oma-architecture — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited oma-architecture (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Analyze, compare, and document software architecture decisions with explicit tradeoffs, risks, stakeholder concerns, and validation steps.
oma diagram resolve reports engine: archify (the normal case — oma auto-fetches the latest archify release), an interactive sibling <artifact-stem>.archify.json + .archify.html derived from that Mermaid (see _shared/conditional/diagram-engine.md)docs/decisions/, linked from docs/decisions/index.md.agents/results/architecture/outputs:
- name: architecture-decision
description: ADR or retained recommendation for a selected approach, with its actual authority status
artifact: "docs/decisions/*.md"
required: false
- name: architecture-artifact
description: Run-specific review, diagnosis, CBAM analysis, or unselected comparison draft
artifact: ".agents/results/architecture/*.md"
required: false
- name: architecture-decision-diagram-html
description: archify interactive HTML diagram (+ JSON spec) beside a retained structural decision; only when the archify engine resolves
artifact: "docs/decisions/*.archify.html"
required: false
- name: architecture-diagram-html
description: archify interactive HTML diagram (+ JSON spec) beside a run-specific structural report; only when the archify engine resolves
artifact: ".agents/results/architecture/*.archify.html"
required: falseresources/execution-protocol.md for workflowresources/methodology-selection.md for method choiceresources/stakeholder-synthesis.md when cross-cutting stakeholder consultation is justifiedresources/output-templates.md for final artifact shapesresources/api-evolution.md for published-contract versioning/deprecation decisions (MAP evolution patterns)resources/migration-patterns.md for transition plans when the chosen architecture requires restructuring a live system_shared/conditional/diagram-engine.md (+ oma diagram resolve) when a structural diagram is emitted — chooses archify vs Mermaid and owns the validate/deliver loopdocs/decisions/; use .agents/results/architecture/, docs/design-docs/, and docs/plans/designs/ as legacy context until migration. New decisions supersede old ones explicitly, never contradict them silently.| Action | SSL primitive | Evidence |
|---|---|---|
| Classify architecture request | SELECT | Method selection summary |
| Read code/docs/context | READ | Source-grounded architecture evidence |
| Compare options | COMPARE | Design-twice or recommendation mode |
| Infer risks and tradeoffs | INFER | ATAM/CBAM-style analysis |
| Validate decision fit | VALIDATE | Checklist and validation steps |
| Write artifact | WRITE | ADR or architecture result |
| Notify outcome | NOTIFY | Final recommendation summary |
Use the configured code-intelligence provider for structure, symbols, references, and integration points. If unavailable, use native search only for paths outside this project or ignored paths:
1. Read prior decisions in docs/decisions/; read old result/design directories as legacy fallback until migration.
2. Discover the configured provider's file, symbol, reference, and pattern tools.
3. Inspect architecture-relevant modules, ownership, and integration points within the selected scope.Then choose Diagnostic, Recommendation, Design-Twice, ATAM-style, CBAM-style, or ADR mode before writing the artifact.
| Scope | Resource target |
|---|---|
CODEBASE | Architecture-relevant source files and docs |
LOCAL_FS | docs/decisions/ decisions and .agents/results/architecture/ run reports |
MEMORY | Assumptions, option matrix, tradeoff notes |
docs/decisions/ and update its index. Keep run reviews, diagnoses, CBAM analyses, and unselected drafts in .agents/results/architecture/. Promotion into docs/ leaves a destination link in the source report.docs/decisions/ before deciding; read legacy locations until migration. When replacing an old decision, mark it superseded rather than contradicting it. Dispatched result-*.md reports always go to .agents/results/, preserving their task/run/session filenames.architecture.adr-complete (execution protocol Step 7). A completed proposal does not supply user approval or authorize implementation.../_shared/core/code-intelligence.md (code search/navigation)resources/execution-protocol.mdresources/checklist.mdresources/methodology-selection.mdresources/stakeholder-synthesis.mdresources/output-templates.mdresources/api-evolution.mdresources/migration-patterns.md../_shared/core/context-loading.md../_shared/core/difficulty-guide.md (unresolved scope or dependencies)../_shared/core/clarification-protocol.md../_shared/core/quality-principles.md~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.