research-report — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited research-report (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Two-mode research workflow. Same engine, two output destinations.
Trigger on:
$workbench:research-report official <topic> — Codex official mode (files written, persistent)$workbench:research-report scan <topic> — Codex scan mode (chat reply only, ephemeral)/workbench:research <topic> — official mode (files written, persistent)/workbench:scan <topic> — scan mode (chat reply only, ephemeral)Skip when:
/workbench:research)Full pipeline: research, write notes, synthesize report, render HTML, open in browser.
End state: exactly two files in research/<umbrella>/<title>/:
notes.md — consolidated raw research dump (one file even if many sources covered)report.html — polished, designed, render-readyHidden in .build/ subdirectory: report.qmd source, quarto cache. Never visible to user.
/workbench:scan)No files. Replies in chat with structured markdown:
## Key findings
- Bullet 1 (the punchline, not the setup)
- Bullet 2
- Bullet 3
## Sources
- [Link with one-liner of why it's relevant]
- [Link with one-liner of why it's relevant]
## Caveats / what I didn't check
- Honest one-liner about gaps
---
*Want me to save this as an official research report? Reply yes and I'll promote.*If user confirms, transition to official mode using the same findings (write notes.md, synthesize report.qmd, render).
Final state, no exceptions:
<project-root>/research/<umbrella>/<title>/
notes.md ← single consolidated raw dump
report.html ← rendered polished read
.build/ ← hidden: qmd source, cache (gitignored)Title = lowercase-kebab-case slug from the topic. "Replaydeck Reddit Positioning" → replaydeck-reddit-positioning.
If the project has a .gitignore, ensure /research is in it. Add it if missing.
Pick the closest match. If two could fit, ask the user. If none fit, ask them to add a new one to this list.
| Umbrella | When to use |
|---|---|
marketing | Competitive analysis, positioning, channel research, audience mapping, launch planning |
uiux | UI patterns, design references, interaction studies, accessibility, design system research |
engineering | Library evaluation, architecture choices, build tooling, infra, framework comparison |
product | Feature scope, user needs, market sizing, pricing |
design | Brand, visual systems, typography, iconography, motion |
ml | Model evaluation, datasets, papers, benchmarks |
ops | Deployment, monitoring, performance, scaling, oncall |
legal | IP, licensing, ToS, compliance, GDPR |
competitive | Direct competitor deep-dives across categories |
research-meta | Fallback when no other category fits |
Run scripts/bootstrap.sh from this skill's directory. It checks for Quarto at ~/.local/share/quarto/bin/quarto and installs if missing. Skip silently if already installed.
Portability constraint — do not regress. The template attemplates/_quarto.ymlandtemplates/report.qmdboth setembed-resources: true. This is required: the renderedreport.htmlis a single self-contained file (CSS, JS, fonts, images all inlined as base64). Without this, Quarto producesreport.htmlplus a siblingreport_files/directory of assets — and the moment the user shares just the HTML over chat, email, or any single-file channel, every stylesheet and script 404s on the recipient's machine. If you ever modify the template format block, keepembed-resources: true. To verify after a render:grep -cE '(src|href)="https?://' report.htmlshould return0(or only return content links, not asset deps).
$ARGUMENTS when invoked through a Claude command, or from the user's current message when invoked in Codex or natural language.For each source, use the appropriate tool. Be exhaustive — depth before breadth. Capture:
If a Reddit MCP is available and the topic is Reddit-relevant: respect the 10 req/min rate limit (7-second pacing), sequential calls only, plan each call with a specific question.
When parallel reporter agents become available (Phase 2 of skill development), dispatch them here. For now, do the research inline.
Run scripts/new.sh <umbrella> <slug>. This:
research/<umbrella>/<slug>/.build/_quarto.yml, styles.scss, report.qmd) into .build/notes.md at the top level/research to project .gitignore if missingFill in notes.md with the structure:
# Research notes — <Topic Title>
> Raw data dump, blog format. Source for the polished report.
**Date:** YYYY-MM-DD
**Umbrella:** <umbrella>
**Sources covered:** <list>
---
## From <source 1>
[everything found from this source — links, quotes, raw data, screenshots referenced]
## From <source 2>
[same]
...One section per source. Be generous with raw data — this is the source of truth for the report.
Edit .build/report.qmd. The template provides:
Sections to populate, adapting to the topic:
.callout-tip with the one-line recommendation.stat-grid (the most important numbers).bar-chart for engagement/score comparisonsflowchart, gantt, graph) for flows and timelines.callout-warning / .callout-important for risks.callout-tip / .callout-note for opportunities<span class="badge badge-..."> for status labels (avoid/wait/medium/post/clean/blocked).methodology block with detailed query logDesign rules:
Run scripts/render.sh <umbrella> <slug>. This:
quarto render on .build/report.qmdresearch/<umbrella>/<slug>/report.html (top level of project)report.html in the default browserIf render fails, surface the error to the user with the relevant lines.
Skip Phases 3–5 entirely. Reply in chat with the structured markdown shown above. End with the promote prompt.
Use the current working directory's git root if present:
git rev-parse --show-toplevel 2>/dev/nullOtherwise use the current directory. If neither makes sense (e.g., in ~), ask the user where to save, or default to ~/research-reports/<umbrella>/<title>/.
If research/<umbrella>/<slug>/ already exists, ask: "This research project exists. Update it (re-render with new findings appended) or replace (start fresh)?"
For updates: append to notes.md under a new dated section, update report.qmd, re-render. For replaces: archive the old folder to .archive-<timestamp>/ first, then start fresh.
All assets live in this skill's directory:
skills/research-report/
templates/
_quarto.yml ← Quarto config (theme, TOC, layout)
styles.scss ← Typography, badges, bar-chart, callouts
report.qmd ← Section scaffolding for the report
scripts/
bootstrap.sh ← Verify/install Quarto
new.sh ← Scaffold a new research project folder
render.sh ← quarto render + open/research is gitignored automatically.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.