octocode-rfc-generator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited octocode-rfc-generator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when a change needs thinking before coding: architecture choices, migrations, cross-package changes, risky refactors, implementation plans, or formal RFC/design docs. The output is evidence-backed and actionable, not a brainstorm.
Core flow:
UNDERSTAND → RESEARCH → COMPARE OPTIONS → WRITE RFC / PLAN → VALIDATE → DELIVERDefault output location when saving is approved: .octocode/rfc/RFC-{meaningful-name}.md.
| User asks for | Mode | Output |
|---|---|---|
| “write RFC”, “design doc”, “proposal”, “architecture decision” | RFC | Full RFC with alternatives, rationale, risks, implementation plan |
| “plan this work”, “research and build”, “implementation plan” | Plan | Evidence-backed implementation plan; RFC sections included only when useful |
| “compare approaches”, “should we use X or Y” | Decision | Options matrix + recommendation + adoption/rollback notes |
| “migration plan” | Migration | Current state, target state, compatibility, rollout, rollback, phases |
| “validate this RFC/design” | Validation | Claim-by-claim verdict with evidence and gaps |
If the task is a trivial one-file edit with no design choice, say an RFC is unnecessary and suggest using octocode-engineer directly.
Pick MCP if available; otherwise use the CLI. Do not guess facts that tools can verify.
Use when the current repo matters.
| Need | MCP | CLI |
|---|---|---|
| Map structure | localViewStructure | octocode ls |
| Find files | localFindFiles | octocode find |
| Search code | localSearchCode | octocode grep |
| Read exact code | localGetFileContent | octocode cat |
| AST shape proof | localSearchCode(mode:"structural") | octocode ast |
| Symbols / LSP | lspGetSemantics | octocode symbols / octocode lsp |
Local flow:
ls → find/grep → symbols → matchString/line range → AST/LSP → cited current-state evidenceUse for prior art, package choices, cross-repo comparison, and history.
| Need | MCP | CLI |
|---|---|---|
| Package → repo | npmSearch | octocode pkg |
| Discover repos | ghSearchRepos | octocode repo |
| Map repo | ghViewRepoStructure | octocode ls owner/repo |
| Search GitHub | ghSearchCode | octocode grep kw owner/repo |
| Read GitHub file | ghGetFileContent | octocode cat owner/repo/path |
| PR/commit history | ghHistoryResearch | octocode pr / octocode history |
| Clone for deep proof | ghCloneRepo | octocode clone |
External flow:
pkg/repo → ghViewRepoStructure → ghSearchCode path/content discovery → ghGetFileContent proof → history/PR rationaleClone and switch to local tools when analysis spans several files or needs AST/LSP.
Use when the source is packaged or compiled.
| Need | MCP | CLI |
|---|---|---|
| Identify file type | localBinaryInspect(mode:"identify") | octocode binary --identify |
| List archive entries | localBinaryInspect(mode:"list") | octocode binary --list |
| Extract one entry | localBinaryInspect(mode:"extract") | octocode binary --extract |
| Decompress stream | localBinaryInspect(mode:"decompress") | octocode binary --decompress |
| Inspect strings | localBinaryInspect(mode:"strings") | octocode binary --strings |
| Unpack archive | localBinaryInspect(mode:"unpack") | octocode unzip |
Flow: identify/list → extract one entry or unpack all → run local tools on the returned localPath.
Capture this before research gets broad:
Ask if the problem or desired output mode is unclear.
Run only the tracks that matter.
| Scenario | Research tracks |
|---|---|
| Existing-system change | Local current state + local blast radius; external prior art if options are unclear |
| Greenfield choice | External prior art + package/repo comparison; local constraints if repo exists |
| Migration | Local current state + contracts/data flows + external migration examples |
| Library/package adoption | npm/package metadata + repo source + local integration points |
| Refactor plan | Local structure + LSP references/callers + AST duplication/smell checks |
| RFC validation | Map each claim to local/external evidence; mark confirmed/likely/uncertain |
Evidence rules:
file:line.matchString, line ranges, AST, LSP, or history before citing.Always include at least two alternatives unless the user explicitly asks for a single implementation plan.
Useful alternatives:
Compare on:
Use references/rfc-template.md for full RFCs; do not duplicate the whole template in the prompt. For implementation plans, include only the sections needed for the work:
# Plan: <title>
## Goal
## Evidence Summary
## Current State
## Proposed Approach
## Alternatives Considered
## Step-by-Step Implementation
## Files / APIs / Contracts Touched
## Test and Verification Plan
## Rollout / Migration / Rollback
## Risks and Open QuestionsImplementation steps should be ordered by dependency, not preference. Avoid time estimates.
Before delivering, check:
Reasoning traps:
Start with a concise summary:
Decision: <recommendation>
Why: <1-2 evidence-backed reasons>
Alternatives: <count and names>
Risk: <low|medium|high + why>
Next step: <one action>Then ask whether to save the full RFC/plan.
.octocode/rfc/RFC-{meaningful-name}.md.| Situation | Move |
|---|---|
| Local search empty | broaden search, inspect structure, try symbols/AST variants |
| GitHub search empty | use repo structure/path search, known files, or clone |
| No external prior art | say so; rely on local constraints and unresolved questions |
| Evidence conflicts | present conflict and decision rule |
| Scope too broad | split into multiple RFCs or phases |
| Two attempts fail | summarize what is known and ask for direction |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.