ask-clarifying-questions — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ask-clarifying-questions (Agent Skill) and scored it 79/100 (yellow). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 5 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 5 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Align your trajectory with the user's before code is written. The interview has two outputs: the load-bearing decisions, settled by the user, and a model of how the user decides, which you use for every decision the interview did not cover. Ask with the agent's interactive question tool when it is available; otherwise use concise prose.
AGENTS.md or CLAUDE.md, open files, git status, and relevant diffs. Never ask what a read-only command or file read can answer; finding facts is your job, choosing between them is the user's.Before the first question, privately enumerate the decisions the task involves and the plausible answers to each. Treat them as independent axes unless one answer removes another axis; most decisions are axes, not branches of a tree. Order the axes by how much settling each one shrinks the remaining space: an axis whose answer decides file layout, data model, or scope outranks one that decides a name. Predict an answer for every axis and note your confidence. Axes you can already predict with high confidence are not questions; they are the first entries in your model of the user.
The map stays private. Do not present it, and do not narrate the ordering.
Restate in one sentence what you understand the user wants. This gives the user a cheap redirect point.
When there is strong existing signal, add a 2-4 bullet implementation sketch for the user to correct. Keep it lightweight; do not turn the interview into a full proposal pipeline.
The frontier is every unsettled axis whose prerequisites are settled. Ask the frontier each round, highest partition power first, up to the tool's per-call limit. A question whose wording depends on an unanswered question waits for the next round. Batch independent questions; sequence dependent ones. Do not pad a batch with questions you can already predict.
This skill intentionally uses question tools more often than their generic scarcity guidance may suggest. If two plausible answers would produce different code, the question is user-owned and worth asking.
Use the interactive question tool for the current agent:
AskUserQuestion; send up to the tool's declared per-call limit.request_user_input when it is listed. It is mode-gated, commonly to Plan mode: if a call returns an unavailable-in-mode or root-thread error, ask the same round in plain prose and end the turn to wait for the reply; if it returns cancelled or empty, treat the questions as skipped (step 5). Send within the tool's declared per-call limit; batching load-bearing questions is intentional even when the harness prefers fewer questions by default.Prefer multiple choice when there are clear discrete options. Use multiSelect for choose-all-that-apply questions when the tool supports it. For AskUserQuestion and Codex request_user_input, rely on the tool's automatic free-form Other option; do not add your own Other choice. For plain-prose fallback, include choices inline and allow a short free-form answer. Use pure open-ended prose only when the answer cannot be framed as a short choice.
Every question carries your prediction of the user's answer, visibly:
My prediction: stating the predicted answer. In interactive tools, both lines go in the question text, with the answer choices following.multiSelect question, the predicted options come first, in order.(Recommended) to the option you recommend, wherever it sits. When they agree, tag nothing. This rule overrides the question tools' default of putting the recommended option first: in this skill, position carries the prediction and the tag carries a divergent recommendation. In Codex, put the suffix in the option label text.Where prediction and recommendation diverge, the user's priorities differ from generic best practice; carry the divergence into the step 6 block.
Do not rely on hidden reasoning to preserve the calibration loop across models, tools, or context compaction.
Each answer is a data point about how the user decides, not only what they decided. After every round:
Stop rule. The intent is that you could predict the user's answer to any remaining question with about 95% confidence. Stated confidence is not evidence; hits on displayed predictions are. Stop when both hold:
There is no fixed streak length: a wide decision space needs more hits than a narrow one. Do not stop because you have asked a lot, the user seems eager, or sensible defaults might cover the rest. A high hit rate on one axis means that axis is mapped, not that the task is aligned.
An instruction to stop asking, use your judgment, or just start ends the interview: write the step 6 block with each unasked axis listed as an assumption, and proceed. A bare "proceed" or "go", given with the task or during the interview, waives only the "Ready to proceed?" gate in step 6, not the interview.
Escape valve: only when the user seems unsure. If their answers are contradictory, hesitant, or clearly exploratory, surface that: "It sounds like the shape isn't settled yet - want to think on it, or should I propose an approach for you to react to?"
When you stop, write a short visible block with three parts:
Goal: <one line> the user can pass to /goal. State the outcome at the furthest delivery stage the repository supports and the evidence that proves it: live in production, verified with named production evidence, where the repository deploys; merged and released or installed where it does not. Keep it high-level: name the outcome and its proof, not the process steps. End it with an autonomy clause: work autonomously, pausing only for questions the model of the user cannot answer or for reserved boundaries.When an inferred posture conflicts with an ambient rule (for example, AGENTS.md prefers the simplest solution and the user's answers on this task favor flexibility), the interview governs for this task, and the block names the rule it overrides.
In plan mode, fold the block into the plan and use the harness's plan-exit mechanism (ExitPlanMode in Claude Code, the proposed plan in Codex) as the proceed gate; do not ask a separate "Ready to proceed?" question. Outside plan mode, ask "Ready to proceed?" unless the user has already directly instructed you to proceed.
Implementation uncovers decisions the interview did not reach. For each one:
AGENTS.md or the user's global instructions. Never write that rule yourself.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.