research — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited research (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Clarify a research ask into an approved brief. This skill asks, writes brief.md and hands over. It does not plan, search or write the report; research:running-research does that once the brief is approved.
No authentication required. Writes one file to the local filesystem.
brief.md.Use the host platform's equivalent tools without changing the workflow:
| Capability | Claude Code | Codex |
|---|---|---|
| Ask a user | AskUserQuestion, or plain text | request_user_input if present, else text |
| File writes | Write, Edit | apply_patch or equivalent file edit tools |
| Shell | Bash | shell command tool |
Cursor: ask in plain text and write with its file edit tools.
The brief has these fields:
html unless the user asks for markdown.Fill each field the request already answers, in the user's own words. Do not ask about those.
For each empty field, ask one question, then wait for the answer before you ask the next. Never bundle several fields into one message. Offer choices where they fit (for example: "Who reads this: you alone, co-owners, or a client?"). Ask the highest-leverage fields first: purpose and deliverable shape the whole job.
When an answer opens a new gap (the purpose names a decision, but not by when), ask about that too. Stop when every field holds a real answer. "No deadline" is a real answer; an empty field is not.
The user may decline a question. Say once why that field changes the result and ask again. If they still decline, write the field as open (user skipped) and go on. When the user wants to skip all remaining questions, mark each empty field that way and go to Step 3. research:running-research makes those choices while it plans and lists them in plan.md.
Do not guess a field and do not fill one with a default the user never chose; open (user skipped) is the only stand-in. Two lines have defaults: the output path is reports/{topic-slug}-{YYYY-MM-DD}/ (the date from date +%F) and Format is html, each unless the user names another.
Create the folder with mkdir -p {OUTPUT_PATH} and write {OUTPUT_PATH}/brief.md:
# Research Brief
Status: draft
Topic: <topic>
Scope: <time, place, in and out>
Audience: <audience>
Purpose: <decision or use>
Deliverable: <form, length, language>
Format: <html | markdown>
Deadline: <date, or none>
Output path: <OUTPUT_PATH>If the folder is not writable, suggest another path and ask the user.
Show the user the full brief and ask them to approve it or change it. Wait for the answer. Apply each change to brief.md and show it again. Repeat until the user approves. An approval that carries a change ("approved, but add X") counts as approval: apply the change and show the changed line, without another round.
When the user approves, change the line Status: draft to Status: approved. research:running-research refuses a brief without that line.
Once the brief says Status: approved, invoke research:running-research yourself with the path to brief.md; the approval is the go. Only if the user says to run it later, give the path and stop.
This skill does not plan, search the web, dispatch researchers, or write plan.md, research notes or the report. Those belong to research:running-research, which reads the approved brief in its first step.
open (user skipped) as Step 2 says, write the brief and show it (Step 3 and Step 4).brief.md already sits at the path: show it and ask whether to reuse it, change it, or pick a new path.brief.md.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.