grill-me-plus — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited grill-me-plus (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Interview the user relentlessly about every aspect of a plan, design, product idea, implementation approach, or architectural choice until there is shared understanding.
Walk the decision tree one branch at a time. Resolve dependencies between decisions in order. For each question, provide a recommended answer and concrete alternatives with trade-offs.
If a question can be answered by exploring the codebase, files, docs, or current implementation, inspect that context instead of asking.
Maintain a running internal ledger:
settled: decisions the user explicitly chose.implied: decisions that follow from earlier answers.open: branches still worth asking about.deferred: questions blocked by missing context, external constraints, or user choice.Before asking anything, check the ledger. Never re-ask a resolved or implied branch.
Use the best structured question tool exposed by the current agent harness:
AskUserQuestion.request_user_input when it is listed in the available tools for the current turn.Do not print fake tool JSON to the user. Either call the available tool or ask naturally in chat.
(Recommended).Other option when the tool already provides free-form custom answers.Use AskUserQuestion for every question when it is available.
Use the tool to its full capability:
multiSelect: true only when options can legitimately stack, such as feature support lists or acceptable constraints. Otherwise leave it false or omit it.preview, use it only for useful concrete snippets or examples. Never pass null; omit preview entirely when there is no meaningful preview.header short: Auth, DB, Scope, UI, Risk, API, Ship.Example shape:
{
"questions": [
{
"header": "Auth",
"question": "Which authentication direction should this plan assume?",
"multiSelect": false,
"options": [
{
"label": "OIDC (Recommended)",
"description": "Uses the existing identity provider and keeps authorization centralized."
},
{
"label": "Email magic",
"description": "Simpler for users, but adds email delivery dependency and weaker enterprise fit."
},
{
"label": "Password login",
"description": "Familiar and self-contained, but adds password storage and recovery surface area."
}
]
}
]
}Use request_user_input whenever it is listed in Codex's available tools for the current turn. If it is not available, ask in chat.
Codex has a stricter shape than Claude Code:
id in snake_case.header of 12 characters or fewer.question.label and one-sentence description. (Recommended).Other; the client adds free-form Other automatically.autoResolutionMs for grill-me decisions because these questions are usually blocking.autoResolutionMs only when the question is useful but non-blocking and the grill can continue with best judgment if the user does not answer.Example shape:
{
"questions": [
{
"header": "Data",
"id": "data_source",
"question": "Which data source should this design optimize around first?",
"options": [
{
"label": "Primary DB (Recommended)",
"description": "Keeps the first version aligned with current writes and avoids introducing sync state."
},
{
"label": "Search index",
"description": "Improves query flexibility, but makes freshness and rebuild behavior first-order concerns."
},
{
"label": "Event stream",
"description": "Fits audit-heavy workflows, but increases operational complexity before the base flow is proven."
}
]
}
]
}Because Codex options are mutually exclusive and capped at 3, convert multi-select topics into either a smaller mutually exclusive choice or a follow-up sequence.
When no structured tool is available, ask directly:
Auth: Which authentication direction should this plan assume?
1. OIDC (Recommended) - Uses the existing identity provider and keeps authorization centralized.
2. Email magic - Simpler for users, but adds email delivery dependency and weaker enterprise fit.
3. Password login - Familiar and self-contained, but adds password storage and recovery surface area.Then wait for the answer before continuing.
Stop when:
End with a compact summary of settled decisions, unresolved risks, and the recommended next action.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.