grill-me-0a2235 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited grill-me-0a2235 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Interview the user relentlessly about every aspect of a plan, design, or approach until shared understanding lands. Walk down each branch of the design tree, resolving dependencies between decisions one-by-one. For every question, supply your recommended answer + the rationale + what changes if the opposite is chosen.
See [README.md](README.md) for the credit (Matt Pocock's original `grill-me`) and install / use instructions.
The default agent mode is execute the user's stated request. That's the wrong mode when the request itself is underspecified — and in real engineering, underspecification is the norm. grill-me flips the polarity: before you start, you act as a peer engineer who would push back on a colleague handing you the same brief.
Concretely:
Fire on:
/grill-me.Do NOT fire on:
1. Current understanding — one paragraph restating the target.
2. Resolved-by-exploration — anything you answered from the code / docs.
3. Open questions — one section per question, each with: why it matters, your recommendation, what changes if the opposite.
4. Decision summary OR blockers — either a clean tree (everything resolved) or a list of items still blocking implementation.The goal is not to admire the plan. The goal is to make it hard to ship something underspecified.
| Bad grill question | Good grill question |
|---|---|
| "Should we use Postgres or MySQL?" | "You picked Postgres — is that for JSONB usage, or just defaults? If just defaults, MySQL would let us reuse the existing replication setup. Recommend: stay on Postgres if we're using JSONB; otherwise reconsider." |
| "Have you thought about testing?" | "The acceptance criterion says 'works correctly under load' — what counts as load (req/s, p95 target)? Without a number, the test plan is unfalsifiable. Recommend: 50 req/s sustained, p95 < 200ms. Changes if higher: we need a queue, not just a route handler." |
| "Any edge cases?" | "What happens if the webhook fires twice for the same event? Recommend: idempotency key on event_id, drop duplicates silently. Without it, we double-charge users on every Stripe retry — that's the failure mode I'm trying to surface." |
| "How will users interact with this?" | "The flow has two entry points (dashboard and email link) — does the email link bypass auth, or does it land on the login page first? Recommend: land on login, then deep-link. Changes if bypass: we need a signed token in the URL and a TTL." |
The pattern: name the specific decision, give a concrete recommendation, expose the consequence of the alternative.
| Artifact | When |
|---|---|
srs-documentation | Grill before writing the SRS, so the spec captures resolved decisions instead of papering over uncertainty. |
srs-to-delivery-plan | Grill the SRS itself before slicing into stories — story shape depends on which decisions are resolved. |
sprint-execution-protocol | The protocol escalates to grill-me when a task's confidence score is < 90%. |
pair-agent-harness | Use grill-me on yourself before opening a peer-review thread — surface your own gaps before the peer does. |
grill-me-codex is a longer workflow-driven cousin that adds an explicit "Workflow / Rules / Output Shape" structure. Pick whichever variant fits — they both register as /grill-me if installed under that folder name.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.