Install
$ agentstack add skill-arasz-ai-badger-evidence-first-research ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Evidence-first research
Answer the question, and make how you know it inseparable from what you found.
Why this exists. A report where "the gate takes 75 seconds, measured" and "the gate takes about five minutes, roughly" look identical is a report that will eventually be quoted wrong. That happened here: a cost claim of "3-5 minutes per push, about an hour across fifteen pushes" reached a changelog and a PR body. Measured, it was 75 seconds and nineteen minutes — off by four times, and caught only because someone re-derived it by hand. Nothing in the format made the unmeasured number look unmeasured.
So every finding is graded, the grades are a closed set, and the renderer refuses a record that grades badly rather than producing a page that looks finished.
The four grades
| Grade | Means | Needs | |---|---|---| | MEASURED | You ran it and read the result | The command, the machine, the conditions | | READ | You read it in a source that is authoritative for this | path:line, a spec section, a doc URL | | INFERRED | You reasoned to it from things above | Say what from — reasoning is not a citation | | UNVERIFIED | You did not check | Nothing. Saying so is the finding |
MEASURED and READ are refused without an **Evidence:** line. UNVERIFIED is deliberately free: demanding a citation for "nobody looked" pushes writers to leave the gap silent instead, which is the failure this is built to prevent. Full rules in references/provenance.md — read it when grading or when a grade is disputed.
The grade is about you, not the claim. A true fact you did not check is UNVERIFIED. A number someone else measured and you copied is READ, not MEASURED — and if you cannot cite where you read it, it is INFERRED.
Steps
- Write the question down first, as one sentence, before looking anything up. A question that
changes shape mid-investigation produces findings that answer neither version.
- Investigate. Prefer running something over reading about it; prefer reading the source over
reasoning about it. Every time you drop a level, that is the grade.
- Write the record from
references/report-template.mdinto the project's dated-work
directory — /work/YYYY-MM-DD-.md, per the canonical tree. Grade every finding as you write it, not in a pass at the end: a grading pass is where "I think I measured that" happens.
- Render the view:
python3 .ai-badger/skills/evidence-first-research/scripts/render_report.py /work/YYYY-MM-DD-.md It writes to a temp directory and prints the path. It refuses a target inside the repository — the record is the artefact, and a committed HTML view becomes a second source of truth nobody can date.
- Read your own
## Still opensection before reporting. If it is empty, you either answered
everything or you stopped noticing. The second is more common.
- Report the grade mix, not just the conclusion. "Four findings, one measured" is a different
answer from "four findings, all measured", and the person acting on it needs to know which.
Charts
Declare one in the record with a fenced block; the renderer turns it into inline SVG. Five kinds, and an unknown kind is refused rather than skipped:
| Kind | For | Body | |---|---|---| | provenance | The grade mix | Automatic — always drawn, never declared | | bars | Comparing measured values | label: value per line | | line | A quantity across a sequence | label: v1,v2,v3 | | matrix | Options against criteria | Header row, then label, v, v | | range | A measurement's interval | label: low..measured..high |
``chart:range title: push seconds by change shape docs-only: 12..14..19 full: 68..75..91 ``
Prefer range to bars for anything timed. A single bar asserts a precision three runs will not support, and the spread is usually the interesting part.
Gotchas
No environment-specific gotchas known.
Red flags — STOP
- A number in the record with no grade on its finding
MEASUREDon something you read rather than ran- A benchmark without the machine and the conditions
- An empty
## Still openon a question that took more than an hour - Rendering the HTML into the repository, or committing it
- Reporting the conclusion without the grade mix
- A
barschart of timings, where the spread was never recorded
Verification checklist
- [ ] The question in the record is the question that was asked
- [ ] Every
MEASUREDfinding names the command and the conditions - [ ] Every
READfinding citespath:lineor a spec section - [ ] Every
INFERREDfinding says what it reasons from - [ ]
## Still openis non-empty, or its emptiness is defended - [ ] The renderer ran clean — it refuses badly graded records, so a clean run is a check
- [ ] The HTML is outside the repository and uncommitted
Files
references/provenance.md— what each grade means, what disqualifies one, worked examples. Read it when grading a finding, or when a grade is disputed.references/report-template.md— the record shape the renderer parses. **Read it when
writing the record (step 3).**
scripts/render_report.py— record → self-contained HTML. No network, inline SVG, no scripts.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: Arasz
- Source: Arasz/ai-badger
- License: MIT
- Homepage: https://github.com/Arasz/ai-badger
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.