business-requirements-capture — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited business-requirements-capture (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Generate structured Business Requirements Documents from exploration session captures.
python ./scripts/execute.py \
--input <file> [<file2>...] \
--mode <brd|rules|constraints> \
--output <output_file.md>Modes:
brd (default): Full Business Requirements Document — functional/non-functional requirements, business rules, constraints, assumptions, success measures.rules: Business rules ledger only — decision logic, policy constraints, workflow conditions.constraints: Constraints and assumptions register only.Flags:
--input PATH [PATH ...] : Session brief, problem framing, BRD draft, or prior captures--output PATH : Destination file (default: exploration/captures/brd-draft.md)--mode MODE : Output scope (default: brd)When invoked interactively, follow this 3-stage pattern. Do not dump a full document at once.
Ask all three questions in a single message before reading or generating anything:
[UNCONFIRMED] source)(Check `exploration/` only if no inline input and no files named.)
brd — full Business Requirements Document (functional + non-functional requirements, business rules, constraints, assumptions, success measures)rules — business rules ledger only (decision logic, policy constraints, workflow conditions)constraints — constraints and assumptions register onlyAfter the user responds: read each input file they identify. Note any that are missing or incomplete.
Build iteratively — do not present a massive markdown dump.
[CONFIRMED] / [UNCONFIRMED] decision rule (apply throughout this stage):
[CONFIRMED] only when: the user explicitly stated it, OR it appears clearly in an input file.[UNCONFIRMED] when: you inferred it, extrapolated it, or the source is ambiguous.[UNCONFIRMED] and surface it for human sign-off.[UNCONFIRMED] items and any [NEEDS HUMAN INPUT] markers into a single ## Consolidated Gaps section at the end.Once all sections are drafted:
<example> Context: User has completed problem framing and wants a formal BRD. user: "Generate a BRD from our session captures." assistant: "I'll run business-requirements-capture in brd mode to scaffold a formal document from your captures." </example>
<example> Context: User wants only the business rules extracted. user: "Document the business rules we identified." assistant: "I'll use business-requirements-capture --mode rules to extract a business rules ledger." </example>
<example> Context: Pre-handoff review. user: "List all constraints and assumptions before we hand off to engineering." assistant: "I'll run business-requirements-capture --mode constraints to produce a constraints and assumptions register." </example>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.