trellis-brainstorm-228cbc — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited trellis-brainstorm-228cbc (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
CoreRule: Interview me relentlessly about every aspect of this plan until we reach a shared understanding. Walk down each branch of the design tree, resolving dependencies between decisions one-by-one. For each question, provide your recommended answer.
Ask the questions one at a time.
If a question can be answered by exploring the codebase, explore the codebase instead.
Guide AI through collaborative requirements discovery before implementation, optimized for AI coding workflows:
Triggered from /trellis:start when the user describes a development task, especially when:
Always ensure a task exists at the start so the user's ideas are recorded immediately.
If you can derive the answer from repo code, docs, configs, conventions, or quick research — do that first.
Never overwhelm the user with a list of questions. Ask one, update PRD, repeat.
For preference/decision questions, present 2–3 feasible, specific approaches with trade-offs.
If the decision depends on industry conventions / similar tools / established patterns, do research first, then propose options.
After initial understanding, proactively consider future evolution, related scenarios, and failure/edge cases — then converge to an MVP with explicit out-of-scope.
Do not ask "should I search?" or "can you paste the code so I can continue?" If you need information: search/inspect. If blocked: ask the minimal blocking question.
Before any Q&A, ensure a task exists. If none exists, create one immediately.
TASK_DIR=$(python3 ./.trellis/scripts/task.py create "brainstorm: <short goal>" --slug <auto>)Use a slug without a date prefix. task.py create adds the MM-DD- directory prefix automatically.
Create/seed prd.md immediately with what you know:
# brainstorm: <short goal>
## Goal
<one paragraph: what + why>
## What I already know
* <facts from user message>
* <facts discovered from repo/docs>
## Assumptions (temporary)
* <assumptions to validate>
## Open Questions
* <ONLY Blocking / Preference questions; keep list short>
## Requirements (evolving)
* <start with what is known>
## Acceptance Criteria (evolving)
* [ ] <testable criterion>
## Definition of Done (team quality bar)
* Tests added/updated (unit/integration where appropriate)
* Lint / typecheck / CI green
* Docs/notes updated if behavior changes
* Rollout/rollback considered if risky
## Out of Scope (explicit)
* <what we will not do in this task>
## Technical Notes
* <files inspected, constraints, links, references>
* <research notes summary if applicable>Before asking questions like "what does the code look like?", gather context yourself:
Write findings into PRD:
What I already knowTechnical Notes| Complexity | Criteria | Action |
|---|---|---|
| Trivial | Single-line fix, typo, obvious change | Skip brainstorm, implement directly |
| Simple | Clear goal, 1–2 files, scope well-defined | Ask 1 confirm question, then implement |
| Moderate | Multiple files, some ambiguity | Light brainstorm (2–3 high-value questions) |
| Complex | Vague goal, architectural choices, multiple approaches | Full brainstorm |
Note: Task already exists from Step 0. Classification only affects depth of brainstorming.
Before asking ANY question, run the following gate:
If answer is available via:
→ Do not ask. Fetch it, summarize, update PRD.
Examples:
→ Do not ask. Take action.
→ Only ask Blocking or Preference.
trellis-research sub-agent (don't research inline)For each research topic, spawn a `trellis-research` sub-agent via the Task tool — don't do WebFetch / WebSearch / gh api inline in the main conversation.
Why:
{TASK_DIR}/research/<topic>.md (the contract — see workflow.md Phase 1.2){file path, one-line summary} to the main agentCodex exception: on Codex CLI, do NOT dispatchtrellis-researchfor research-first mode — do the research inline (WebFetch / WebSearch in the main session) and write findings to{TASK_DIR}/research/<topic>.mdyourself. Reason: Codexspawn_agentruns sub-agents withfork_turns="none"(isolated context, no parent session inheritance), so the research sub-agent cannot resolve the active task path viatask.py currentand silently aborts without producing files. Inline research on Codex avoids this failure mode. The 3+ inline research calls limit (B rule inworkflow.md) is relaxed for Codex specifically.
Agent type: trellis-research Task description template: "Research <specific question>; persist findings to {TASK_DIR}/research/<topic-slug>.md."
❌ Bad (what you must NOT do):
Main agent: WebFetch(url-A) → WebFetch(url-B) → Bash(gh api ...)
→ WebSearch(q1) → WebSearch(q2) → ... (10+ inline calls)
→ Write(research/topic.md)→ Pollutes main context with raw HTML/JSON, burns tokens.
✅ Good:
Main agent: Task(subagent_type="trellis-research",
prompt="Research topic A; persist to research/topic-a.md")
+ Task(subagent_type="trellis-research",
prompt="Research topic B; persist to research/topic-b.md")
+ Task(subagent_type="trellis-research",
prompt="Research topic C; persist to research/topic-c.md")
→ Reads research/topic-{a,b,c}.md after they finish.Each trellis-research sub-agent should:
{TASK_DIR}/research/<topic>.mdMain agent then reads the persisted files and produces 2–3 feasible approaches in PRD.
The PRD itself should only reference the persisted research files, not duplicate their content. Add a ## Research References section pointing at research/*.md.
Optionally, add a convergence section with feasible approaches derived from the research:
## Research References
* [`research/<topic-a>.md`](research/<topic-a>.md) — <one-line takeaway>
* [`research/<topic-b>.md`](research/<topic-b>.md) — <one-line takeaway>
## Research Notes
### What similar tools do
* ...
* ...
### Constraints from our repo/project
* ...
### Feasible approaches here
**Approach A: <name>** (Recommended)
* How it works:
* Pros:
* Cons:
**Approach B: <name>**
* How it works:
* Pros:
* Cons:
**Approach C: <name>** (optional)
* ...Then ask one preference question:
After you can summarize the goal, proactively broaden thinking before converging.
I understand you want to implement: <current goal>.
Before diving into design, let me quickly diverge to consider three categories (to avoid rework later):
1. Future evolution: <1–2 bullets>
2. Related scenarios: <1–2 bullets>
3. Failure/edge cases: <1–2 bullets>
For this MVP, which would you like to include (or none)?
1. Current requirement only (minimal viable)
2. Add <X> (reserve for future extension)
3. Add <Y> (improve robustness/consistency)
4. Other: describe your preferenceThen update PRD:
RequirementsOut of ScopeOpen Questions → RequirementsAcceptance Criteria with testable checkboxesOut of ScopeFor <topic>, which approach do you prefer?
1. **Option A** — <what it means + trade-off>
2. **Option B** — <what it means + trade-off>
3. **Option C** — <what it means + trade-off>
4. **Other** — describe your preferenceAfter requirements are clear enough, propose 2–3 approaches (if not already done via research-first):
Based on current information, here are 2–3 feasible approaches:
**Approach A: <name>** (Recommended)
* How:
* Pros:
* Cons:
**Approach B: <name>**
* How:
* Pros:
* Cons:
Which direction do you prefer?Record the outcome in PRD as an ADR-lite section:
## Decision (ADR-lite)
**Context**: Why this decision was needed
**Decision**: Which approach was chosen
**Consequences**: Trade-offs, risks, potential future improvementsWhen open questions are resolved, confirm complete requirements with a structured summary:
Here's my understanding of the complete requirements:
**Goal**: <one sentence>
**Requirements**:
* ...
* ...
**Acceptance Criteria**:
* [ ] ...
* [ ] ...
**Definition of Done**:
* ...
**Out of Scope**:
* ...
**Technical Approach**:
<brief summary + key decisions>
**Implementation Plan (small PRs)**:
* PR1: <scaffolding + tests + minimal plumbing>
* PR2: <core behavior>
* PR3: <edge cases + docs + cleanup>
Does this look correct? If yes, I'll proceed with implementation.For complex tasks with multiple independent work items, create subtasks:
# Create child tasks
CHILD1=$(python3 ./.trellis/scripts/task.py create "Child task 1" --slug child1 --parent "$TASK_DIR")
CHILD2=$(python3 ./.trellis/scripts/task.py create "Child task 2" --slug child2 --parent "$TASK_DIR")
# Or link existing tasks
python3 ./.trellis/scripts/task.py add-subtask "$TASK_DIR" "$CHILD_DIR"prd.md should converge to:
# <Task Title>
## Goal
<why + what>
## Requirements
* ...
## Acceptance Criteria
* [ ] ...
## Definition of Done
* ...
## Technical Approach
<key design + decisions>
## Decision (ADR-lite)
Context / Decision / Consequences
## Out of Scope
* ...
## Technical Notes
<constraints, references, files, research notes>After brainstorm completes (Step 8 confirmation approved), the flow continues to the Task Workflow's Phase 2: Prepare for Implementation:
Brainstorm
Step 0: Create task directory + seed PRD
Step 1–7: Discover requirements, research, converge
Step 8: Final confirmation → user approves
↓
Task Workflow Phase 2 (Prepare for Implementation)
Code-Spec Depth Check (if applicable)
→ Research codebase (based on confirmed PRD)
→ Configure code-spec context (jsonl files)
→ Activate task
↓
Task Workflow Phase 3 (Execute)
Implement → Check → CompleteThe task directory and PRD already exist from brainstorm, so Phase 1 of the Task Workflow is skipped entirely.
| Command | When to Use |
|---|---|
/trellis:start | Entry point that triggers brainstorm |
/trellis:finish-work | After implementation is complete |
/trellis:update-spec | If new patterns emerge during work |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.