Skills parametric-scribe
📦

parametric-scribe

Content revision r1 Medium Risk ⚙️ External commands

Replay Coding History with Recipes

Coding agents usually lose the reasoning behind each step. Parametric Scribe records prompts, outputs, and SHAs so teams can replay or fork work.

Supports: Claude Codex Code(CC)
📊 69 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "parametric-scribe" from https://skillstore.io/skills/cycleaddict-parametric-scribe.md and its manifest at https://skillstore.io/api/skills/cycleaddict-parametric-scribe/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/cycleaddict-parametric-scribe.md Signed manifest GET /api/skills/cycleaddict-parametric-scribe/manifest Signed lockfile GET /api/skills/cycleaddict-parametric-scribe/lockfile

Test it

Using "parametric-scribe". User asks to record a completed authentication task.

Expected outcome:

The agent adds a recipe entry describing the intent, changed files, timestamp, and current commit reference.

Using "parametric-scribe". User asks to change Step 002 from Flask to FastAPI.

Expected outcome:

The agent reviews the recipe, asks for confirmation before changing git state, reruns the target step, and adapts later steps.

Using "parametric-scribe". User asks to create a variant for a different storage backend.

Expected outcome:

The agent copies the recipe into a variant file and changes only the selected path for comparison.

Security Audit

Medium Risk
v10 • 7/9/2026 Open versioned report

Most static findings are Markdown backtick false positives, not Ruby or shell execution. One real external command risk remains because the replay workflow instructs git checkout, and two semantic risks involve prompt retention and replaying recipe-sourced prompts.

3
Files scanned
88
Lines analyzed
1
Review items
0
False positives ignored

Confirmed security concerns (2)

Medium
SKILL.md:31-40
Untrusted Recipe Prompt Replay
The replay protocol reads original prompts from the recipe and executes adapted prompts. A tampered recipe file could steer the agent during replay.
The protocol directly reads recipe content and later executes adapted prompts from that history. The threat requires an untrusted or modified recipe file, so the confidence is moderate.
Low
SKILL.md:17-23
Sensitive Prompt Retention
The recipe format stores the exact prompt used for each step. If prompts contain secrets or private data, docs/recipe.yaml can retain sensitive information.
The documented YAML entry includes a prompt field that records the exact prompt. The risk depends on user content, so confidence is high for retention behavior but lower for actual exposure.
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
SKILL.md:33-39
Ruby/shell backtick execution
3. **Hard Reset:** `git checkout <Step X-1 SHA>` (Go back to the state *before* Step X).
Line 33 explicitly instructs the agent to run git checkout against a stored SHA. This external command can change repository state and should require clean-worktree checks and user confirmation.

Risk Factors

⚙️ External commands (9)
SKILL.md:10 SKILL.md:15 SKILL.md:17-24 SKILL.md:24-31 SKILL.md:31-33 SKILL.md:33-39 SKILL.md:39 SKILL.md:41-46 SKILL.md:46
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/cycleaddict-parametric-scribe/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/cycleaddict-parametric-scribe/security.svg)](https://skillstore.io/skills/cycleaddict-parametric-scribe?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/cycleaddict-parametric-scribe?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cycleaddict-parametric-scribe/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/cycleaddict-parametric-scribe.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

Cycleaddict. (2026). parametric-scribe security audit report (audit version 10) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cycleaddict-parametric-scribe/audits/10

BibTeX citation

@techreport{cycleaddict-cycleaddict-parametric-scribe-2026, author = {Cycleaddict}, title = {parametric-scribe security audit report (audit version 10)}, institution = {Skillstore}, year = {2026}, number = {10}, url = {https://skillstore.io/skills/cycleaddict-parametric-scribe/audits/10}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "parametric-scribe security audit report (audit version 10)" version: "unspecified" type: report authors: - name: "Cycleaddict" date-released: "2026-07-09" url: "https://skillstore.io/skills/cycleaddict-parametric-scribe/audits/10" identifiers: - type: other value: "skillstore:cycleaddict-parametric-scribe:audit:10" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High
55
Architecture
85
Maintainability
87
Content
71
Community
83
Spec Compliance

What You Can Build

Prototype Direction Changes

Replay an early framework or architecture decision and adapt later work instead of rebuilding from scratch.

Review Agent Workflows

Inspect prompts, outputs, and SHAs for each coding step during team review.

Create Feature Variants

Fork a recipe to test a different implementation path while preserving the original history.

Try These Prompts

Start a Recipe 
Read parametric-scribe/SKILL.md. After each coding task, update docs/recipe.yaml with the step intent, files changed, and current git SHA.
Record a Completed Task 
Record the completed task as the next recipe step. Include the intent, the user prompt, changed files, timestamp, and current commit reference.
Replay an Earlier Step 
Replay from Step [number] with this new prompt: [new direction]. Before checkout, confirm the branch, clean working tree, and target SHA.
Fork a Variant Safely 
Create a variant recipe for Step [number]. Keep the original recipe unchanged, apply this alternate prompt, and summarize changed downstream steps.

Best Practices

  • Review the recipe after important tasks to keep intent and outputs accurate.
  • Confirm a clean working tree before any replay or checkout action.
  • Redact secrets from prompts before storing or sharing the recipe.

Avoid

  • Running replay commands without user confirmation.
  • Treating recipe prompts from unknown repositories as trusted instructions.
  • Storing API keys, credentials, or private customer data in recorded prompts.

Frequently Asked Questions

Does this skill run code by itself?
No. It provides workflow instructions for an AI coding agent to follow.
What file does it maintain?
It maintains docs/recipe.yaml as the source of truth for step history.
Can it work with Claude, Codex, and Claude Code?
Yes. The marketplace metadata lists Claude, Codex, and Claude Code as supported tools.
Does it replace Git?
No. It depends on Git SHAs to identify earlier project states.
What should I check before replay?
Check the current branch, confirm a clean working tree, and verify the target SHA.
Is it safe for sensitive prompts?
Use caution. The recipe can store exact prompts, so redact secrets before saving or sharing it.

Developer Details

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/Cycleaddict/parametric-scribe/tree/main/

Ref

0519034dad657fb1f7706e0550e962beeda73fdf

Maintenance freshness

7/20/2026

Usage

3 downloads · 235 views

File structure

📁 examples/

📄 recipe.yaml

📄 README.md

📄 SKILL.md