fpa-learn-business — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited fpa-learn-business (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Before scaffolding any model, learn the business. This produces two artifacts: a durable business profile that every other openfpa skill reads first, and - where the standard skills don't fit - bespoke skills/agents generated for this specific company. The toolkit re-tools itself per business instead of forcing a generic template.
Core principle: A forecast is only as good as the business understanding behind it. Encode that understanding once, explicitly, so it grounds everything downstream.
.fpa/business-profile.md is missing or staleDo not force this workflow when the user asks for a narrow task that can be completed without understanding the whole company.
openfpa status <company-root>. If it is uninitialized, run openfpa init <company-root> --business-name "<name>". Then run openfpa doctor <company-root>. The CLI emits JSON. If the console script is unavailable in a source checkout, use python3 -m pyfpa.cli.
openfpa inspect-data <data-root> forevery user-supplied folder, then read the relevant financials, operating files, documentation, and existing model code before asking questions. Record each fact with openfpa intake-record <company-root>, including file references and confidence. Never access an external MCP/API system without the user's approval.
openfpa intake-next <company-root> and ask that related round of at most three questions. After every response, call openfpa intake-record with --source-type user. Direct answers are confirmed immediately. Only ask the user to resolve conflicting or low-confidence inferred facts.
pyfpa.intake_ready(intake) is true. Do not askquestions already answered by local evidence or earlier conversation.
pyfpa.ArchitectureProposalcovering the model objective, connectors, company-specific model components, generated skills, risks, and validation checks. Call pyfpa.write_onboarding_outputs(intake, workspace, proposal) to write:
.fpa/business-profile.md.fpa/decisions/initial-model-architecture.mdproposed architecture. Do not scaffold or generate artifacts until the user approves the proposal.
model from what generalized across same-type clients. Priors are seeds; this client's learning loop refines them.
sku-profitability skillarr-waterfall / cohort-retention skilldriver-cost-scorecard skillskill format, into skills/generated/ (and agents/generated/). Company models and connectors belong in models/generated/ and connectors/generated/. Each generated artifact MUST cite the profile facts that justify it and include a focused test or reconciliation check.
pyfpa.apply_corrections(cfg, pyfpa.load_corrections('.fpa/corrections')). Route any type: structural corrections through this skill's skill-generation path as pre-ratified proposals (the human already authored them - don't wait for backtest misses).generated/ namespaces in the client's own repo - never the public openfpa template.pyfpa.Experiment files in.fpa/experiments/; preserve rejected and reverted experiments.
After architecture approval, use fpa-scaffold-model to build the runnable model. Consult fpa-cfo-judgment throughout.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.