ultra-research — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ultra-research (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
$SKILL_DIR is this skill's directory. The Python helper is scripts/vault.py; prompts are in prompts/. Read each prompt when you reach its stage.
Prefer plain claudex:deep-research by default. Use ultra-research only when: the question is high-stakes (policy/financial/factual gravity); the user explicitly asks for dual-model or cross-verified research; or a prior deep-research run on the topic returned mixed/unreliable citation integrity.
clarifying questions, then proceed; else state one interpretation and proceed. Never block mid-run after this point.
VAULT="$(python3 "$SKILL_DIR/scripts/vault.py" vaultpath)"
REFINED_QUESTION="$(cat <<'EOF'
<refined question>
EOF
)"
RUN="$(python3 "$SKILL_DIR/scripts/vault.py" runid --date "$(date +%F)" --question "$REFINED_QUESTION")"
RUNDIR="$VAULT/$RUN"
mkdir -p "$RUNDIR"The question must be passed as one safely quoted shell argument; do not inline it inside double quotes where embedded quotes can break the command.
Agent(subagent_type: codex:codex-rescue) with thetext of prompts/codex-research.md, placeholders filled, including --write and the absolute target $RUNDIR/20-report-codex.md. Prefer background.
claudex:deep-research yourself on the same refinedquestion. When it finishes, write its verified report to $RUNDIR/10-report-claude.md with the report frontmatter (author-model: claude, note-type: report, degraded: false, tags: [ultra-research, report]).
per-stage timeout via the helper (handles scalar or object codexTimeoutMs):
# Stage-1 research default: 20 min (1,200,000 ms) unless config overrides it.
DEADLINE=$(( $(date +%s%3N) + $(python3 "$SKILL_DIR/scripts/vault.py" timeout --stage research) ))
until python3 "$SKILL_DIR/scripts/vault.py" ready "$RUNDIR/20-report-codex.md"; do
[ "$(date +%s%3N)" -ge "$DEADLINE" ] && break
sleep 10
done
if ! python3 "$SKILL_DIR/scripts/vault.py" ready "$RUNDIR/20-report-codex.md"; then
# Execute DEGRADED branch A.
fiIf the post-loop ready check fails → DEGRADED branch A (below).
Each report is audited by the OTHER model; auditors are blind to each other.
codex:codex-rescue --write withthe prompts/audit.md contract + the absolute path $RUNDIR/10-report-claude.md, writing $RUNDIR/30-audit-of-claude-by-codex.md (author-model: codex, audited-report-model: claude).
Task (general-purpose)subagent and explicitly instruct it to use WebFetch for every cited URL. Give it the prompts/audit.md contract assembled inline and the path $RUNDIR/20-report-codex.md; it writes $RUNDIR/31-audit-of-codex-by-claude.md (author-model: claude, audited-report-model: codex). Joined by the subagent's return.
Stage-2 audit timeout (default 10 min):
DEADLINE=$(( $(date +%s%3N) + $(python3 "$SKILL_DIR/scripts/vault.py" timeout --stage audit) ))
until python3 "$SKILL_DIR/scripts/vault.py" ready "$RUNDIR/30-audit-of-claude-by-codex.md"; do
[ "$(date +%s%3N)" -ge "$DEADLINE" ] && break
sleep 10
done
if ! python3 "$SKILL_DIR/scripts/vault.py" ready "$RUNDIR/30-audit-of-claude-by-codex.md"; then
# Execute DEGRADED branch B.
fiIf the post-loop ready check fails → DEGRADED branch B.
Dispatch codex:codex-rescue --write with prompts/final-synthesis.md, the four absolute paths filled in. It writes $RUNDIR/90-final-report.md and prints a bullet summary to stdout.
DEADLINE=$(( $(date +%s%3N) + $(python3 "$SKILL_DIR/scripts/vault.py" timeout --stage synthesis) ))
until python3 "$SKILL_DIR/scripts/vault.py" ready "$RUNDIR/90-final-report.md"; do
[ "$(date +%s%3N)" -ge "$DEADLINE" ] && break
sleep 10
done
if ! python3 "$SKILL_DIR/scripts/vault.py" ready "$RUNDIR/90-final-report.md"; then
# Execute DEGRADED branch C.
fiIf the post-loop ready check fails → DEGRADED branch C.
$RUNDIR/00-index.md from prompts/index.md. Read audit verdicts forthe status table with:
python3 "$SKILL_DIR/scripts/vault.py" get "$RUNDIR/30-audit-of-claude-by-codex.md" trust-verdict
python3 "$SKILL_DIR/scripts/vault.py" get "$RUNDIR/30-audit-of-claude-by-codex.md" trust-score
python3 "$SKILL_DIR/scripts/vault.py" get "$RUNDIR/31-audit-of-codex-by-claude.md" trust-verdict
python3 "$SKILL_DIR/scripts/vault.py" get "$RUNDIR/31-audit-of-codex-by-claude.md" trust-scorepath $RUNDIR.
Degraded notes get degraded: true in frontmatter AND a first-line banner: > **⚠️ DEGRADED — single-model run; adversarial cross-audit merit absent.**
deep-research report (already deterministically verified). Optionally attach a Claude self-audit ONLY if labeled self-audit — NOT adversarial; equivalent to plain deep-research integrity. Write a degraded 90-final-report.md and a degraded 00-index.md.
that direction) AND self-audits its own report under the explicit self-audit — NOT adversarial; equivalent to plain deep-research integrity label; proceed to Stage 3; mark the run partially degraded.
90-final-report.md from the fourinputs using the Stage-3 merge algorithm; set both author-model: claude and synthesized-by: claude. Not full DEGRADED (all four inputs exist) — just note the synthesis fallback.
report; the cross-audit is an ADDITIONAL adversarial layer.
self-audit, which never counts as adversarial merit).
90-final-report.md file — not any stdout — is the canonical final report.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.