resolve-beagle — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited resolve-beagle (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Take a spec produced by brainstorm-beagle and close its remaining gaps — both the explicit Open Questions and the latent ones the self-review missed — by researching, proposing answers, and rewriting the spec in place.
The terminal state is a spec with no known open questions and no placeholder requirements. Planning can start immediately after.
<hard_gate> This skill does not write code, scaffold projects, design architecture, or create implementation plans. It only edits the spec document. "Answering an open question" means proposing a WHAT/WHY answer with rationale — never a HOW. If a question turns out to require implementation design, defer it with a note and move on. </hard_gate>
Objective pass conditions so steps are not skippable by assertion alone:
Read succeeds (or the user supplied a valid path after you listed 3–5 recent docs/specs/ candidates).../brainstorm-beagle/references/spec-reviewer.md with failures fixed in-session unless the user opts for a follow-up pass.git commit unless the user answered yes to the commit prompt in § Committing.docs/specs/brainstorm-beagle uses (see ../brainstorm-beagle/references/spec-reviewer.md)Locate spec → Extract gaps → Show list ──→ User adds/removes
→ Dispatch research (parallel if possible)
→ Propose answers (one at a time)
→ User decision → next
→ Rewrite spec in place
→ Self-review (fix inline)
→ Ask about committingIf the user gave a path, use it.
Otherwise, list the 3–5 most recently modified files in docs/specs/ and ask: "Work on <most recent>, or another one?" Don't scan the whole directory tree — specs are top-level per brainstorm-beagle's convention.
If no spec directory exists, ask the user for the path.
Two categories count as gaps:
Explicit gaps — every bullet under the spec's Open Questions heading is one research task.
Latent gaps — issues that slipped past the brainstorm's self-review. Scan the spec for:
| Problem | What it looks like |
|---|---|
| Placeholder | TBD, TODO, "to be determined", ellipsis used as content |
| Vague requirement | "fast", "simple", "good", "user-friendly", "intuitive" — nothing to verify against |
| Missing rationale | Constraint or Out-of-Scope item with no "why" |
| Contradiction | Requirement conflicts with another requirement, with a constraint, or with Out of Scope |
| Untestable success | No observable way to verify the requirement was met |
| Implementation leakage | A requirement prescribes HOW instead of describing WHAT |
| Unconsumed surface | A must-have introduces new externally-facing surface (API surface, command, endpoint, exported contract) that nothing else in the spec consumes |
| Unresolved composition | An existing mechanism sits upstream/downstream in the same data pipeline and transforms (truncate, filter, buffer, reorder, dedupe) the data the feature depends on, but its composition with the feature is left unexamined |
The reason to treat latent gaps as first-class: a spec that says "fast" or "good UX" hasn't been answered just because nothing was explicitly flagged. Planning will trip over those same words. Close them here.
Before dispatching research, show the combined list to the user in one message — "here's what I'm planning to close" — and let them add, remove, or defer items. Don't ask permission one-by-one; that's the proposal step.
Each gap gets exactly one research task. Classify each task first — the type determines which tools the research needs:
| Task type | Looks like | Tools |
|---|---|---|
| Codebase pattern | "How does the existing --start-at pattern work?" "Where is SKILL_MAP defined?" | search the codebase (grep/glob/read) |
| External / API | "What does the agent's SDK expose for sub-agent spawning?" "Does Codex have hooks?" | web search and page fetch (if web access is available) |
| Design tradeoff | "What should the merged report format be?" "How should deduplication work?" | Reasoning + analogous reference points already in the spec |
| Scope / policy | "Should config/docs files route to a stack or fallback?" | Reasoning tied to the spec's own Core Value and Constraints |
If the agent supports subagents, dispatch each research task as an independent subagent — all in the same turn, so they run in parallel. Each subagent gets its own context window, which matters: gaps often come with large supporting context (the spec, the codebase) that you don't want crammed into a single conversation.
See references/subagent-prompts.md for the prompt templates (one per task type).
The research return must be structured: recommended answer, 1–2 alternatives with why rejected, and concrete evidence (file:line citations, URLs, or references to existing spec sections). Cap each return at ~300 words — you want decisions, not transcripts.
If no subagent tool is available, do the research yourself, one question at a time. Work in cheapest-first order: codebase questions, then external, then tradeoffs, then scope/policy. Produce the same structured proposal for each. This is slower but never leaves gaps unresolved.
Present proposals one at a time. For each:
The user can accept, revise, or reject. Follow the thread if they want to discuss; move on once decided.
Order matters. Resolve in this rough sequence:
When a gap can't be resolved without input only the user has (budgets, stakeholder preferences, unstated constraints), don't guess — ask directly. It's cheaper than proposing the wrong answer and unwinding it.
As decisions land, migrate them to where they belong:
| Gap type | Destination after resolution |
|---|---|
| Architectural or policy decision | New entry under Key Decisions (with alternatives considered) |
| Concrete behavior | New entry under Requirements (assigned must/should/out-of-scope) |
| Hard limit | New entry under Constraints (with rationale) |
| External reference discovered during research | New entry under Reference Points |
| Vague requirement replaced | Rewrite the existing requirement inline; do not duplicate |
| Intentionally deferred | Stays in Open Questions with a deferred: <reason> suffix |
Two rules that matter:
Run the checks from ../brainstorm-beagle/references/spec-reviewer.md:
needs-spike-before-planning, not left unexaminedFix anything that surfaces inline before handing back to the user. If new gaps appear during the rewrite (they sometimes do), add them to a "new gaps surfaced" list and ask the user whether to resolve them now or leave for a later pass.
After the rewrite, summarize and ask:
"Spec updated. Resolved N explicit questions and M latent gaps. Want me to commit this as docs: resolve open questions in <topic> spec?"If yes, commit. If no, leave the working tree for the user. Do not commit unprompted — the user may want to review the diff first or bundle it with other changes.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.