oma-market — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited oma-market (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Run the upstream last30days research engine (always the latest release, managed by oma) for community-signal research, then frame the result for the user's intent (pain / trend / competitor / discovery) with strategic frameworks and save one brief under .agents/results/market/.
--days 7|30|90|180)--discover), person mode, hiring signals (--hiring-signals), follow-up drills (--drill)oma schedule <action> wrapping this skill--intent pain|trend|competitor|discovery (else classified per resources/intent-rules.md)--days), --vs <entity> (competitor), --frameworks auto|none|swot,5f,pesteloma market run --help) — passed through verbatim.agents/results/market/{topic-slug}-{YYYYMMDD}.md🌐 last30days v{VERSION} · synced {date}); body per the upstream OUTPUT CONTRACT; framework sections appended per intent; engine footer preservedmarket.save_dir (default .agents/results/market/raw/)outputs:
- name: market-brief
description: Single LAW-compliant markdown brief with framework sections
artifact: ".agents/results/market/*.md"
required: trueoma market resolve / oma market run — engine location, Python 3.12+ resolution, --save-dir defaultSKILL.md at the resolved engine root (skillMd in oma market resolve --json) — the authoritative research contractresources/intent-rules.md, resources/frameworks/, resources/output-laws.md, resources/execution-protocol.mdoma market detect-trap gate before anything else (exit 2 = REFUSE, exit 4 = invalid)oma market resolve refreshes the managed copy (throttled) and falls back to the cached copy offline; a pinned market.path / LAST30DAYS_HOME opts outoma market detect-trap "<topic>". Exit 2 → surface the REFUSE reason and reframe suggestion, stop.oma market resolve --json. ok: false → report reason (missing engine → oma market update; missing Python → the install hint) and stop. Never fall back to WebSearch-only synthesis and present it as market research.engine.skillMd top to bottom. It is long by design; do not skim. Treat engine.root as its SKILL_DIR.resources/intent-rules.md; map to engine flags and framework set.oma market run already resolved the interpreter."${LAST30DAYS_PYTHON}" "${SKILL_DIR}/scripts/last30days.py" <args>, run oma market run <args> with the same arguments (foreground, 5-minute timeout, --emit=compact). --save-dir is added automatically from market.save_dir unless you pass one.resources/frameworks/).resources/output-laws.md, write .agents/results/market/{topic-slug}-{YYYYMMDD}.md, preview the first 50 lines.--vs <entity> or "A vs B" phrasing → competitor intent → upstream COMPARISON flow (two passes + head-to-head as its contract specifies) → SWOT + Porter's 5F.engine.status: stale → include the note in the report (research ran on the cached engine version).--force only on explicit user reconfirmation.oma market resolve not ok → stop with the reason; no engine run.| Action | SSL primitive | Evidence |
|---|---|---|
| detect-trap preflight | VALIDATE | Topic arg, trap pattern rules |
| Resolve engine + Python | CALL_TOOL | oma market resolve --json |
| Read upstream contract | READ | engine.skillMd |
| Classify intent | SELECT | resources/intent-rules.md |
| Upstream pre-research steps | INFER | Upstream SKILL.md Steps 0–0.75 |
| Run engine | CALL_TOOL | oma market run <args> |
| Synthesize + frameworks | WRITE | Upstream OUTPUT CONTRACT, resources/frameworks/ |
| Self-check + write brief | WRITE | resources/output-laws.md, .agents/results/market/ |
oma market detect-trap <topic> (preflight gate)oma market resolve [--refresh|--offline] [--json] (engine + Python resolution; managed latest)oma market update (force-refresh the managed engine)oma market run <engine args…> (passthrough to the resolved upstream engine’s Python entry point)TOPIC="VS Code pain points"
oma market detect-trap "$TOPIC"
oma market resolve --json # read .engine.skillMd, then follow it
# … upstream Steps 0 / 0.45 / 0.5 / 0.55 / 0.75 …
oma market run "$TOPIC" --plan "$QUERY_PLAN_FILE" --subreddits=vscode --emit=compact --save-suffix=v3| Scope | Resource target |
|---|---|
NETWORK | Inside the engine only (its per-source fetchers); GitHub for the managed engine refresh |
LOCAL_FS | ~/.cache/oma-market/last30days/<tag>/ (engine), ~/.config/last30days/ (engine config, keys), .agents/results/market/ (brief + raw) |
PROCESS | oma market subcommands → the resolved upstream Python entry point |
oma market resolve is ok (engine present; Python ≥ 3.12 found on PATH, via uv, or pinned with market.python / LAST30DAYS_PYTHON)..agents/results/market/{topic-slug}-{YYYYMMDD}.md and raw engine files to market.save_dir.~/.config/last30days/.env with user consent.oma market resolve stops before the upstream setup wizard. Relay its install hint; after an authorized interpreter installation, retry resolution. Do not expect the skipped upstream Python preflight to install it.resources/execution-protocol.mdresources/intent-rules.mdresources/output-laws.mdresources/frameworks/swot.md, resources/frameworks/porters-5f.md, or resources/frameworks/pestel.md (load only the selected framework)resources/checklist.mdresources/error-playbook.mdengine.skillMd path from oma market resolve --json; upstream scripts are managed engine files, not bundled skill resources.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.