avav25/spike
plugin/skills/spike/SKILL.md
Use this skill when evaluating new tech, prototyping approaches, researching unknowns, or building a proof-of-concept — for a time-boxed exploration with a go/no-go writeup, single-pass with optional reviewer and no RALF (a spike is exploration, not convergence). Not for development (use /develop) or decisions already made.
$ install --global
skillsauthnpx skillsauth add avav25/ai-assets spikeInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 23, 2026, 4:34 AM24.0s3 files scanned
SKILL.md
- name:
- spike
- description:
- Use this skill when evaluating new tech, prototyping approaches, researching unknowns, or building a proof-of-concept — for a time-boxed exploration with a go/no-go writeup, single-pass with optional reviewer and no RALF (a spike is exploration, not convergence). Not for development (use /develop) or decisions already made.
- context:
- fork
- argument-hint:
- <research question> [--time-cap <minutes>] [--poc]
/spike — Time-Boxed Exploration
Single-pass research workflow producing a SPIKE-REPORT with a go/no-go/needs-more-info recommendation. Time-cap is the primary discipline. Optional --poc flag produces a minimal proof-of-concept code alongside the writeup.
When to use
- "Can we use gRPC instead of REST?"
- "Best way to implement real-time sync?"
- "Is this library production-ready?"
- "Research: what's our path to multi-region deployment?"
Not for
- Decisions already made → just
/planthen/develop - Open-ended exploration with no question →
/spikerequires a stated question - Convergence on a binary success signal →
/ralph(spike is exploration, not iteration)
Invocation
/spike "Can we use gRPC instead of REST?" --time-cap 120
/spike "Best way to implement real-time sync" --poc
/spike "Is Postgres pg_vector production-ready for our scale?" --time-cap 90
Arguments
| Flag | Default | Effect |
|---|---|---|
| <question> (positional) | required | Research question or evaluation goal |
| --time-cap <min> | 180 | Wall-time cap for the spike |
| --poc | off | Produce minimal proof-of-concept code in <repo>/spike-poc-<run-id>/ |
Output
<repo>/.ai-skills-memory/spikes/<run-id>/SPIKE-REPORT.md— findings, pro/con analysis, recommendation- (optional)
<repo>/spike-poc-<run-id>/— proof-of-concept code if--poc - Memory write: L4 research record for future reference
Agent roster
| Agent | Model | Effort | Tools | Role |
|---|---|---|---|---|
| subject-matter-expert (role-appropriate, chosen by Lead) | inherit | high | Read, Grep, Glob, Bash, (Write+Edit if --poc) | Research + writeup + POC |
| (optional) technical-reviewer | inherit | medium | Read, Grep, Glob | Stress-test findings, identify gaps |
The Lead picks the SME role based on the question domain (e.g., db-engineer for schema questions, ml-engineer for ML questions, solution-architect for architecture).
Pipeline
┌─ Lead chooses SME role based on question domain
│
├─ SME researcher:
│ - Research question exhaustively (within time-cap)
│ - Gather evidence (docs, benchmarks, examples)
│ - Build POC if --poc flag set
│ - Estimate effort if go/no-go decision involved
│ → SPIKE-REPORT.md with go/no-go/needs-more-info recommendation
│
├─ (Optional) technical-reviewer validates findings:
│ └─ Stress-test assumptions, identify gaps in evidence
│ → review.md
│
└─ Memory write: L4 research record
Report: go/no-go + next steps
No RALF — spike is exploration, not convergence.
Decision lens & evidence requirements
- SME research + evidence gathering: every quantitative claim in the SPIKE-REPORT cites a source from
references/evidence-hierarchy.md(level 1–5; level 6–7 requires "low confidence" caveat). - SME recommendation (the go/no-go/needs-more-info writeup): apply Cynefin classification + One-Way/Two-Way Doors lens per
references/decision-frameworks.md. Recommendation is one ofgo-two-way,go-one-way, orneeds more spike before commit, with each option classified on (Cynefin domain, reversibility, ICE/RICE relative score, confidence level).
G7 spawn payloads
SME and reviewer spawns use structured G7 payloads per plugin/schemas/spawn-payload.schema.json. Returns conform to plugin/schemas/return-contract.schema.json.
Eval rubric
Pointer: plugin/eval/judge-rubrics/spike.md (B10).
Dimensions:
- Question clarity — spike clearly answers the stated question
- Evidence quality — findings backed by data (not opinion)
- Completeness — considered trade-offs and alternatives
- Feasibility assessment — if go/no-go, effort estimate is realistic
- Actionability — next steps clear (prototype? deep dive? abandon?)
Pass: avg ≥ 4.0, no dimension < 3.
Memory writes
| Layer | When | Shape |
|---|---|---|
| L4 | After complete | .ai-skills-memory/spikes/<run-id>/report.md — full findings |
| L4 (committed) | Always ask user explicitly after report, never auto-write | .ai-skills-memory/.committed/decisions/<date>-<question>.md — recorded decision |
Hard rule on committed decisions: never auto-create .committed/decisions/ files. .committed/ goes to git and the user may want to reword the decision before committing. The skill ALWAYS asks before writing to .committed/decisions/. The pre-tool-use-committed-write.py hook enforces the allowlist on these paths regardless.
Failure modes
- Time cap hit mid-research: SME pauses at time-cap; produces partial report with explicit
[INVESTIGATION INCOMPLETE]marker and "more investigation needed" section listing specific data gaps - Findings inconclusive: report states inconclusive with specific data gaps; recommend deeper spike or prototype
- POC fails to compile/run: report failure as a finding; do NOT block the spike completing — POC failure is itself a data point for go/no-go
Observability events
workflow_start— spike + questiontime_cap_warning— at 80% of time-capworkflow_end—COMPLETEwith go/no-go ORINCOMPLETEif time-cap hit
Integration
- Orchestrator:
feature-design-lead(only agent withtools: Task) - Schemas:
plugin/schemas/spawn-payload.schema.json,plugin/schemas/return-contract.schema.json - Companions:
/context-load(per-role context for SME),/subagent-spawn(G7 payload) - Rules:
subagent-isolation(G7 + bounded recursion),untrusted-content-wrapping(G1 wrap on subagent returns + reference docs read),memory-discipline(committed writes always-ask + allowlist) - Hooks:
pre-tool-use-committed-write.py(enforces.committed/decisions/allowlist),tool-output-normalize.py(G2 on bash output)
Related Skills
avav25/knowledge-sync
development
VerifiedTrustedCommunity
Use this skill when running the recurring (daily) knowledge-base rescan for a repo that already has knowledge/.knowledge-sync.yml — the main-thread dispatcher that reads the config, computes the git delta since last_scanned_sha, maps changed paths to affected doc areas, early-exits cheaply when nothing changed, then fans out one Agent(content-writer) per affected area, applies the propose/direct update policy, advances the baseline only on success, and writes an L4 run log — all with the G1 untrusted-content choke-point, secret-scan, deny-list, and budget controls woven in. For first-time setup use /knowledge-sync-init.
1SKILL.mdUpdated May 24, 2026
avav25/knowledge-sync-init
development
VerifiedTrustedCommunity
Use this skill when bootstrapping scheduled knowledge-base sync for a repo that has no knowledge/.knowledge-sync.yml yet — to run one-time setup that detects the knowledge_root from CLAUDE.md/AGENTS.md, maps doc areas to source globs, records opt-in external sources (Linear/Notion/WebFetch, all disabled by default), captures a baseline last_scanned_sha, sets the per-area update policy, generates or seeds knowledge/CONVENTIONS.md, provisions the L4 memory dir, and offers to register the daily routine. Routes ongoing recurring sync operations to /knowledge-sync.
1SKILL.mdUpdated May 24, 2026
avav25/ai-skills-init
tools
VerifiedTrustedCommunity
Use this skill when bootstrapping a target repository to be ai-skills-aware — on the first run of any ai-skills workflow in a fresh repo, when adopting the ai-skills plugin in an existing repo, or after upgrading to a plugin version that adds new memory paths or templates, including when the user does not say "init" but asks to "set up" or "onboard" the repo — to detect codebase type, create CLAUDE.md + AGENTS.md scaffolding, initialize the .ai-skills-memory/ directory tree from L1 templates, and configure .gitignore. Idempotent — safe to re-run. Accepts `--codebase-type <type>` and `--overwrite`. Not for re-initializing only memory — use `/memory-init` instead.
1SKILL.mdUpdated May 18, 2026
avav25/plugin-author
tools
VerifiedTrustedCommunity
Use this skill when extending, repairing, or improving plugin assets, when ingesting a `/feedback` report as a fix-cycle backlog, or when you do not remember which lower-level command is right for the job — the umbrella workflow for ai-skills plugin-asset authoring and maintenance: creating, auditing, fixing, improving, refactoring, and migrating skills, agents, rules, hooks, prompts, schemas, and rubrics inside the plugin. Auto-classifies the request, loads the right knowledge skills (`@prompt-engineering`, `@context-engineering`, `@team-protocols`), and spawns the right subagents (`prompt-engineer`, `system-architect`, `python-engineer`, `software-engineer`, `qa-engineer`, `eval-judge`) via the `Agent` tool.
1SKILL.mdUpdated May 14, 2026