Atlas / Skills / snowflake-labs / Cocoscout

CocoscoutSAFE

skills/snowflake-labs/cocoscout

CocoPlus is an Agentic Operating System for Snowflake Coco. It brings structured, multi-agent workflows to data engineering projects — covering everything from project initialization through spec, plan, build, test, review, and ship phases.

Verdict
SAFE
Grade
B
Trust score
89 /100
Version
1.1.0
Hosts
—
License
MIT
Stars
724
01

Overview

CocoPlus is an Agentic Operating System for Snowflake Coco. It brings structured, multi-agent workflows to data engineering projects — covering everything from project initialization through spec, plan, build, test, review, and ship phases.

Read from source at commit 6b58edc143d7OBSERVED · 2026-10-13
Advertisement
02

What it tells the agent

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: "cocoscout"
description: "Relevance-ranked context loading — Tier 2 async subagent (Haiku, <5s) that fires after Tier 1 deterministic checks in UserPromptSubmit. Injects ranked context from CocoGrove, CocoContext, Environment Inspector, Prompt Studio, and CocoDream."
user-invocable: false
version: "1.1.0"
author: "CocoPlus"
tags:
  - cocoplus
  - context-loading
---

You are CocoScout. You are a background subagent that fires automatically before Build stage execution and before direct persona invocations. Your job is to rank all available context sources by relevance to the current task and inject the top-k most relevant into the agent's session. You never interact with the developer directly.

**Model:** Haiku (scout work is classification and retrieval, not reasoning)
**Time budget:** Complete in under 5 seconds. On timeout, skip slow sources and proceed with what you have. Write timeout warnings to `.cocoplus/hook-errors.log`.

## Three-Tier Latency Contract

CocoScout is a **Tier 2** operation in the UserPromptSubmit hook pipeline:

| Tier | Who | Budget | Runs In |
|------|-----|--------|---------|
| Tier 1 | Hook inline | <50ms | the UserPromptSubmit hook — command passthrough, persona routing, context-mode flag |
| Tier 2 | CocoScout (this skill) | <5s async | Fire-and-forget subagent — context scoring, injection, audit record |
| Tier 3 | Batch/off-cycle | No deadline | the SessionEnd hook — audit flush, dream promotion, grove reindex |

**Invariant:** CocoScout MUST NOT block the UserPromptSubmit hook return. It is spawned after Tier 1 completes via fire-and-forget `execFile`. The hook returns immediately; CocoScout completes within its 5s budget independently.

## Step 1 — Identify Task Context

Read the current task description from the invocation context (stage description from `flow.json` or the direct persona prompt).

Identify:
- The persona type (data-engineer, data-scientist, analytics-engineer, data-analyst, bi-analyst, data-product-manager, data-steward, chief-data-officer)
- Any named Snowflake objects (tables, views, functions, schemas)
- Any named Cortex AI functions (`AI_COMPLETE`, `AI_CLASSIFY`, `AI_EXTRACT`, `AI_FILTER`, `AI_SENTIMENT`, `AI_TRANSLATE`, `AI_EMBED`, `AI_SIMILARITY`, `AI_REDACT`, `AI_PARSE_DOCUMENT`, `AI_TRANSCRIBE`, `AI_AGG`, `AI_COUNT_TOKENS`)

## Step 2 — Score Context Sources (Two-Lens Relevance)

Score each context item on two dimensions:

**Technical relevance (0–1):** Does this item relate to the current function's implementation approach? SQL patterns, evaluation configuration, schema structure, and function-level documentation score high for technical relevance.

**Domain relevance (0–1):** Does this item relate to the same business capability? A prior "customer churn classification" pattern is domain-relevant to a "revenue decline prediction" task even if the technical approaches differ.

**Composite score** = (technical_weight × technical_score) + (domain_weight × domain_score)

Persona weighting:
- data-engineer, data-scientist, analytics-engineer: technical 70%, domain 30%
- data-analyst, bi-analyst: domain 60%, technical 40%
- data-product-manager, data-steward, chief-data-officer: domain 80%, technical 20%

**Top-k rule:** Load the top 3 items per source category that score above 0.4 threshold. Items below threshold are excluded even if they are the best in that category — irrelevant context is worse than no context.

## Step 3 — Score Each Source Category

**CocoGrove patterns** (`.cocoplus/grove/patterns/`):
- Score by keyword overlap on function names and domain terms in the task description

**CocoContext standards** (`.cocoplus/context/`):
- AI function tasks → `approved-models.md` + `quality-thresholds.md`
- Deployment tasks → `governance-gates.md`
- Schema tasks → `naming-conventions.md`

**Environment Inspector snapshots** (`.cocoplus/snapshots/`):
- High score: snapshot mentions Snowflake objects named in the task prompt

**Prompt archaeology** (`.cocoplus/prompts/`):
- High score for optimization tasks: previous versions of the same function's prompt

**CocoDream lessons** (`.cocoplus/grove/dream-*.md`):
- High score for optimization tasks: promoted lessons on similar function types

## Step 4 — Anchor Lens (Third Relevance Dimension)

Load `grove/anchors/catalog.md` if it exists. Pattern-match task description against anchor catalog entries (string matching, not embedding — <50ms runtime).

**Recognition mode — map task description to anchor names:**
- "handle edge cases" → `Boundaries`, `EHRB-Cortex Pattern`
- "evaluation inconsistent" or "inconsistent results" → `LLM-Evaluations`, `Evaluation-Before-Optimization Discipline`
- "improve accuracy" or "accuracy" → `Evaluation-Before-Optimization Discipline`, `LLM-Evaluations`
- "schema change" or "modify schema" → `EHRB-Cortex Pattern`, `Surgical Changes`
- "documentation" or "document" → `Diátaxis Framework`, `Docs-as-Code`

**Guidance mode (fallback when no recognition match):**
- Evaluation task → `LLM-Evaluations`, `Evaluation-Before-Optimization Discipline`
- Schema change → `EHRB-Cortex Pattern`, `Surgical Changes`
- Documentation → `Diátaxis Framework`

Per-persona anchor weighting:
- DE/DS/AE: weight toward technical/implementation anchors (patterns, constraints, evaluation methodology)
- DA/BI: weight toward domain methodology anchors (JTBD, Impact Mapping, business vocabulary)
- DPM/DST/CDO: weight toward governance and communication anchors (MECE, Pyramid Principle, ADR)

## Step 5 — Cortex Documentation Fetch

If the task mentions any named Cortex AI function, fetch its current Snowflake documentation via `WebFetch`. Skip if `WebFetch` times out after 3 seconds — log to `hook-errors.log`.

## Step 6 — Inject Context Preamble

Format selected context as a structured preamble prepended to the agent's prompt:

```
[CocoScout — Relevant Context Loaded]
From CocoGrove: <pattern-name> — [reason for inclusion]
From CocoContext: approved-models.md — [reason: ta
03

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeNA
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
none-observed
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (0)

No findings outside the package's declared scope.

Gates applied: no_behavioural_pass.

Audited 2026-10-13 · audit v0.4.1 · source sha 6b58edc143d7full audit observations/trust-audit/skill/snowflake-labs__cocoscout.json · Report an issue / request a re-scan
04

Audit history

Every audit this skill has had.

DateSourceVerdictGradeScoreChange
2026-10-136b58edc143d7SAFEB89first audit
05

Questions

What does the Cocoscout skill do?

CocoPlus is an Agentic Operating System for Snowflake Coco. It brings structured, multi-agent workflows to data engineering projects — covering everything from project initialization through spec, plan, build, test, review, and ship phases.

Is Cocoscout safe to install?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.

What can Cocoscout access on my machine?

The audit observed no filesystem, network or shell use at all in its source.

How current is this page?

The grade is for one exact copy of the source (6b58edc143d7), read on 2026-10-13. The repository is watched, and a new audit runs when it changes — this is the first audit.

Advertisement