octocode-engineer — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited octocode-engineer (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill to understand, review, or change code without guessing. The skill itself is the router; detailed playbooks live in references/. First identify the scenario, then read the smallest set of references that covers the evidence you need. Some tasks require several references — combine them deliberately instead of over-reading.
Default to the Octocode CLI quick commands (ls, find, grep, cat, lsp, pr, history, repo, pkg, binary, unzip, clone, cache fetch) because they are easy to validate with --help, support --json/--compact, and dogfood the same runners agents use through MCP. If octocode is not installed or not on PATH, run the CLI with npx octocode <command>; do not fall back to native search just because the global binary is missing. Use raw octocode tools <name> --scheme → octocode tools <name> --queries '<json>' when a quick command cannot express an exact field, pagination lane, content selector, or OQL gap. Use MCP tool calls only when the host provides them and the CLI is unavailable or the task explicitly needs MCP transport.
Hard rules:
--json whenever another step depends on returned paths, refs, line numbers, diagnostics, or pagination.octocode tools <name> --scheme before every raw-tool call. Quick-command flags and raw-tool fields are not the same API.octocode search --scheme / octocode search --explain before relying on OQL routing for partial targets.octocode search target:"research" as a broad candidate pass, then prove destructive edits with LSP references, AST import search, exact reads.cat --match-string --mode none, line ranges, selected PR patches, AST structural matches, LSP output, binary metadata, or tests.next.*, pagination, char offsets, match pages, file pages, comment pages, and commit pages. Do not invent offsets or local paths.git status, git diff, branch/log inspection, and repo maintenance around Octocode itself; use Octocode CLI/MCP for code research.Decision-quality rules:
Start with the primary reference, then add companions only when the scenario needs them.
| Task / question | Read |
|---|---|
Local code research, implementation tracing, symbol lookup, AST/LSP, matchString, minify, pagination | references/research_local.md |
Archives, compressed files, .node/.wasm/native binaries, unzip/unpack then inspect | references/research_binary.md |
| GitHub/npm research, cross-repo comparison, package source lookup, PR/commit history, clone handoff | references/research_external.md |
CLI command names, flags, raw tools, and MCP fallback map | references/context_cli_mcp_commands.md |
| AST pattern examples and structural-search gotchas | references/context_ast_pattern_cookbook.md |
External metrics/checkers (dep-cruiser, knip, type-coverage, eslint, ruff, mypy) | references/context_external_measurement_tools.md |
| General engineering research recipes: orientation, blast radius, dead export, refactor, review | references/workflow_engineering_research.md |
| PR review, local diff review, staged changes, safe-to-merge, history review | references/workflow_pr_local_review.md |
| Large PR / large local diff parallel review | references/workflow_review_parallel_strategy.md |
| Validate or dismiss a finding | references/workflow_validation_playbooks.md |
| Quality and review domain checklists | references/checklist_quality_signals.md, references/checklist_review_domains.md |
| Final artifact/report shape | references/template_artifact_report.md, references/template_review_report.md |
| Scenario | Reference set |
|---|---|
| Trace local behavior or implement a local change | research_local.md + workflow_engineering_research.md; add template_artifact_report.md for non-trivial output |
| Review local/staged changes | workflow_pr_local_review.md + research_local.md + checklist_review_domains.md + template_review_report.md |
| Review a remote PR | workflow_pr_local_review.md + research_external.md + checklist_review_domains.md + template_review_report.md; add research_local.md after clone |
| Compare external libraries/repos | research_external.md; add research_local.md after clone and context_ast_pattern_cookbook.md if comparing code shapes |
| Inspect archive/binary package contents | research_binary.md; after unpack, continue with research_local.md |
| Architecture/refactor risk | workflow_engineering_research.md + research_local.md + checklist_quality_signals.md; add context_external_measurement_tools.md only when a metric/graph number matters |
| Dead-code/package-drift audit | workflow_engineering_research.md + research_local.md; add context_external_measurement_tools.md for knip confirmation |
| Suspicious quality/security finding | checklist_quality_signals.md + workflow_validation_playbooks.md; add context_ast_pattern_cookbook.md for AST proof |
| Need exact syntax for any command/tool | context_cli_mcp_commands.md plus the workflow/reference for the task |
research_local.md.research_external.md; clone and switch to local when analysis spans several files or needs AST/LSP.research_binary.md; unpack before local code research.workflow_pr_local_review.md and add review checklist/template.workflow_engineering_research.md, then add the relevant research reference.context_cli_mcp_commands.md.matchString, line ranges, AST, LSP, or history before citing.confirmed, likely, or uncertain.| Need | Evidence path |
|---|---|
| Unknown tree | octocode ls → octocode find |
| Unknown file | octocode cat --mode symbols |
| Exact quote/line | octocode cat --match-string ... --mode none |
| Code shape | octocode grep <path> --pattern/--rule or raw localSearchCode(mode:"structural") |
| Definition/usages/call flow | octocode lsp or raw lspGetSemantics with a real lineHint |
| Dead-code/package drift | octocode search --query '{"target":"research",...}' --json, then LSP/AST/knip proof |
| Remote proof | octocode cat <owner/repo/path> --match-string ... --mode none; clone/cache for AST/LSP |
| Why it changed | octocode history → octocode pr selected content |
| Metric/cycle/coverage number | external tool reference, then ask before running |
For quick tasks: answer with the finding, evidence, and next step.
For non-trivial work: use template_artifact_report.md and include only relevant sections: summary, flows, data/contracts, boundaries, quality findings, execution risks, confidence, and next step.
For reviews: use template_review_report.md, cap findings to the few that matter, dedupe existing PR comments, and include concrete fixes.
Ask before continuing when a task would change a public contract, cross layers/packages, delete/rename shared things, affect many consumers, require an architectural tradeoff, or when evidence conflicts.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.