Octocode Rfc GeneratorSAFE
Code research platform for AI agents; find, understand, and prove context across your code and all of GitHub, in a fraction of the tokens. One toolset, MCP or CLI
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
octocode-rfc-generator gives an agent the structure to turn research into a reviewable technical decision. It writes RFCs, design docs, migration plans, implementation plans, architecture proposals, and decision briefs before risky work begins.
Use it when the cost of being wrong is higher than the cost of writing the reasoning down.
The Problem
Complex changes fail when the decision lives only in chat. Alternatives disappear, assumptions go untested, rollout order becomes vibes, and rollback is discovered too late.
This skill makes the agent capture current-state evidence, compare viable options, explain tradeoffs, and produce a document another engineer can review or implement.
Capabilities
- Current-state evidence from local code, GitHub paths, PRs, commits, packages, or formal sources.
- Alternative comparison before recommendation, unless the user explicitly asks for a single plan.
- Decision language tied to constraints, evidence, tradeoffs, and non-goals.
- Risk, pre-mortem, unresolved-question, migration, rollout, and rollback sections.
- Implementation steps ordered by dependency rather than preference.
- Open questions closed with Octocode citations, not guesses.
- Success criteria and post-ship verification derived from the RFC's goals.
- Resources and references appendices for local refs, prior art, papers, packages, research artifacts, and search prompts.
- Saved RFC flow when the user wants a durable artifact in the repo.
Operating Model
The workflow is:
UNDERSTAND -> RESEARCH -> PREREQUISITES -> COMPARE -> WRITE -> CLOSE QUESTIONS -> KPI -> VALIDATE -> DELIVER
The agent first clarifies the decision and the evidence surfaces. It gathers proof with Octocode, compares options, writes the RFC, closes every open question with a citation, derives measurable success criteria, validates, then delivers in chat or as an approved repo artifact.
Output
On an approved save the skill writes a folder `\
acb65580ab4eOBSERVED · 2026-10-12Host compatibility
What the documentation claims. We have not run a compatibility test.
| Host | Status | Notes |
|---|---|---|
| codex | mentioned | |
| cursor | mentioned |
What it tells the agent
The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.
---
name: octocode-rfc-generator
description: "Use when a consequential change needs a decision before coding: write or improve an RFC, design doc, architecture proposal, migration plan, option comparison, rollout plan, or measurable implementation contract. If the idea is still open-ended, use octocode-brainstorming first."
---
# Octocode RFC Generator
Produce evidence-backed decisions that an implementer and reviewer can execute.
Flow: `UNDERSTAND → RESEARCH → PREREQUISITES → COMPARE → WRITE → CLOSE QUESTIONS → KPI → VALIDATE → DELIVER`.
For existing RFCs, run `REASSESS` (see `references/workflow.md` § Reassess existing RFCs) instead of WRITE — audit against live code, not prior checkboxes.
## Lobby rules
- Skip RFC mode for trivial edits. Ask one focused question when uncertainty changes shape, owner, scope, or decision criteria.
- Compare at least two alternatives, including do-nothing, unless the user explicitly requests one implementation plan.
- Recommendations require verifiable facts; cite exact anchors and commands/checks that actually ran.
- `RFC.md` owns goals, scope, and decision. Other files link to its anchors rather than restating them.
- Resolve every open question with evidence or an explicit deferral; no recommendation may rest on an uncertain claim.
- Order implementation by dependency, not estimates; bind requirements to acceptance and verification.
- Reviewing, rating, or cleaning up `.octocode/rfc/` (delete/implemented/fixed calls) always requires a dated `## Audit Reasoning` block written into the RFC itself, backed by fresh reads of the live code.
- Never assert RFC status from memory or from another RFC's claims.
- Stop when: the change is a trivial one-file edit (route to `octocode-research`); a brainstorming handoff is marked Prototype First, Narrow, Park, or not ready; uncertainty changes artifact shape, owner, scope, or tradeoff priority; two research attempts fail (state what is known and ask for direction); scope needs splitting into separate RFCs or phases; an unresolved blocker would have to be assumed satisfied; or a save, delete, or archive under `.octocode/rfc/` awaits explicit approval.
## Artifact route
- Small, reversible, single-package work: produce only `RFC.md` with plan, acceptance, and inline references.
- Otherwise, after save approval, create `<workspace>/.octocode/rfc/{name}/`: `RFC.md` (decide), `PREREQUISITES.md` (ready, existing code only), `IMPLEMENTATION.md` (build), `KPI.md` (verify), and `RESOURCES.md` (source appendix).
## Smart routes — load only what the current step needs
- To understand the ask and select a mode before drafting, load `references/workflow.md` — gates, claim ledger, artifact set, traceability, validation, and delivery order.
- When researching evidence, load `references/octocode.md` then `references/research-playbook.md` — delegate exact research and keep claims auditable.
- When existing code has readiness work, load `references/rfc-prerequisites.md` before planning — expose baselines, blockers, owners, and setup.
- When comparing options and writing the decision, load `references/rfc-template.md` — structure alternatives, goals/non-goals, reversibility, and pre-mortem.
- When building the execution plan, load `references/rfc-implementation.md` — close open questions, order dependencies, and define rollout/rollback.
- When defining acceptance and KPI targets, load `references/rfc-kpi.md` — connect user stories, metrics, decision rules, and verification in a traceability matrix.
- When preserving sources, load `references/rfc-resources.md` — record provenance without moving decisive citations out of the RFC.
- When you reassess, rate, or clean up an existing RFC, load `references/rfc-audit.md` — the dated `## Audit Reasoning` block, with live-code evidence, is required before any keep/fix/delete call.
- When improving this skill, prefer `octocode-graph-eval`; otherwise load `references/improve-loop.md` — enforce measurable accept/revert.
## Related routes and verification
- Use `octocode-brainstorming` before RFC when worth-building is unresolved; `octocode-research` to close factual questions; `octocode-graph-eval` for KPI rigor.
- Use `octocode-skills` when changing this skill folder.
- Before delivery validate the document contract section by section and report the real result.Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | NA |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (1)
packages/octocode-benchmark/compare/bin/octoc1811
Gates applied: no_behavioural_pass.
acb65580ab4efull audit observations/trust-audit/skill/bgauryy__octocode-rfc-generator.json · Report an issue / request a re-scanAudit history
Every audit this skill has had.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | acb65580ab4e | SAFE | B | 89 | first audit |
Questions
What does the Octocode Rfc Generator skill do?
Code research platform for AI agents; find, understand, and prove context across your code and all of GitHub, in a fraction of the tokens. One toolset, MCP or CLI
Is Octocode Rfc Generator safe to install?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.
What can Octocode Rfc Generator access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
Which assistants does Octocode Rfc Generator work with?
Its documentation mentions codex and cursor. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (acb65580ab4e), read on 2026-10-12. The repository is watched, and a new audit runs when it changes — this is the first audit.