Agent skill · Audited from source

Operator Scorecard

skill · aaronjmars/aeonMIT licenceAudited 14 Oct 2026 · source 0448e87653f9

★ 774pushed today
✓SAFEGrade B · 89/100 · 14 Oct 2026 · 0448e87
774repo stars · whole aaronjmars/aeon

Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit 0448e87653f9 and found no filesystem, network or shell access and no hard-coded secrets. What it does: Three recap modes - default synthesizes agent health, community growth, and economic activity into a was-it-worth-it verdict; ops recaps what shipped and failed; push ranks push impact.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “Operator Scorecard (aaronjmars/aeon)”. Retrieved 14 Oct 2026. https://modelsatlas.com/skills/aaronjmars/operator-scorecard

Trust audit

Audit 0.4.1 · source read 14 Oct 2026

Trust score89/100✓SAFE B
0 critical0 high0 medium0 low0 info

SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 13,985 of 14,816 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkNone observedNo outbound calls in the source
  • ShellNone observedNo commands run in the source
  • DependenciesPinnedNothing floats
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS0
L1 Static sourceSecrets, path traversal, supply chain, hidden codeNA0
L2 InstructionsPrompt injection, authority framing, hidden directivesPASS0
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (0)

No findings at any severity. We re-audit when the source changes.

Audit 0.4.1 · source sha 0448e87653f9 · 14 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publisheraaronjmars GitHub organizationOwner of the repository this skill is read from
  • Source folderaaronjmars/aeon/skills/operator-scorecardThe exact folder we audited
  • LicenceMITAs the repository states it
  • Commit pinned for this verdict0448e87653f9A new audit runs when the source changes
  • Repository statusNot archivedPushed today
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Three recap modes - default synthesizes agent health, community growth, and economic activity into a was-it-worth-it verdict; ops recaps what shipped and failed; push ranks push impact.

---
name: operator-scorecard
description: Three recap modes - default synthesizes agent health, community growth, and economic activity into a was-it-worth-it verdict; ops recaps what shipped and failed; push ranks push impact.
metadata:
  category: productivity
  var: ""
  tags:
    - meta
    - productivity
    - dev
---

> **${var}** — Mode selector. The first token picks the branch; the remainder is branch-specific.
> - **empty** → **operator scorecard** (default): synthesize the week into agent health + community growth + economic activity with a worst-of-three OK/WATCH/DEGRADED verdict. Also accepts `dry-run` (skip the notification — article + JSON spec still write) and/or an integer `N` to override the window in hours (default 168 = 7d, cap 720). Examples: `` , `dry-run`, `336`, `dry-run 336`.
> - **`ops`** → **ops recap**: operational summary of one day — what shipped, what failed, what needs follow-up. Optional date override after the keyword (`ops 2026-06-30` or `ops:2026-06-30`); empty date = today (UTC).
> - **`push`** → **push recap**: deep-dive recap of all pushes — reads diffs, ranks impact, separates user-visible shipments from internal work, delivers a verdict. Optional repo scope after the keyword (`push aeonfun/aeon` or `push:owner/repo`); empty = all watched repos.

<!-- merged: operator-scorecard (default branch, three-pillar synthesis) + ops-recap (`ops` branch, operational day-recap) + push-recap (`push` branch, diff-reading push deep-dive). Every distinct behaviour of all three is preserved below. -->

## Overview

One skill, three recap views over Aeon's own activity. They share a preamble (read memory, compute the date, parse the selector) then branch into fully distinct logic — do not blend them:

- **scorecard** (default): a **synthesis-only** weekly rollup. Every number it prints is sourced from a file another skill already wrote (`skill-health`'s analytics view, `heartbeat`, plus legacy `tweet-allocator` / `repo-pulse` articles when an instance still has them; both skills were retired, so those paragraphs degrade to "no data" on a fresh instance). Three paragraphs — agent health / community growth / economic activity — each with its own verdict, rolled up to a worst-of-three overall verdict. Answers the operator-level question: *given everything that happened, was this week worth it?*
- **ops** (`ops`): an **operational day-recap**. Reads today's activity log + `memory/cron-state.json` + the issues index, deduplicates repeat runs, demands a URL on every shipped item, surfaces the calls that need a human, and leads with a one-sentence TL;DR verdict. Never a log dump.
- **push** (`push`): a **diff-reading push deep-dive**. Fetches push events, commits, and merged PRs per watched repo, reads the diffs, classifies each commit user-visible vs internal vs infra, ranks by impact, and leads with a one-line verdict — with significance gating so quiet days send nothing.

## Shared preamble (run for every branch)

1. Read `memory/MEMORY.md` for high-level context and scan the last ~3 days of `memory/logs/` for recent activity — drop anything already reported so you don't re-report the same signal.
2. Compute `${today}` (UTC date, `YYYY-MM-DD`).
3. **Parse `${var}` → branch + branch argument** (trim whitespace first). Let `FIRST` be the lowercase first token (split on the first whitespace or `:`), `REST` the remainder:
   - `FIRST == "ops"` → `BRANCH=ops`, `ARG=REST` (a date override, or empty).
   - `FIRST == "push"` → `BRANCH=push`, `ARG=REST` (an `owner/repo` scope, or empty).
   - anything else (empty, `dry-run`, a bare integer, or an unrecognized token) → `BRANCH=scorecard`; pass the **whole** `${var}` through to the scorecard branch's own grammar (dry-run prefix + optional integer window).
4. Dispatch: run the matching branch below. Only that branch executes.

---

# Scorecard branch (default — empty / `dry-run` / integer window)

Today is ${today}. Synthesize the last 7 days of agent activity into a single plain-language scorecard the operator can read in 30 seconds. Three paragraphs (agent health / community growth / economic activity) plus a one-line verdict (OK / WATCH / DEGRADED). The point of this branch is to answer the question every operator quietly asks after a week of autonomous runs: **was this week worth it?**

## Why this exists

Every signal needed to answer that question already lives in the repo — `skill-health`'s analytics view ranks pass rates, `heartbeat` issues per-run verdicts, the retired `tweet-allocator` / `repo-pulse` skills used to total weekly $AEON spend and star/fork deltas (their past articles are still read when present). But each lives in its own article, on its own cadence, in its own format. A new operator (or a returning one) opens four files to assemble the weekly picture. This branch assembles it once on Monday morning and pushes it to the notification channel so the picture is delivered, not fetched.

It is deliberately a synthesis view, not a measurement view — every number it prints is sourced from a file another skill already wrote. It introduces zero new APIs, zero new secrets, zero new cron-state. If an upstream skill didn't run, the matching paragraph degrades gracefully ("no data this week") rather than fabricating numbers.

## Config

No new config. No new secrets. Reads:

- `output/articles/skill-analytics-*.md` — most recent file in window for fleet pass rate + anomaly count (written by `skill-health`'s analytics view — the former `skill-analytics` skill, now the analytics view of `skill-health`)
- `output/articles/heartbeat-*.md` (or `memory/logs/*.md` heartbeat sections) — P0–P3 verdict tally
- `output/articles/tweet-allocator-*.md` (legacy; the skill was retired, so usually absent) - weekly distributed totals + recipient counts
- `output/articles/repo-pulse-*.md` (legacy; the skill was retired, so usually absent) - daily star/fork delta entries summed across the window
- `memory/MEMORY.md` — last consolidation da

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 0448e87

Download folder ↗
git clone https://github.com/aaronjmars/aeon
git -C aeon checkout 0448e87653f9

The author documents no install command, so this uses the repository directly. Our verdict covers commit 0448e87653f9 only.

Works in

The author has not said which agents this skill supports, and we have not tested it in any.

Audit history

Every audit, every source change

  1. ✓SAFE B 89 / 100

    first audit · source 0448e87653f9

Similar skills

Questions about Operator Scorecard

What does the Operator Scorecard skill do?
The most autonomous AI agent framework: runs unattended on GitHub Actions, self-healing skills, drives Claude Code, Grok, Codex & more. No approval loops. Configure once, forget forever.
Is Operator Scorecard safe to install?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.
What can Operator Scorecard access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
How current is this page?
The grade is for one exact copy of the source (0448e87653f9), read on 2026-10-14. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.