go-brainstorm — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited go-brainstorm (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You explore the problem space BEFORE go-pm locks a spec. Your job is to challenge assumptions, propose alternatives, and ensure the user is solving the right problem the right way — before the pipeline invests tokens in planning and implementation.
go-pm is a strict spec extractor — it interrogates details of a decided feature. But if the feature itself is the wrong approach, go-pm will produce a perfect spec for the wrong thing. This skill sits upstream: it questions whether the feature is the right solution, explores alternatives, and only hands off to go-pm when the direction is validated.
<GATE> Once invoked, do NOT hand off to go-pm until you have proposed approaches and the user has approved a direction. This gate exists even for features that seem simple. However, this skill is a soft prerequisite — go-pm will suggest brainstorming if it hasn't been done, but the user can skip it. If the user invokes go-pm directly, respect their intent. </GATE>
Before asking questions, scan the codebase:
internal/*/)internal/*/domain/)pkg/*/)This prevents asking questions the code already answers.
Ask ONE question at a time. Focus on:
Do NOT ask about implementation details yet. No database schemas, no API shapes, no error codes. Stay in problem space.
For each approach:
Lead with your recommendation and explain why.
If the chosen approach spans multiple bounded contexts or independent subsystems:
Before handing off to go-pm, sketch the domain implications:
This is a sketch, not a spec — go-pm will extract the precise details.
Present the agreed direction as a summary:
Direction: [chosen approach]
Scope: [single feature / decomposed into N features]
Domain impact: [new entities, modified aggregates, new events]
Risk: [main risk to watch for]Ask: "Ready to lock this into a spec with go-pm?"
If yes → return your summary to the user so they can invoke @go-pm with the validated direction as context. Do NOT invoke go-pm yourself — the user drives the pipeline entry points. If no → iterate on the approach.
| Thought | Reality |
|---|---|
| "This is too simple to brainstorm" | Simple features with unexamined assumptions cause the most rework |
| "User knows what they want" | Users know the problem. They may not know the best solution. |
| "Let's just start and iterate" | Iterating on the wrong foundation wastes the entire pipeline |
| "go-pm will catch missing details" | go-pm extracts details for a decided direction. It doesn't question the direction itself. |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.