hyper-research — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited hyper-research (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Pre-implementation research gate. By default runs both the Codex research path and the Claude research path in parallel, producing two artifacts (.hyperclaude/research/<timestamp>-<slug>.md from Codex and .hyperclaude/research/<timestamp>-<slug>-claude.md from Claude) that share one frontmatter slug:; you read them and integrate findings into your next planning step. A single path runs only on explicit user request.
/hyperclaude:hyper-research <task>.Skip when:
--resume is not supported (deferred — research is not iterative).
Invocation argument: $ARGUMENTS
Two research paths exist (Codex and Claude). Pick by reading the user's intent — this is a plain-language rule, not a flag/token/$ARGUMENTS grammar:
/hyperclaude:hyper-research <task>, or any case not explicitly single-path) → both paths in parallel (Codex + Claude), producing two artifacts that share one slug.All cases first resolve the task description the same way:
This is the default. Run the Codex and Claude research paths concurrently so the two multi-minute operations overlap:
<slug> (Claude-path rule, step 1 below), and get <timestamp> once — these are shared by both artifacts.researcher agent with the Agent tool, subagent_type: hyperclaude:researcher, `run_in_background: true`, in return-body mode, using the same prompt contract as the Claude path step 4 below (Task verbatim + required section structure). Do not wait for it yet.node "${CLAUDE_PLUGIN_ROOT}/scripts/codex-bridge.mjs" research --task-file "<temp file path>" with timeout: 600000, clean up the temp file, parse the JSON line). This Bash call blocks for ~minutes — while it runs, the backgrounded researcher is working in parallel. The bridge writes .hyperclaude/research/<timestamp>-<slug>.md.{"ok":false,"error":"..."} — surface the Codex error to the user. Do NOT pretend the Codex artifact was produced. Then go to step 4 to collect the researcher; if it succeeded, write and report the Claude artifact as a PARTIAL result and continue using only it. If the researcher also failed or returned an empty body, report full failure to the user and stop.researcher agent was dispatched with run_in_background: true, the Agent tool returns a task handle immediately; the result is delivered as a completion notification. After the blocking bridge call returns, wait for / collect that researcher completion. If the researcher returned an error or an empty body — SKIP writing the Claude artifact, tell the user only the Codex artifact is available (or report full failure if Codex also failed in step 3), and continue using only what succeeded. Otherwise write the Claude artifact with the Write tool to .hyperclaude/research/<timestamp>-<slug>-claude.md using the SAME frontmatter block + one-liner as in Claude path (single — explicit request only) steps 5–6. The ONLY difference from the single-Claude case is the filename's -claude suffix; the frontmatter slug: stays <slug> (identical to the Codex artifact — this is the canonical trace key)..hyperclaude/plans/<timestamp>-<slug>.md so /hyperclaude:hyper-plan-review can find it later./tmp/hyperclaude-task-<unix-timestamp>.txt. Save the task as plain text; no escaping needed.timeout: 600000: node "${CLAUDE_PLUGIN_ROOT}/scripts/codex-bridge.mjs" research --task-file "<temp file path>" rm -f "<temp file path>"{"ok":true,"path":"..."} — read the file with the Read tool.{"ok":false,"error":"..."} — surface the error to the user; do not pretend research happened..hyperclaude/plans/<timestamp>-<slug>.md so /hyperclaude:hyper-plan-review can find it later.This path runs Claude-native research via the researcher agent. It uses WebFetch against KNOWN URLs only — it is not web-search parity with the Codex --search bridge mode. If the user needs broad live web search, route them to the Codex path instead.
<slug> from the resolved task with the same rule as hyper-plan: lowercase, ASCII only, alphanumerics + hyphen, first 5 words of the task joined by -. Example: "Add OAuth login to the API" → add-oauth-login-to-the.<timestamp> (UTC — matches the bridge's artifact filename convention): date -u +%Y%m%d-%H%M mkdir -p .hyperclaude/researchBase path: .hyperclaude/research/<timestamp>-<slug>-claude.md (the -claude suffix is how the Claude artifact coexists with the Codex one when both ran). If it exists, append -2, -3, … before the extension until free.
-claude — .hyperclaude/research/<timestamp>-claude.md (with the same -2/-3 collision suffixing) — and the frontmatter slug: line is the bare key with an empty value: slug: (key, colon, single space, nothing after — NOT slug: "").researcher agent with the Agent tool, subagent_type: hyperclaude:researcher, in return-body mode (the agent returns the report markdown; it does not write files). The prompt MUST include:### Prior Art, ### Pitfalls, ### Recommendations, ### Open Questions.cwd/git-head JSON-quoted the same way the bridge's renderer does): node -e 'const c=require("child_process");let h;try{h=c.execSync("git rev-parse HEAD").toString().trim();}catch(e){h="unknown";}console.log(JSON.stringify({generated:new Date().toISOString(),cwd:process.cwd(),gitHead:h}))'renderFrontmatter(), do NOT add Codex-only conditional keys like codex-thread-id, and do NOT author plugin-version — the PostToolUse stamp hook adds it after the write): ---
mode: research
task: |-
<task, each line 2-space indented>
slug: <slug>
generated: <generated ISO from the one-liner>
codex-version: claude
template-version: 1
cwd: <JSON-quoted cwd from the one-liner>
git-head: <JSON-quoted gitHead from the one-liner>
codex-resume-status: fresh
---
# Research: <task>
<researcher agent body verbatim>For the no-ASCII-slug fallback, the slug: line is the bare empty form described in step 3.
A research file has YAML frontmatter followed by markdown sections (Prior Art / Pitfalls / Recommendations / Open Questions). Do not modify the file.
The default (parallel) run produces a Codex + Claude pair: .hyperclaude/research/<timestamp>-<slug>.md (Codex) and .hyperclaude/research/<timestamp>-<slug>-claude.md (Claude). Both files carry an identical frontmatter `slug:` — that shared slug is the canonical trace key, not the filename. A single-path run produces only the one corresponding file.
Every research file has the same always-present frontmatter keys (mode, task, slug, generated, plugin-version, codex-version, template-version, cwd, git-head, codex-resume-status) and the same section structure. plugin-version is present on both, but by different means: the bridge writes it into the Codex artifact, while the Claude artifact gets it from the PostToolUse stamp hook post-write (so it lands as the first frontmatter key, not mid-block). The Codex artifact's codex-version is the Codex CLI version and it may add Codex-only conditional keys (e.g. codex-thread-id; codex-input-tokens, codex-cached-input-tokens, codex-output-tokens, codex-reasoning-output-tokens — each emitted independently when Codex reported that token field in usage); the Claude artifact's codex-version is claude and it omits those conditional keys. Downstream consumers match on frontmatter slug: and may find BOTH files of a pair.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.