deepline-plays — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited deepline-plays (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Deepline GTM work is paid uncertainty reduction. The play is the notebook, stable ids are the cache, datasets are durable row state, getters are the interface, and CSV is an input/output boundary. Start from live Deepline contracts, then run exactly or build a small durable wrapper.
Default rule: every user request is fresh unless the user names a project, play file, run id, saved play, or asks to continue prior work. Do not inspect old local .play.ts, README, or CSV files for route evidence.
Run one Deepline command at a time when you need its output. Avoid jq, shell parsing, background jobs, raw curl, env spelunking, or local provider probes around Deepline commands. JSON output is for reading directly.
If CLI V2 seems broken, check deepline switch status; use deepline switch sdk to switch to SDK mode or deepline switch python to roll back to the Python CLI.
plays search -> plays describe; for tools, tools search -> tools describe.plays describe is the gate for prebuilts; plays check <file> is mandatory for local, bootstrapped, or forked plays.Safe planning-only commands: auth/health/balance, plays search, plays describe, tools search, tools describe, plays check, plays bootstrap --help, and local scaffolding. Do not call plays run or provider execution in planning-only mode.
| Situation | Use | First commands | Gate |
|---|---|---|---|
| Known play/prebuilt may fit exactly | This page + run/export reference | deepline plays describe prebuilt/<name> --json | Input/output/export/pricing/freshness match |
| CSV needs aliases, validation, projection, or join | This page + run/export reference | plays describe, inspect headers, plays bootstrap | plays check and pilot pass |
| Find companies, contacts, or TAM | references/find-companies-contacts-tam.md + this page | plays search "company list TAM...", fallback tools search | Criteria, evidence, count/sample basis, and cost are legible |
| Company -> contacts -> email/phone | Company/contact/TAM reference + this page | search/describe company, people, and channel contracts | Pilot proves account grain and contact identity |
| API/cron/webhook monitor | This page + generated refs + run/export reference | plays bootstrap --help, generated SDK/API refs | Trigger, input, side effects, and pilot are isolated |
| Billing/rerun/debug/export question | references/run-export-inspect-repair.md first | runs get, runs export, runs logs | No paid rerun until run metadata is understood |
Names are hints. Live search and describe are source of truth.
deepline plays search "<job words>" --json
deepline plays describe prebuilt/<candidate> --json
deepline tools search "<provider need>" --categories <category> --json
deepline tools describe <tool-id> --jsonRules:
plays search defaults to trusted Deepline-managed prebuilts. Use --all only when the user explicitly names or asks for their own/user/org play.tools describe for a prebuilt play.references/find-companies-contacts-tam.md.Contract checklist from plays describe / tools describe:
result.extractedValues.email?.get()Direct-run only when exact:
Typical flow:
deepline plays describe prebuilt/<name> --json
deepline plays run prebuilt/<name> --input '{"field":"value"}' --watch
deepline runs get <run-id> --full --json
deepline runs export <run-id> --dataset result.rows --out rows.csvFor CSV prebuilts, compare required headers to actual headers. If aliases are unsupported or output projection is custom, bootstrap a wrapper instead of editing the prebuilt.
Bootstrap is the composition tool. It is not anti-prebuilt.
Bootstrap/wrap when:
Fork when internals need to change:
Do not fork for simple CSV aliases or final formatting. Wrap instead.
deepline plays bootstrap <family> --from <source> --using play:prebuilt/<candidate> --limit 5 --out workflow.play.ts
deepline plays get prebuilt/<name> --source --out fork.play.ts
deepline plays check workflow.play.tsRoute families: people-list, company-list, people-email, people-phone, company-people, company-people-email, company-people-phone.
If bootstrap syntax fails, run deepline plays bootstrap --help or route help and retry with explicit stage flags such as --people, --email, or --phone.
Use the current V2 shape from generated references when exact syntax matters:
import { definePlay } from 'deepline';
type Input = { limit?: number };
export default definePlay(
'gtm-play',
async (ctx, input: Input = {}) => {
return { ok: true, limit: input.limit ?? 5 };
},
{ billing: { maxCreditsPerRun: 50 } },
);Authoring rules:
ctx.csv, ctx.dataset, ctx.tools.execute, ctx.runPlay, ctx.step, ctx.fetch, and ctx.secrets.fs, raw fetch, shell commands, env reads, Date.now, or Math.random inside play bodies.email_lookup_raw.status, miss_reason, display fields, and transformations in separate pure columns after the paid column.email_lookup_raw: rowCtx.runPlay(...) or rowCtx.tools.execute(...), then resolved_email, email_status, and miss_reason as pure extraction/mapping columns.extractedValues.*.get() exists.status, miss_reason, evidence/source, and requested output fields.Dynamic staleness pattern:
.withColumn("job_change", {
run: async ({ row, ctx, previousCell }) => {
if (previousCell?.value.status === "stale_contact") {
return previousCell.value;
}
return await checkJobChange(row, ctx);
},
staleAfterSeconds: (value) =>
value.status === "stale_contact" ? null : 30 * 24 * 60 * 60,
})Semantics:
value is the new value returned by run.null stale time means no next expiry.previousCell guard avoids paying again during metadata backfill.Load only when the task needs it:
references/find-companies-contacts-tam.md (Find Companies, Contacts, And TAM): account sourcing, contacts, TAM, portfolio/investor lists, hiring-qualified companies, signals, personas, provider playbooks, account-first strategy, evidence, or fanout economics.references/run-export-inspect-repair.md (Run, Export, Inspect, Repair): before scale; after every meaningful run; for billing, rerun, export, cached rows, failed rows, logs, suspicious output, partial repair, or UI/run mismatch.references/sdk-reference.md: exact current SDK signatures.references/api-reference.md: exact API/manual invocation, polling, streaming, stop, list, inspect/export, and artifact routes.Do not load a separate reference for ordinary prebuilt search/describe/run, CSV contracts, bootstrap, wrapping, or forking. Those basics are here.
When work ran, summarize:
When no paid run happened, say so explicitly and list the safe commands used.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.