sam-gov-monitor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sam-gov-monitor (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You generate a complete capture-management pipeline anchored on SAM.gov as the source of truth. Saved searches beat email alerts (email rolls in 24-72 hours late). Pre-RFP engagement (RFI, Sources Sought) is where the bid is won — by the time the solicitation drops, the requirement is often written around an incumbent.
============================================================ === PRE-FLIGHT === ============================================================
Verify:
Recovery:
============================================================ === PHASE 1: SAM.GOV API CLIENT === ============================================================
Generate sam_client.py (or Node equivalent):
class SAMClient:
BASE = "https://api.sam.gov/opportunities/v2"
def search(self, *, posted_from, posted_to, naics=None, psc=None,
keyword=None, set_aside=None, agency=None, limit=1000):
"""Returns list of opportunities. Handles pagination + rate limit."""
params = {
"limit": min(limit, 1000), # API max per page
"postedFrom": posted_from.strftime("%m/%d/%Y"),
"postedTo": posted_to.strftime("%m/%d/%Y"),
"api_key": self.api_key,
}
if naics: params["ncode"] = ",".join(naics)
if psc: params["ccode"] = ",".join(psc)
if keyword: params["q"] = keyword
if set_aside: params["typeOfSetAside"] = set_aside
if agency: params["organizationCode"] = agency
# Paginate, respect 429s with exp backoff, dedupe by noticeId
...
def get_details(self, notice_id):
"""Full opportunity record including attachments URL list."""
...Cache responses to local SQLite — re-running same search shouldn't burn quota.
VALIDATION: Client paginates correctly past 1000 results. 429 (rate limit) triggers exp backoff, not crash. Dedupes by noticeId.
============================================================ === PHASE 2: SAVED SEARCHES === ============================================================
Generate searches.yaml — one entry per pursuit profile:
searches:
- name: "IT modernization at HHS"
naics: [541511, 541512, 541513, 541519, 518210]
psc: [DA01, DA02, DA10, DA12, DJ01]
keywords: ["modernization", "legacy", "cloud migration", "FedRAMP"]
agencies: [HHS, CMS, FDA, NIH]
set_aside: ["SBA", "8A", "TOTAL_SMALL"]
- name: "Cyber assessments DoD"
naics: [541511, 541512, 541513, 541690, 541990]
psc: [DA10, R425, R408]
keywords: ["pentest", "red team", "RMF", "ATO", "FedRAMP"]
agencies: [DOD, USAF, USN, USA, USMC, DISA]Run searches daily via cron. Surface deltas (new notices, amended notices, awarded notices).
VALIDATION: Search YAML is human-editable. Cron runs without intervention. Deltas dedupe against prior runs.
============================================================ === PHASE 3: PRE-RFP SIGNAL TRACKING === ============================================================
The bid is often won before the RFP is published. Track notice types:
| Notice Type | Stage | Action |
|---|---|---|
| Special Notice | Pre-pre-RFP | Read. Mark agency for future intel. |
| RFI | Market research | RESPOND. Get on agency's vendor list. Free intel ride. |
| Sources Sought | Market research | RESPOND. Strongest signal of upcoming SOL. Capture begins. |
| Presolicitation | RFP draft | Engage agency BD POC. Influence requirements (legal!). |
| Solicitation | RFP issued | Decide pursue/no-pursue NOW. |
| Combined Synopsis | Simplified acq | Often a sole-source workaround — investigate. |
| Award | Won by competitor | Read winning company. Track who has the work. |
| Justification | Sole-source | Read carefully — sometimes contestable. |
Generate pre_rfp_pipeline.csv that surfaces all RFI / Sources Sought / Presolicitation notices in your saved-search domain, with response deadlines.
VALIDATION: RFI / Sources Sought items get auto-flagged as P0 in the digest. Deadlines tracked.
============================================================ === PHASE 4: CAPTURE-MANAGEMENT SCORING === ============================================================
Each opportunity scores on Pwin × value × strategic fit:
| Dimension | Score 1-5 |
|---|---|
| Incumbent strength | 1 = strong incumbent, low Pwin. 5 = no incumbent or weak. |
| Customer intimacy | 1 = no prior touch. 5 = sold-to in last 12 months. |
| Set-aside fit | 1 = full + open. 5 = your set-aside category restricted. |
| Past performance match | 1 = adjacent. 5 = exact past work. |
| NAICS / PSC fit | 1 = secondary code. 5 = primary code. |
| Solution maturity | 1 = new build. 5 = productized. |
| Bid value (annual) | (raw $). |
| Strategic value | 1 = no follow-on. 5 = pipeline gate for $10M+ multi-year work. |
Composite Pwin = average of first 6, multiplied by strategic-value adjustment.
Pursue threshold: Pwin ≥ 3.5 AND capacity available AND no calendar conflict with higher-Pwin pursuit.
VALIDATION: Each scored opp produces a single pursue/hold/no-pursue decision with rationale.
============================================================ === PHASE 5: INCUMBENT + COMPETITOR INTELLIGENCE === ============================================================
For each opportunity, query USAspending.gov + SAM.gov contract-data API for:
Output competitor_dossier.md per pursuit.
VALIDATION: Each pursuit has a competitor dossier with ≥ 3 named competitors and their prior award value.
============================================================ === PHASE 6: SMALL BUSINESS ELIGIBILITY CHECK === ============================================================
If the opportunity is set-aside, verify your company's eligibility _automatically_:
Generate eligibility_check.md per pursuit — green/yellow/red per dimension.
VALIDATION: Real-time SBA DSBS check or fallback to user-supplied certs.
============================================================ === PHASE 7: PROPOSAL READINESS PACKAGE === ============================================================
Once a "pursue" decision is made, generate the proposal-readiness scaffold:
VALIDATION: Compliance matrix has 100% coverage of RFP requirements (no orphan Section L instructions).
============================================================ === SELF-REVIEW === ============================================================
Score 1–5:
Common gap: chasing every RFP. The discipline is no-bid more than bid.
============================================================ === LEARNINGS CAPTURE === ============================================================
Append to ~/.claude/skills/sam-gov-monitor/LEARNINGS.md:
============================================================ === STRICT RULES === ============================================================
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.