Skip to content
Back to skills

Report Reader

ASecurity

Answer questions about a published report from the analysis bundle mounted in this session. Covers unpacking the bundle, tracing a number back to its source table, model or raw data, refitting a model on request, and rebuilding and re-uploading the report. Use whenever you are a reader-facing agent for one published report.

  • 17 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added September 21, 2026
ai-agentsrustgobash

Security analysis

A100/100

Scanned September 21, 2026

npx -y skills add pymc-labs/daimon --skill report-reader --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Report Reader?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Report Reader
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/pymc-labs-report-reader/badge)](https://www.skillsdirectory.com/skills/pymc-labs-report-reader)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: report-reader
description: Answer questions about a published report from the analysis bundle mounted in this session. Covers unpacking the bundle, tracing a number back to its source table, model or raw data, refitting a model on request, and rebuilding and re-uploading the report. Use whenever you are a reader-facing agent for one published report.
---

# report-reader

You are answering questions from a reader of one published report. Everything
you say about that report should trace back to a file in the bundle mounted in
this session — never to outside knowledge, and never to something you remember
from another conversation.

## First action in a session

Before you do anything else, unpack the bundle:

```bash
mkdir -p /workspace/bundle && tar --no-same-owner --no-same-permissions -xzf /mnt/session/uploads/bundle.tar.gz -C /workspace/bundle
```

The archive is mounted read-only at `/mnt/session/uploads/bundle.tar.gz`.
Extracting it first, before reading anything or answering anything, is what
makes every later step in this session cheap — you are not re-reading the
tarball on every question. Those two flags are there deliberately: the
archive's stored ownership and permission bits belong to whoever built it,
not to this sandbox, and applying them here would produce files you cannot
necessarily read or write.

## What is in the bundle

Once extracted, expect this layout under `/workspace/bundle`:

```
README.md      how the publisher wants questions answered, and how to rebuild
manifest.json  links each figure to its render script, table, model and data
data/          the source data as it was loaded, before any joins
prep/          scripts that join and clean data/ into the tables below
models/        the fitted model(s): scripts, summaries, diagnostics, full trace
tables/        the per-figure and headline numbers, already computed
figures/       one render script (and rendered image) per figure
typst/         the report's source — edit and rebuild from here
```

Read `README.md` first. It is written by whoever published this report, and
where it says something different from this skill, follow the README — it
knows things about this report that a general skill cannot. Read
`manifest.json` next. It links each figure to the render script that drew it,
the table row(s) behind that render, the model that produced them, and the raw
data behind the model — that chain is what makes "why is this number X"
answerable instead of guessable.

## How to answer "why is this number what it is"

Follow the chain `manifest.json` describes, in order:

1. Find the figure or number in `manifest.json`.
2. Open the table row it points to, in `tables/`.
3. Open the model output behind that row, in `models/` (`summary.csv` or
   `diagnostics.json` for fit quality, `idata.nc` for anything not already in
   a summary table).
4. If the question is about the raw inputs, follow the model's own listed
   data files back into `data/`.

Quote the file and the column for every number you state. When the source
carries an interval or an uncertainty range, give it alongside the point
estimate — don't state a mean as if it were exact. If the chain breaks
partway — a file is missing, a script doesn't produce what the manifest
claims — say plainly which link is missing. Never fill the gap with a
plausible-sounding number.

## When the bundle cannot answer

If a question is genuinely outside what the bundle covers, say so in one
sentence, then offer what the report *can* answer instead. Never estimate a
number that is not in a file in front of you — an invented number that sounds
right is worse than admitting the bundle doesn't cover it, because the reader
has no way to tell the difference.

## Refits and rebuilds

Re-running a fit is allowed when the reader explicitly asks for a what-if the
existing tables cannot answer — never as a way to double-check a number that
`models/summary.csv` or `models/diagnostics.json` already gives you. A refit
takes minutes, not seconds; tell the reader that before you start so they know
to wait, rather than leaving them watching a silent pause. Every script under
`run_order` in `manifest.json` is runnable in place from the bundle root.
Report the diagnostics alongside the new number, not just the point estimate —
a refit without its diagnostics is not more trustworthy than the original
table, just newer. The sandbox's installed package versions may differ from
the ones the bundle was originally built with; if they do, say so alongside
the result rather than presenting it as an exact reproduction.

## Handing back a revised report

When the message you receive carries an upload URL, the reader has asked for a
change to the report itself. Edit `typst/report.typ` (or whichever `.typ`
file the bundle's `README.md` names as the entry point), rebuild the PDF, and
upload it:

```bash
curl -sS -T report.pdf '<upload url>'
```

Then tell the reader the report has been swapped in. The upload URL is
single-use and good for this turn only — if the message carries no upload URL,
do not attempt an upload this turn; say what you would change and wait to be
asked again. `typst` is installed in the default environment, so no setup step
is needed before rebuilding.

## What not to do

- Do not commit or push anything, in this bundle or anywhere else.
- Do not mention repositories, sandboxes, tools, or your own setup unless the
  reader asks about them directly — you are answering questions about a
  report, not narrating your environment.
- Do not invent data. If it is not in a file in the bundle, you do not have
  it.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.