The auxfirst skill scores every action an agent can take, caps its autonomy at the hottest dimension, and writes the mandate, exception handling and owner’s manual behind it. Most agent guidance answers “can the model do this?” This answers the question that actually blocks production.
/plugin marketplace add auxfirst/auxfirst-skill-global /plugin install auxfirst@auxfirst
Given an action this agent can take, what does the team owe before it is allowed to take it unsupervised?
You give it an agent — a copilot, an automation, a workflow that writes to a system of record. It gives back written artifacts: a scored action inventory, a mandate with an enforcement mechanism on every row, exception handling with named recipients and deadlines, and a readiness verdict out of 24.
It works per action, never per agent. An agent that can do nine things has nine answers, and averaging them is the exact mistake the skill exists to prevent.
No averaging. Four cool dials never buy back one hot one — a perfectly reversible, narrow, internal action that signs a contract is still a contract. This single rule is what stops “but it’s mostly fine” from shipping a disaster.
Three dials are cool. The action is still HIGH — it leaves the building and asks for money.
A team scoring by average calls this low-medium and ships it on auto-run.
Steps one to five are lookups the skill runs for you — there is a script, because hand lookups quietly average. Steps six to nine are where the judgment lives, and the skill walks you through them.
A single SKILL.md carrying the procedure, loaded only when the work calls for it.
Heat ladder, heuristics and patterns, owner’s manual, workflow readiness, production check, anti-patterns.
Mandate, autonomy map and owner’s manual — the artifacts you hand to engineering and to the board.
heat.py scores an action and returns the band, the autonomy cap and what that mode obliges you to build.
A trigger-eval set, because the description is the whole triggering mechanism and guessing is not a test.
Everything traces to published, dated auxfirst material. Nothing in the skill is unsourced.
You install it and it stays out of the way until the work needs it — then it turns a vague autonomy argument into a table you can implement against.
You are the named human when something goes wrong. This gives your teams one vocabulary and one bar, so agent nine is as defensible as agent one.
It is not about prompts, models, retrieval or cost. Those are real problems and belong elsewhere. This assumes the agent can do the task and asks whether the organization can own it.
It will not give you a single score. Capability and supervision are reported separately and never combined, because the gap between them is the finding. An agent that can do a great deal and can be supervised very little is the specific thing worth knowing, and one number would hide it.
It tells you whether the accountable human can see, approve and undo what the agent did. That is a different claim from safety, and it is the only one a document can honestly support.
Every component has a longer canonical treatment. The skill is the operational compression; these are the arguments.
CC BY 4.0 — take it, adapt it, ship it inside your own governance. Keep the attribution and tell us what broke.