Agent skill · Audited from source
Openspec Explore
skill · VILA-Lab/FigMirrorLicence not declaredAudited 18 Oct 2026 · source 0a7231a8d795
Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit 0a7231a8d795 and found no filesystem, network or shell access and no hard-coded secrets. What it does: Enter explore mode - a thinking partner for exploring ideas, investigating problems, and clarifying requirements. Use when the user wants to think through something before or during a change.
Cite
Cite this page
ModelsAtlas. “Openspec Explore (VILA-Lab/FigMirror)”. Retrieved 18 Oct 2026. https://modelsatlas.com/skills/vila-lab/openspec-explore
6 skills are called “Openspec Explore”. You are viewing VILA-Lab/FigMirror.
- VILA-Lab/FigMirror★ 530✓SAFE
- fission-ai/openspec★ 73k✓SAFE
- fengshao1227/ccg-workflow★ 5.9k✓SAFE
- qixing-jk/all-api-hub★ 4.9k✓SAFE
- Chorus-AIDLC/Chorus★ 1.2k✓SAFE
and 1 more with this name.
Trust audit
Audit 0.4.1 · source read 18 Oct 2026
SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 16,667 of 17,602 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkNone observedNo outbound calls in the source
- ShellNone observedNo commands run in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 0 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | NA | 0 |
L2 Instructions | Prompt injection, authority framing, hidden directives | PASS | 1 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass.
Findings (1)
LOWPrompt injectionprompt.transfer_instruction · docs/assets/icons/LICENSE-lucide.txt:21
airplay, alert-circle, alert-octagon, alert-triangle, aperture, arrow-down-circle, arrow-down-left, arrow-down-right, arrow-down, arrow-left-circle, arrow-left, arrow-right-circle, arrow-right, arrow-
- Why
- an instruction to move sensitive data to an outside destination
- Fix
- remove; a skill never needs the user's secrets off the machine
Audit 0.4.1 · source sha 0a7231a8d795 · 18 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- PublisherVILA-Lab GitHub organizationOwner of the repository this skill is read from
- Source folderVILA-Lab/FigMirror/.claude/skills/openspec-exploreThe exact folder we audited
- LicenceNot declaredAs the repository states it
- Commit pinned for this verdict0a7231a8d795A new audit runs when the source changes
- Repository statusNot archivedLast push 18 days ago
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Enter explore mode - a thinking partner for exploring ideas, investigating problems, and clarifying requirements. Use when the user wants to think through something before or during a change.
---
name: openspec-explore
description: Enter explore mode - a thinking partner for exploring ideas, investigating problems, and clarifying requirements. Use when the user wants to think through something before or during a change.
license: MIT
compatibility: Requires openspec CLI.
metadata:
author: openspec
version: "1.0"
generatedBy: "1.3.0"
---
Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first and create a change proposal. You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing.
**This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
---
## The Stance
- **Curious, not prescriptive** - Ask questions that emerge naturally, don't follow a script
- **Open threads, not interrogations** - Surface multiple interesting directions and let the user follow what resonates. Don't funnel them through a single path of questions.
- **Visual** - Use ASCII diagrams liberally when they'd help clarify thinking
- **Adaptive** - Follow interesting threads, pivot when new information emerges
- **Patient** - Don't rush to conclusions, let the shape of the problem emerge
- **Grounded** - Explore the actual codebase when relevant, don't just theorize
---
## What You Might Do
Depending on what the user brings, you might:
**Explore the problem space**
- Ask clarifying questions that emerge from what they said
- Challenge assumptions
- Reframe the problem
- Find analogies
**Investigate the codebase**
- Map existing architecture relevant to the discussion
- Find integration points
- Identify patterns already in use
- Surface hidden complexity
**Compare options**
- Brainstorm multiple approaches
- Build comparison tables
- Sketch tradeoffs
- Recommend a path (if asked)
**Visualize**
```
┌─────────────────────────────────────────┐
│ Use ASCII diagrams liberally │
├─────────────────────────────────────────┤
│ │
│ ┌────────┐ ┌────────┐ │
│ │ State │────────▶│ State │ │
│ │ A │ │ B │ │
│ └────────┘ └────────┘ │
│ │
│ System diagrams, state machines, │
│ data flows, architecture sketches, │
│ dependency graphs, comparison tables │
│ │
└─────────────────────────────────────────┘
```
**Surface risks and unknowns**
- Identify what could go wrong
- Find gaps in understanding
- Suggest spikes or investigations
---
## OpenSpec Awareness
You have full context of the OpenSpec system. Use it naturally, don't force it.
### Check for context
At the start, quickly check what exists:
```bash
openspec list --json
```
This tells you:
- If there are active changes
- Their names, schemas, and status
- What the user might be working on
### When no change exists
Think freely. When insights crystallize, you might offer:
- "This feels solid enough to start a change. Want me to create a proposal?"
- Or keep exploring - no pressure to formalize
### When a change exists
If the user mentions a change or you detect one is relevant:
1. **Read existing artifacts for context**
- `openspec/changes/<name>/proposal.md`
- `openspec/changes/<name>/design.md`
- `openspec/changes/<name>/tasks.md`
- etc.
2. **Reference them naturally in conversation**
- "Your design mentions using Redis, but we just realized SQLite fits better..."
- "The proposal scopes this to premium users, but we're now thinking everyone..."
3. **Offer to capture when decisions are made**
| Insight Type | Where to Capture |
|----------------------------|--------------------------------|
| New requirement discovered | `specs/<capability>/spec.md` |
| Requirement changed | `specs/<capability>/spec.md` |
| Design decision made | `design.md` |
| Scope changed | `proposal.md` |
| New work identified | `tasks.md` |
| Assumption invalidated | Relevant artifact |
Example offers:
- "That's a design decision. Capture it in design.md?"
- "This is a new requirement. Add it to specs?"
- "This changes scope. Update the proposal?"
4. **The user decides** - Offer and move on. Don't pressure. Don't auto-capture.
---
## What You Don't Have To Do
- Follow a script
- Ask the same questions every time
- Produce a specific artifact
- Reach a conclusion
- Stay on topic if a tangent is valuable
- Be brief (this is thinking time)
---
## Handling Different Entry Points
**User brings a vague idea:**
```
User: I'm thinking about adding real-time collaboration
You: Real-time collab is a big space. Let me think about this...
COLLABORATION SPECTRUM
════════════════════════════════════════════
Awareness Coordination Sync
│ │ │
▼ ▼ ▼
┌────────┐ ┌────────┐ ┌────────┐
│Presence│ │Cursors │ │ CRDT │
│ "3 │ │ Multi │ │Conflict│
│online" │ │ select │ │ free │
└────────┘ └────────┘ └────────┘
│ │ │
trivial moderate complex
Where's your head at?
```
**User brings a specific problem:**
```
User: The auth system is a mess
You: [reads codebase]
┌─────────────────────────────────────────────┐
Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit 0a7231a
git clone https://github.com/VILA-Lab/FigMirror git -C FigMirror checkout 0a7231a8d795
The author documents no install command, so this uses the repository directly. Our verdict covers commit 0a7231a8d795 only.
Works in
The author has not said which agents this skill supports, and we have not tested it in any.
Audit history
Every audit, every source change
- ✓SAFE B 89 / 100
first audit · source
0a7231a8d795
Similar skills
VILA-Lab/FigMirror
FigMirror mirrors the visual style of a top-conference paper figure (NeurIPS / ICML / ICLR / Nature family) onto the user's own data. Takes dirty data plus a reference figure screenshot (cropped or uncropped),…
VILA-Lab/FigMirror
Implement tasks from an OpenSpec change. Use when the user wants to start implementing, continue implementation, or work through tasks.
VILA-Lab/FigMirror
Archive a completed change in the experimental workflow. Use when the user wants to finalize and archive a change after implementation is complete.
VILA-Lab/FigMirror
Propose a new change with all artifacts generated in one step. Use when the user wants to quickly describe what they want to build and get a complete proposal with design, specs, and tasks ready for implementation.
op7418/guizang-material-illustration
Generate Guizang-style material illustrations, labeled explanatory visuals, material-styled chart illustrations, and data-first editorial images from articles, notes, product concepts, workplace reports, creator posts,…
langgenius/dify
Use when writing or changing Vitest or React Testing Library tests under `web/` or `packages/dify-ui/`, or when the user explicitly requests frontend test strategy, including evaluation of an existing strategy. Do not…
Questions about Openspec Explore
What does the Openspec Explore skill do?
Is Openspec Explore safe to install?
What can Openspec Explore access on my machine?
How current is this page?
Sources
- github.com/VILA-Lab/FigMirror/tree/main/.claude/skills/openspec- — the audited source at commit 0a7231a8d795 and every finding aboveObserved · 18 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the Openspec Explore skill do?
- Is Openspec Explore safe to install?
- What can Openspec Explore access on my machine?