octocode-news — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited octocode-news (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Goal: Lock scope, sweep RSS + cataloged sources in parallel, research gaps, assemble a validated JSON report and an HTML report, then open the HTML in the default browser.
Use defaults silently when the user did not provide a value. Only ask if the request is genuinely ambiguous.
24h / 7d / 14d / 30d. Default: 7dbrief / deep / comprehensive. Default: deepreferences/sources.md as the baseline catalog, not a suggestion.summary based on full-page content (120+ chars)whyImportant (or legacy whyInteresting) explaining why the story matters nowreferences (at least one)contentEvidence.method = "full-page" with chars >= 200topItems are the hero stories — must not be duplicated inside sections[].items.sourcesChecked with status, found, and notes. Never silently drop a failed source.shortTitle, shortDescription) rather than replacing title or summary.shortTitle and shortDescription.meta.json exists, repo verification (step 5) is done, HTML exists, and browser open was attempted.{id}.json. The coordinator owns dedupe, topItem selection, meta.json, and final HTML build.~/tmp/{ts}-sections/{id}.json) following the SectionPayload schema and returns coverageSummary, dedupeHints, and blockedOrStale to the coordinator.meta.json, the validated JSON, or HTML files directly. Only the coordinator writes meta.json and runs build-report.Generate {ts} once as YYYYMMDD-HHmmss (e.g. 20260404-143000) and reuse it for every output file path. Use defaults when missing: domains=all, window=7d, depth=deep.
If dependencies are missing: run yarn install from the monorepo root (this resolves all workspaces including skills).
Run both scripts in parallel — they are independent and both read references/sources.md:
RSS fetch + health — candidate pool, volume by domain, and per-feed health status in one pass:
yarn --cwd skills/octocode-news fetch-rss \
--window {window} \
--include-health \
--json-out ~/tmp/{ts}-whats-new-rss.jsonSource catalog — full coverage checklist (websites, RSS, repos, custom resources per domain):
yarn --cwd skills/octocode-news catalog-sources \
--json-out ~/tmp/{ts}-whats-new-catalog.jsonAfter both finish, you have:
rss.json → summary shows volume by domain, items gives the candidate pool, and each feeds[] entry includes a health object (ok, reason, validFeed, freshness data) — broken/stale/empty feeds are flagged inlinecatalog.json → every website, RSS feed, repo, and custom resource to track in sourcesCheckedNote: check-rss still exists as a standalone script for targeted feed audits, but --include-health on fetch-rss covers the same ground in a single network pass.
Create the output directory first:
mkdir -p ~/tmp/{ts}-sections/Resume protocol: Before spawning subagents, check for existing section JSON files in ~/tmp/{ts}-sections/. If a valid {id}.json already exists (has items or is a quiet stub), skip that domain — it was completed by a previous run. This allows recovery from coordinator crashes without re-doing finished domains.
Domains: ai, devtools, web, security, repos, optional cross (when a story clearly spans sections).
Single-domain shortcut: When only one domain is selected, skip subagent overhead — run the research pass inline as the coordinator. Write the section JSON file directly and proceed to Step 4.
Quiet stubs for unrequested domains: When domains is not all, write a quiet stub for each unselected primary domain so the HTML report renders every section:
{ "id": "web", "name": "Web Platform", "icon": "W", "iconClass": "si-web", "quiet": true, "quietMsg": "Web platform was not in scope for this run.", "items": [], "sourcesChecked": [] }When multiple domains are selected, spawn one subagent per domain. Each subagent runs the same four-step pass:
sourcesChecked entries.Each subagent writes ~/tmp/{ts}-sections/{id}.json following the SectionPayload schema:
{
"id": "ai",
"name": "AI",
"icon": "A",
"iconClass": "si-ai",
"quiet": false,
"items": [ ... ],
"sourcesChecked": [ ... ]
}Required fields: id, name, icon, iconClass, quiet, items, sourcesChecked. Set quiet: true + quietMsg + empty items when a domain has no notable items.
Each items[] entry follows the Item schema (domain, type, title, summary, heat, references, contentEvidence, etc.). Each sourcesChecked[] entry follows the SourceCheck schema.
Each subagent also returns to the coordinator:
coverageSummary — what was covered, what was quiet, what needs follow-updedupeHints[] — URLs, repos, release pages, or products that may overlap another domainblockedOrStale[] — sources or candidate stories that need coordinator reviewThe coordinator waits for all selected subagents, then reads their JSON files for cross-domain dedup, topItem selection, and meta assembly.
Prefer Octocode for GitHub data, local scripts for catalog/RSS work, and direct web fetching for non-GitHub sources.
Blocked-page fallback: When a canonical URL cannot be fetched (challenge, paywall, timeout), use the RSS snippet + source metadata as contentEvidence.method = "rss-snippet" with chars set to actual snippet length. Log the reason in sourcesChecked. Do not silently drop the item — a well-sourced RSS summary with a clear whyImportant is better than nothing.
Source tiers at brief depth: When depth=brief, focus on P1 sources from sources.md only. Skip P2 sources unless P1 coverage is clearly thin (<3 items for a domain).
Subagent stopping condition: stop when the domain slice has met its depth floor or exhausted the cataloged sources for that domain, every checked/blocked/skipped source is logged, and the section JSON file is written.
Subagent context-limit recovery: If a subagent is approaching its context limit before finishing all sources, it must immediately write its section JSON with whatever items it has collected, mark remaining sources as status: "skipped" with notes: "context limit", and return to the coordinator. Partial coverage is acceptable — the coordinator can flag thin sections in the report tldr.
Coordinator stopping condition: stop only when every selected domain subagent has finished or explicitly reported blocked status, cross-domain duplicates are resolved, meta.json is written, section files are updated (topItems removed from sections), and the global depth floor is met (brief: 15+, deep: 30+, comprehensive: 50+).
When changing the local tooling:
src/yarn --cwd skills/octocode-news build:scriptsscripts/ as built output, not the authoring sourceAfter all subagents finish, the coordinator:
~/tmp/{ts}-sections/{id}.json written by subagents.cross only when they span more than one section. If cross has items, writes ~/tmp/{ts}-sections/cross.json.topItems from across all sections. Removes them from the section files they came from (hero items must not be duplicated inside sections).~/tmp/{ts}-sections/meta.json following the ReportMeta schema:{
"window": "Mar 28-Apr 3, 2026",
"windowLabel": "7d",
"generated": "2026-04-03",
"tldr": "High-signal developments across AI, developer tools, web platform, security, and repos.",
"topItems": [ ... ],
"sourcesChecked": [ ... ]
}meta.json fields: window, windowLabel, generated, tldr, topItems, and optionally sourcesChecked for coordinator-level entries.
Section-level sourcesChecked stay in their section files. The build-report script unions them automatically.
Quality gates (apply during ranking):
tldr: 2-5 sentences, 120+ chars, editorial not fragmentarytitle: unique, SEO-friendly headline, accurate and non-clickbaitsummary: 2-3 sentences, 120+ chars, covering who/what/where/whenwhyImportant: short paragraph on why the story matters nowtitle + summary + whyImportant under 150 wordsshortTitle and shortDescriptiontopItems must not be duplicated inside sectionsreferences, contentEvidence, dates, source infoPresentation rules for every kept item:
references; the rendered HTML exposes a visible Source Link action.theme metadata field (ai, tech, security, repositories, others) to each item. The HTML renders sections in canonical domain order (ai, devtools, web, security, repos, optional cross), not by theme grouping.Skip at `brief` depth. Brief reports prioritize speed over verification — proceed directly to Step 6.
After merge and ranking, run a verification pass on every item that references a GitHub repository. Use Octocode MCP tools to ground-truth the report data against live GitHub state.
Scope: all items across topItems and every section where link, sourceUrl, or any references[].url points to a github.com repo or release page.
Verification checklist per repo item (batch up to 3 queries per Octocode call):
ghSearchRepos with owner + repo name extracted from the URL. Confirm status: "hasResults". If empty or error, flag the item.stars, pushedAt, language, topics. Update the item stars field with the real count (e.g. "★ 12.4k"). Flag repos with no pushes in >90 days as potentially stale.ghGetFileContent on CHANGELOG.md, RELEASES.md, or the GitHub releases page path. Verify the version string appears. Alternatively use ghSearchPRs with type="metadata" to confirm merged release PRs.ghViewRepoStructure (root, depth=1) to confirm the repo has a README and is not empty/archived. Cross-check the repo description against the item summary for accuracy.Actions based on verification results:
| Result | Action |
|---|---|
| Repo confirmed, data matches | No change — item passes |
| Stars differ by >10% | Update stars field with verified count |
| Release version not found | Add note to whyImportant, downgrade heat by 10 |
| Repo not found / private / archived | Remove item or move to blockedOrStale, log in sourcesChecked |
| Repo stale (no push >90d) | Add staleness note to whyImportant, consider lowering heat |
Efficiency rules:
ghSearchRepos call (the tool supports 1-3 queries).type is blog, newsletter, or advisory and no GitHub URL appears in link or references.sourcesChecked entries. Only verify repos that subagents discovered via RSS or web sources without GitHub tool confirmation.yarn --cwd skills/octocode-news build-report \
--section-dir ~/tmp/{ts}-sections/ \
--json-out ~/tmp/{ts}-whats-new.json \
--output ~/tmp/{ts}-whats-new.html \
--require-full-content \
--openThe --section-dir reads meta.json and every {id}.json from the directory, merges them, validates with Zod, normalizes, then injects each section into its own <script> block in the HTML.
Legacy single-file mode still works for backwards compatibility:
yarn --cwd skills/octocode-news build-report \
--input ~/tmp/{ts}-whats-new.raw.json \
--json-out ~/tmp/{ts}-whats-new.json \
--output ~/tmp/{ts}-whats-new.html \
--require-full-content \
--openIf validation fails: the error output lists every failing item and the reason (missing whyImportant, short summary, missing references, bad contentEvidence). Fix the failing items in the relevant section JSON and re-run. Do not skip --require-full-content.
Fallback only if the script itself is broken:
scripts/report-template.html__REPORT_META__ with the meta JSON, and each __SECTION_{ID}__ with the section JSON (or null)| File | Purpose | Used in |
|---|---|---|
references/sources.md | Source catalog — baseline for all research | Steps 2, 3 |
references/dataStructure.md | Schema guide + example JSON + constraints | Steps 3, 4 |
src/report-schema.ts | Zod schema — SectionPayload, ReportMeta, and full ReportData | Steps 3, 4, 6 |
src/ | Editable TypeScript, HTML, and CSS source | All steps (edit here, then build:scripts) |
scripts/ | Bundled/minified runnable artifacts | Steps 2, 6 |
scripts/report-template.html | Self-contained UI template (per-section <script> blocks, CSS inlined at build) | Step 6 (fallback) |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.