DiscoverBLOCK
turns your codebase into an autoresearch loop — discovers what to measure, instruments the benchmark, then runs tree search with parallel subagents.
Overview
turns your codebase into an autoresearch loop — discovers what to measure, instruments the benchmark, then runs tree search with parallel subagents.
f8edbd9e89c5OBSERVED · 2026-10-12Host compatibility
What the documentation claims. We have not run a compatibility test.
| Host | Status | Notes |
|---|---|---|
| codex | mentioned | |
| openclaw | mentioned |
What it tells the agent
The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.
---
name: discover
description: Initialize evo for the current repository by exploring the codebase, proposing unexplored optimization dimensions, constructing the benchmark inside a baseline worktree, and running the first experiment. Use when the user invokes /evo:discover, mentions setting up evo, wants to instrument a codebase for autonomous optimization, or asks to start a new evo run on a project.
argument-hint: <optional context about what to optimize>
evo_version: 0.8.0
---
# Discover
Internal procedure for `evo:discover`. The user only sees the user-facing prompts, the dashboard URL, and the baseline score -- everything else is the agent's choreography.
## Evo surface
General guidance on the skills and tools available in evo. Each line is a triggering condition: if you're about to do X, pull/dispatch/read this. Don't preload -- act when the trigger fires.
**Always have a sense of the skill before jumping into its references.** A skill body carries the decision-making; references are concrete contracts that assume a decision has been made.
```
evo plugin
│
├── Main thread (the orchestrator -- you, inside /evo:discover or /evo:optimize)
│ │
│ ├── Skills (Skill tool)
│ │ ├── evo:discover starting a new evo workspace / instrumenting a project
│ │ ├── evo:optimize after discover commits the baseline -- drives the loop.
│ │ │ Args: subagents=N (read sizing-the-round FIRST),
│ │ │ autonomous, subagents-only, budget=N, stall=N
│ │ ├── evo:ship after the loop stops -- distills the best valid
│ │ │ experiment into a mergeable change (PR if remote,
│ │ │ else merge) + a mergeability report
│ │ ├── evo:finetuning task is finetuning / post-training / training a model
│ │ └── evo:infra-setup need a remote backend, pooled workspaces, lease/slot
│ │ management, or specific provider auth/setup
│ │
│ └── Subagents to dispatch (Task tool, subagent_type=...)
│ ├── evo:benchmark-reviewer before the baseline run, or whenever the
│ │ benchmark command / harness changes
│ └── evo:ideator stalled, or every ~5 committed experiments.
│ One subagent per brief:
│ failure_analysis, literature, frontier_extrapolation
│
├── Subagent thread (each subagent spawned by /optimize step 5)
│ │
│ ├── Skills (the subagent loads this on first turn -- the brief's first
│ │ sentence mandates it; not auto-loaded by the host)
│ │ └── evo:subagent load FIRST -- defines the iteration protocol
│ │ + brief field shape the subagent operates under
│ │
│ └── Subagents to dispatch (Task tool, subagent_type=...)
│ └── evo:verifier ALWAYS dispatch pre AND post every evo run.
│ Pre: ~30s static analysis before the experiment runs.
│ Post: result-validity audit after it commits.
│ Not optional. Not ad-hoc.
│
└── Key references (Read tool, on demand)
├── discover/references/
│ ├── constructing-benchmark.md designing + assembling a benchmark from scratch
│ ├── sdk_python.py / sdk_node.js wiring per-task instrumentation -- preferred path
│ ├── inline_instrumentation.py inline fallback when SDK can't be used.
│ │ Copy as-is; do not reimplement (file header
│ │ explains why)
│ ├── sizing-the-round.md BEFORE invoking /evo:optimize with any
│ │ specific subagents=N. Single-GPU /
│ │ single-exclusive-resource -> subagents=1
│ ├── proposing-dimensions.md choosing what to optimize when not obvious
│ └── instrumentation-contract.md the format evo reads (result + traces shapes)
│
├── finetuning/references/
│ ├── glue.md writing train.py -- I/O contract evo expects
│ ├── diagnostics.md per-failure-mode diagnostics
│ ├── false-progress.md what doesn't count as improvement
│ ├── trace-schema.md per-task trace JSON schema for training runs
│ ├── rl/ RL framework references
│ │ └── art.md ART (Algorithm-Refined Training)
│ ├── sft/ SFT framework references
│ │ └── tinker.md Tinker SFT
│ └── serving/ eval-time inference references
│ └── vllm.md vLLM serving config + LoRA-multi
│
├── infra-setup/references/
│ └── provider-matrix.md provider/backend summary (auth, setup, costs)
│
└── references/ (shared across skills)
├── evo-wait.md any time you need to wait without burning
│ context (subagent completion, training,
│ ideators, GPU activity, any long-running)
├── agent-sdk-reference.md SDK API surface
└── cli-quick-reference.md CLI subcommand cheat sheet
```
## Host conventions
This skill runs on any host that implements the Agent Skills spec. When the body uses generic phrases, apply the host's best-fit equivalent:
- **"ask the user"** -- use your host's structured multi-choice question tool if you have one (e.g. `AskUserQuestion`, `request_user_input`). If the host has none, phrase the question as plain text in your next reply and wait for the user's answer.
- **File paths like `references/...`** -- relative to this `SKILL.md`; resolve from the skill directory.
- **Slash cTrust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (3)
evo env load .env --all
evo env load .env --allow KEY1,KEY2
Dashboard live: http://127.0.0.1:8080 (pid 12345)
Gates applied: no_behavioural_pass.
f8edbd9e89c5full audit observations/trust-audit/skill/evo-hq__discover.json · Report an issue / request a re-scanAudit history
Every audit this skill has had.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | f8edbd9e89c5 | BLOCK | D | 69 | first audit |
Questions
What does the Discover skill do?
turns your codebase into an autoresearch loop — discovers what to measure, instruments the benchmark, then runs tree search with parallel subagents.
Is Discover safe to install?
No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What can Discover access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
Which assistants does Discover work with?
Its documentation mentions codex and openclaw. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (f8edbd9e89c5), read on 2026-10-12. The repository is watched, and a new audit runs when it changes — this is the first audit.