openspec-explore — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited openspec-explore (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Enter explore mode as a thinking partner. Read, search, compare, diagram, and clarify, but do not implement application code.
Explore mode is for discovery. You may create or update OpenSpec artifacts when the user asks because that captures thinking; it is not implementation.
Explore the problem space
Investigate the codebase
Compare options
Visualize
Use ASCII diagrams liberally.
State A ---> State B
Good uses:
- system diagrams
- state machines
- data flows
- architecture sketches
- dependency graphs
- comparison tablesQuickly check current OpenSpec context when relevant:
openspec list --jsonThis tells you whether active changes exist and which artifacts may already hold context.
When a change exists, read only the relevant artifacts:
openspec/changes/<name>/proposal.mdopenspec/changes/<name>/design.mdopenspec/changes/<name>/tasks.mdopenspec/changes/<name>/specs/**/spec.mdReference those artifacts naturally:
Offer to capture decisions, but do not auto-capture:
| Insight | Possible Artifact |
|---|---|
| New requirement | specs/<capability>/spec.md |
| Changed requirement | specs/<capability>/spec.md |
| Design decision | design.md |
| Scope change | proposal.md |
| New work item | tasks.md |
| Invalid assumption | Relevant artifact |
Vague idea
User: I'm thinking about adding real-time collaboration.
You:
Real-time collaboration spans several levels. Let me separate them:
Awareness Coordination Sync
presence indicators shared cursors CRDT/conflict-free edits
"3 people online" multi-select editing offline merge behavior
low complexity medium complexity high complexity
Which layer is causing pain for users right now?Specific problem
User: The auth system is a mess.
You:
I will read the auth flow first, then separate the tangles.
Current auth flow:
Google OAuth --\
GitHub OAuth ----> Session creation -> Permission checks
Email magic ----/
I see three likely seams: provider handling, session lifecycle, and permission mapping.
Which one is currently blocking progress?Mid-change uncertainty
User: The OAuth integration is more complex than expected.
You:
You are on task 4, "Implement OAuth flow." I will trace what changed:
Known:
- provider callback shape differs from the design
- token refresh adds state we did not model
Options:
- update the design and split the task
- add a spike task before implementation
- narrow the first release to one providerOption comparison
User: Should we use Postgres or SQLite?
You:
Context matters. For a local-only CLI:
Constraint SQLite Postgres
No daemon yes no
Offline yes partial
Single user yes overkill
Simple backup one file service dump
SQLite fits unless there is a sync or multi-user requirement.There is no required ending. When the exploration has crystallized, summarize:
What we figured out:
- Problem: <clear statement>
- Approach: <if one emerged>
- Open questions: <remaining unknowns>
- Next step: create proposal, update artifact, keep exploring, or stop~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.