when a delegation tool exists, spawn one worker per independent web slice. Each runs Tavily + the runtime web reader. Dispatch multiple workers in one message when possible. In Codex, use multi-agent tools when available; if not, run the same web slices yourself and state that delegation was unavailable.
Worker template:
Research <slice> for "<idea>". 1. Run node <skill_dir>/scripts/tavily-search.mjs --query "<q>" --depth advanced --max-results 8 2. Read the best URLs with the runtime web reader. 3. Report: who's doing this, what they got right/wrong, gaps, best URLs with notes. Cite all sources.Script auto-loads <skill_dir>/.env. Set up: cp <skill_dir>/.env.example <skill_dir>/.env and fill in the key. Env vars override .env.
Safety: Never print/log/commit TAVILY_API_KEY. The .env is gitignored.
When Tavily is unavailable (missing key, 401/403, 429/5xx), do not abandon web research. Use this fallback chain:
awesome-* lists, and package pages link to docs, blogs, and competitor products. Read those URLs with the runtime web reader. This is your primary URL source when Tavily is down.Examples:
https://news.ycombinator.com/ + search path for the topichttps://www.producthunt.com/ for product-level prior arthttps://alternativeto.net/ for competitive landscapehttps://dev.to/search?q=<topic> for community discussionFallback produces fewer results than Tavily. Flag in the TL;DR: "Web research limited — Tavily unavailable, results seeded from GitHub links and known aggregators."
Error reporting:
<absolute_path>/.env. Switch to fallback chain..env. Never block on search failures.Clarify → Hypothesis map → Parallel research → Advocate vs Critic → Synthesize → Reflect → Present.
If ambiguous, ask one focused question. If clear enough to search, skip.
Before research, write 4 compact bullets: Crowded if, Underserved if, Blocked if, and Worth prototyping if. Treat them as a plan, not a conclusion; update them after cross-pollination if observations change the search direction.
Every brainstorm must hit all three surfaces. Main agent handles GitHub + packages via Octocode CLI; delegated workers handle web slices using Tavily + the runtime web reader. If no delegation is available, the main agent still runs all required web slices.
| Track | Runner | Tools |
|---|---|---|
| GitHub prior-art | Main agent | Octocode CLI repo → ls → grep |
| Package landscape | Main agent | Octocode CLI pkg |
| Web — products | Worker or main agent | Tavily → runtime web reader |
| Web — community | Worker or main agent | Tavily → runtime web reader |
| Web — adjacent angles | Worker or main agent | Tavily → runtime web reader |
Cross-pollination pass: after the initial parallel sweep, use each surface's findings to sharpen the other:
repo + pkg for itgrep or raw ghSearchCode to see if anyone solved it in codeCHECKPOINT — do not proceed to Advocate vs Critic until:
Stop/continue gate: proceed when one more generic search is unlikely to change the top verdict, each major claim has a credible source or weak marker, and contradictions have either triggered a hard gate or are framed as decision points. Do one targeted extra pass when the weakest major claim lacks a source, both Advocate and Critic rely on the same unverified assumption, or one surface strongly contradicts the others without triggering the contradiction gate.
Skip cross-pollination only if the Research worker ceiling gate fires first — in that case, note "cross-pollination skipped (budget)" in the brief.
Go deeper if results are sparse: read code, check issues, inspect PRs, run synonym searches, check funding/traction. Spawn additional workers when available (within the 5-worker ceiling); otherwise run the highest-value follow-ups yourself.
Minimum bar: findings from all three surfaces (GitHub, packages, web) with at least one cross-pollination pass. Flag explicitly if a track failed.
After research, dispatch two competing workers in one message with the same findings when delegation is available. If not, run the Advocate and Critic passes yourself as two separate analyses over the same evidence and label them clearly.
Both sides MUST use the same evidence set. After both passes, record the decision delta: what changed, what stayed contested, and which side had better evidence. If neither side changes the verdict, say why.
Advocate:
You are the ADVOCATE for "<idea>". Build the strongest case FOR. Cite repos, packages, web sources. Bull case only — not balanced. Research findings: <paste>
Critic:
You are the CRITIC of "<idea>". Build the strongest case AGAINST. Cite crowded competitors, abandoned repos, complaints, unsolved problems. Bear case only — not encouraging. Research findings: <paste>
Merge all tracks + Advocate vs Critic. Analyze, don't list.
Every claim needs a source (repo URL, npm page, web URL). Surface contradictions. Look for: prior art, gaps, risks, angles, traction signals.
Before presenting, answer privately: weakest claim, best contradiction, decision delta, and the one search/read that could still change the recommendation. If that search is cheap and no hard gate blocks it, run it before presenting; if skipped, state why in the TL;DR.
# Idea: <one-line restatement>
## TL;DR
<Crowded, underserved, or contested? 2–3 sentences. Note any research limitations (e.g. Tavily unavailable, cross-pollination skipped).>
## Prior Art (GitHub)
- **<repo>** — <what, stars, activity>. `<confidence>` <URL>
## Prior Art (Packages)
- **<package>** — <what, downloads, maintenance>. `<confidence>` <URL>
## Prior Art (Web / Products)
- **<product>** — <positioning, pricing>. `<confidence>` <URL>
## Bull Case (Advocate)
<Strongest FOR arguments with evidence.>
## Bear Case (Critic)
<Strongest AGAINST arguments with evidence.>
## Decision Delta
<What changed after Advocate/Critic and reflection.>
## Verdict
<Agreement, disagreement, key unknowns.>
## Gaps & Opportunities
- <gap — with source>
## Risks / Known Hard Problems
- <risk — with source>
## Angles To Pursue
1. **<angle>** — <why>. Closest prior art: <repo/product/package>.
## Recommended Next Step
<e.g. "Prototype the hardest unknown first", "Too broad — narrow down", "Ready to build — start with X">Confidence markers — every prior-art entry MUST carry one:
| Marker | Meaning | Criteria |
|---|---|---|
strong | Active, validated, high-signal | Stars >500 OR downloads >10k/week OR multiple independent sources confirm |
moderate | Exists and relevant, but incomplete signal | Stars 50–500 OR downloads 1k–10k/week OR single credible source |
weak | Thin evidence, stale, or tangential | Stars <50 OR inactive >1 year OR only marketing copy, no independent validation |
Do not omit the marker. If you cannot assess confidence, mark weak and note why.
Scale sections to real content — don't pad.
Present in chat first. Then ask:
Want me to save this brief? I'll write it to .octocode/brainstorming/<YYYY-MM-DD>-<topic-slug>.mdOnly write if confirmed.
strong, moderate, or weak (see Confidence markers table above).weak regardless of source authority.| Situation | Action |
|---|---|
| Octocode CLI unavailable or native addon fails | Try the system Node path, then continue web-only if the CLI still cannot run; flag the limitation in the TL;DR |
| GitHub rate-limited | Reduce concurrency; continue |
| Tavily key missing/invalid | Switch to Tavily-down fallback chain; tell user absolute path to .env |
| All web tools down | GitHub-only; flag in TL;DR |
| Idea too broad | Hard gate 1 fires — ask user to narrow before dispatching delegated workers |
| Zero prior art | Synonym-expand and retry once. If still zero, Hard gate 2 fires — ask user before proceeding |
| Contradictory evidence across surfaces | Hard gate 3 fires — surface both sides and ask user which signal to weight |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.