sf-watch-topic — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sf-watch-topic (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
npm install -g @spfunctions/cli
sf loginWatch + alerts are user-scoped — requires auth.
watchlist (subject) → alert rule (condition) → webhook (delivery)
→ email / Telegram (optional)Each watch object can have multiple alert rules. Each rule can deliver to multiple endpoints.
If it's a URL (FRED series, news source, market URL), use identify:
sf watchlist identify --url https://fred.stlouisfed.org/series/UNRATE --jsonReturns a structured watch object (ticker if it's a market, series ID if it's FRED, raw URL otherwise).
If it's freeform text or a topic:
sf watchlist add --text "UNRATE unemployment rate latest release" --jsonIf it's a known ticker:
sf watchlist add --ticker KXRATECUT-26DEC31 --jsonCapture the returned watchId.
sf alerts create \
--watch-id <watchId> \
--condition "price > 75" \
--jsonCondition syntax (string-based, parsed server-side):
| Condition | Triggers when |
|---|---|
price > 75 | Market price crosses above 75¢ |
price < 25 | Market price crosses below 25¢ |
delta_24h > 5 | 24h price change >5¢ |
volume_ratio > 3 | Volume >3x baseline |
residual_vr > 2 | Volume residual >2σ from regime expectation |
fred_value > <n> | FRED series crosses threshold |
keyword_match "<phrase>" | News/social hit matches phrase |
Multiple conditions = OR semantics. For AND, use --all-conditions.
sf webhooks create \
--url https://your-app.com/sf-webhook \
--secret "your-hmac-secret" \
--jsonThe webhook secret is used for HMAC-SHA256 signature verification. SimpleFunctions sends:
X-SF-Signature: sha256=<hex>See <https://docs.simplefunctions.dev/build/webhooks> for verification code in TS/Python/Go.
sf alerts update <alertId> --webhook <webhookId>Or attach Telegram delivery:
sf alerts update <alertId> --telegram-chat <chatId>(Requires sf telegram link first — see sf-claude-code-setup for Telegram bot setup.)
sf watchlist list --json
sf alerts list --json
sf webhooks list --json
sf alerts deliveries --json --limit 10deliveries shows recent fires — useful to confirm the chain works end-to-end. Each delivery has status (delivered, failed, retrying) and attemptCount.
sf webhooks test <webhookId> --jsonSends a synthetic delivery to confirm your endpoint receives and verifies the signature.
If the watch is a natural-language research question instead of a structured condition:
sf monitor create "tell me if Iran sanctions news materially affects oil markets" --cadence 30m --jsonThis creates an LLM-driven loop that:
Use sf monitor list --json --limit 10 to see active research monitors.
If using the Plate desktop app:
sf plate status --jsonPlate subscribes to all your watch objects and alert rules automatically. No separate config needed.
sf watchlist identify first.sf alerts deliveries --json for the failure body. Often HMAC signature mismatch (verify secret) or 5xx from your endpoint.--cooldown 30m to suppress repeat alerts within 30 min.sf-research — find the topic to watch before setting upsf-inspect — verify a specific ticker before adding to watchlistsf-thesis-monitor — for thesis-linked monitoring (uses heartbeat instead)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.