business-pulse-df96d6 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited business-pulse-df96d6 (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
One prompt, one page. Pull live data from every connected tool, synthesize it into a single scannable brief, and surface the single most important thing to act on today. Do the work — don't ask the user to help find the data.
Dispatch all connector calls in a single parallel batch — see reference/data_sources.md for the exact tool-to-metric mapping. Do not pull serially; latency turns a 30-second skill into a painful wait.
Connectors to attempt simultaneously:
If a connector errors or returns no data, record it internally and move on. Never block the pulse on a single bad integration.
QuickBooks fallback: if QBO returns an unexpected state (account not connected, sync pending, empty response), mark the Cash section "n/a — QuickBooks unavailable" and proceed. Do not retry or ask the user to reconnect.
Gmail fallback: Gmail auth is intermittently flaky. If the call errors, skip the Watch List section silently and note "Gmail unavailable" in the appendix — do not surface an error mid-pulse.
Read reference/thresholds.md for red/yellow/green cutoffs. Compute:
Assign a 🟢/🟡/🔴 status to each section. If a source returned nothing, mark the metric "n/a" and note it in the appendix.
Scan for actionable items. Every risk entry must name a specific record and a next step — "some overdue invoices" is useless; "$3,400 from Acme Corp, 47 days overdue, no response since Mar 12" is actionable.
Use the exact template in reference/output_template.md. Include only sections where real data exists — omit headers for connectors that weren't available. Adapt depth to context: a casual "how are we doing" gets a fuller report; "quick snapshot before a call" gets a tighter one.
Cross-connector synthesis is where this skill earns its keep. If a Slack message connects to a stalled HubSpot deal, surface that link in the #1 Priority section. Synthesis is what makes the pulse more useful than checking each tool separately.
Writing rules:
After presenting the pulse, offer once:
If they say yes, do it. If they say no or don't respond, move on — don't ask again.
The owner may ask for a narrower cut:
reference/data_sources.md — exact connector tool → metric mapping with fallbacksreference/thresholds.md — 🟢/🟡/🔴 cutoffs, tunable per ownerreference/output_template.md — exact markdown structure; do not deviatereference/gotchas.md — known failure modes (QB states, Gmail auth, Slack write)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.