universal-data-acquisition-pipeline — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited universal-data-acquisition-pipeline (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Act as the router for a data acquisition skill tree. Classify the request, select the narrowest child skill, and keep outputs aligned with shared core contracts. Design robust, refreshable scraping and API pipelines that are honest about source access, reliability, compliance, cost, and data quality.
Do not scrape immediately. First classify the source access, prove that a reliable data path exists, design a reusable pipeline, validate a small sample, and require approval before any full run.
For feasibility requests, do not stop at desk research when public probing is possible. Run a bounded pre-report probe ladder first, then generate the feasibility report from the observed evidence. Treat the probes as due diligence, not execution: 1 to 3 URLs, 20 rows maximum, no account pages, no CAPTCHA solving, no rate-limit bypass, and no broad collection.
Use the child skill that best matches the request:
data-acquisition-core: shared contracts, access classes, compliance, scorecards, output schemas, and pipeline quality standards.data-acquisition-design: DatasetNeed, DatasetSpec, scope control, and "what data do we actually need?"data-acquisition-feasibility: feasibility scoring, source comparison, Green/Yellow/Red decisions, and approval gates.data-acquisition-discovery: endpoint discovery, public APIs, GraphQL, XHR/fetch, sitemaps, embedded JSON, and pagination probes.data-acquisition-browser: Patchright warm-session cookie/storage generation, browser network capture, Playwright rendered DOM fallback, and authorized owned-session probes.data-acquisition-pipeline: production pipeline architecture, pipeline.yaml, raw/staged/normalized layers, quality gates, and run reports.data-acquisition-publish: probe-backed case studies and publishable/non-publishable result packaging.Select the narrowest useful mode from the user's request. Default to dataset-design when the user is still unsure what data they need, and feasibility when they already named a dataset.
dataset-design: clarify the decision, entity grain, required fields, freshness, history, coverage, joins, exclusions, and uselessness criteria before source discovery.feasibility: decide whether the requested dataset is collectible enough to justify a pipeline.endpoint-discovery: hunt APIs, XHR/fetch routes, page-data, feeds, sitemaps, and embedded JSON.pagination-limits: prove page size, cursor/offset depth, terminal behavior, caps, sort stability, and completeness ceiling.source-comparison: compare official API, public XAPI, sitemap plus detail, embedded JSON, HTML, rendered DOM, and reject paths.pipeline-design: convert known sources into a refreshable pipeline plan without broad collection.sample-validation: run tiny probes and validate rows, fields, parsing, and diagnostics.compliance-boundary: identify Green/Yellow/Red boundaries, stop conditions, and safer alternatives.owned-session: use a user-provided, user-owned authenticated browser/session only for data the user is authorized to access; mark outputs non-public.execution: collect only after explicit approval, with checkpoints, limits, validation, and incremental outputs.Every request must move through:
ModeSelectionSourceAccessClassDatasetNeedDatasetSpecSourcePlanEndpointPlanHeaderProfileProbeResultsFeasibilityScorecardDataAcquisitionMemoFeasibilityReportPipelineQualityPlanPipelinePlanSampleRowsApprovalGateNever return raw code alone. The user wants a decision and an engineering design: what access class applies, whether the data is collectible, how complete it can be, the cheapest reliable path, the trapdoors, the quality gates, and the repeatable pipeline design.
When mode is feasibility, source-comparison, pagination-limits, or sample-validation, run the narrowest safe probes before writing the report unless the user explicitly says "report only" or "do not browse/probe".
Default sequence:
Source boundary: fetch or inspect robots/sitemaps/public docs when available; identify disallowed, auth-only, and reject paths.Cold structured probe: try ordinary unauthenticated HTTP against one public seed URL and obvious public metadata files only; record status, redirects, schemas, and block pages.Static/embedded probe: inspect HTML for JSON-LD, canonical links, meta tags, embedded state, product/listing cards, and pagination clues.Browser fallback: if cold probes are blocked or incomplete and the data is visible in a normal browser, run a tiny browser probe using the data-acquisition-browser helper.Patchright visible fallback: if headless browser probing is blocked but a normal visible browser context is acceptable, run Patchright non-headless with a persistent local profile for 1 URL. Mark the source as owned_session/non_public_authorized_result if the pipeline depends on that local browser state.Page-only option: if the user asks for no API usage, use page-load DOM extraction only; do not discover, replay, or recommend API endpoints for execution.Stop: stop and score Red when progress would require CAPTCHA solving, fingerprint evasion, auth bypass, private data, or rate-limit bypass.The feasibility report must say which ladder steps were attempted, which succeeded, and which were intentionally not attempted.
Load only the shared core references needed for the request from skills/data-acquisition-core/references/, or delegate mentally to the matching child skill:
skills/data-acquisition-core/references/workflow.mdskills/data-acquisition-core/references/modes.mdskills/data-acquisition-core/references/source-access.mdskills/data-acquisition-core/references/pattern-library.mdskills/data-acquisition-core/references/endpoint-discovery.mdskills/data-acquisition-core/references/probing.mdskills/data-acquisition-core/references/playwright-rendered-dom.mdskills/data-acquisition-core/references/execution-adapters.mdskills/data-acquisition-core/references/pipeline-engineering.mdskills/data-acquisition-core/references/feasibility-scoring.mdskills/data-acquisition-core/references/compliance-boundaries.mdskills/data-acquisition-core/references/source-strategies.mdskills/data-acquisition-core/references/output-contracts.mdskills/data-acquisition-core/references/examples.mdowned-session or licensed_api, mark outputs non-public, avoid storing secrets, and require explicit approval.Always produce these sections unless the user explicitly asks for a narrower artifact:
DatasetSpecSourceAccessClassDatasetNeedSourcePlanEndpointPlanHeaderProfileProbeResultsFeasibilityScorecardDataAcquisitionMemoFeasibilityReportPipelineQualityPlanPipelinePlanSampleRowsApprovalGateFor implementation tasks, generated pipeline artifacts should include pipeline.yaml, report.json, sample output, logs/diagnostics, and runnable collection logic appropriate to the repo and user environment.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.