audit-docs-b51eaa — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited audit-docs-b51eaa (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Project-agnostic, global skill. It finds every hand-authored documentation file in the current repo, extracts verifiable claims from each one, checks those claims against the actual codebase, and produces a ranked report with targeted fix proposals — requiring explicit per-finding approval before making any change.
It is the complement to audit-agent-docs (which audits Codex instruction files). This skill covers user-facing and developer-facing docs: README, setup guides, API references, architecture docs, tutorials, and similar.
README.md (root and nested), docs/, CONTRIBUTING.md, ARCHITECTURE.md,SECURITY.md, and any hand-authored .md, .txt, .rst, .adoc files.
not as audit targets themselves.
AGENTS.md, AGENTS.override.md, CLAUDE.md, .codex/, .agents/, and .claude/directories when they are agent/tool configuration rather than user-facing docs.
CHANGELOG*, HISTORY* — updated at release time, stale by design.LICENSE*, NOTICE* — static legal text.node_modules/, dist/, build/, out/, vendor/,.venv/, target/, __pycache__/, .next/, coverage/, Sphinx _build/, JSDoc/TypeDoc out/, Swagger/OpenAPI output files.
.gitignore.Git churn alone is a weak signal for documentation. The primary mechanism is extracting verifiable claims from each file and checking them against codebase reality.
| Claim type | What to extract | How to verify |
|---|---|---|
| Code blocks | Fenced ` blocks | Do the referenced functions/classes/files exist? Does the snippet still match the actual source? |
| Shell commands | $ lines, bash/sh blocks | Does the command, flag, or subcommand still exist in the CLI/Makefile/scripts? |
| File paths | Paths in prose or blocks | Does the path still exist in the repo? |
| Version/dep refs | "requires Node 16", "Python ≥ 3.8", semver pins | Compare with package.json, pyproject.toml, go.mod, .tool-versions, etc. |
| Symbol refs | Function, class, config-key names in prose | Do these symbols still exist in the source (grep/Glob)? |
| Internal links | [text](../other-file.md) | Does the target path exist? |
| Env/config keys | ENV_VAR, config field names | Do these appear in the codebase or .env.example? |
Claim extraction is heuristic and intentionally non-exhaustive — surface the highest- confidence mismatches, not every possible discrepancy.
Report findings by doc importance first, staleness severity second:
| Tier | Files |
|---|---|
| Critical | Root README.md, root docs/getting-started*, docs/install*, docs/setup* |
| High | CONTRIBUTING.md, docs/quickstart*, docs/tutorial*, onboarding guides |
| Medium | docs/api*, docs/reference*, ARCHITECTURE.md, SECURITY.md |
| Low | Internal/contributor docs, docs already covered by a critical-tier file |
PDFs in the repo (design docs, specs, RFCs) are read as reference context, not audit targets. If a PDF spec contradicts what the docs or code say, flag the discrepancy — but do not attempt to edit the PDF.
Doc fixes are targeted:
| Finding type | Proposed action |
|---|---|
| Wrong version number / renamed flag | Targeted Edit of the specific line — propose and require approval |
| Outdated code block | Propose replacing just that block — require approval |
| Broken file path / symbol ref | Propose the corrected path/name — require approval |
| Entire section describes removed feature | Flag for manual rewrite; do not auto-edit |
| New major feature has no docs | Flag as a coverage gap; offer to draft a stub |
Never propose a full-file rewrite unless the user explicitly asks.
find . \( -name "*.md" -o -name "*.txt" -o -name "*.rst" -o -name "*.adoc" \) \ -not -path '*/node_modules/*' -not -path '*/.git/*' -not -path '*/dist/*' \ -not -path '*/build/*' -not -path '*/vendor/*' -not -path '*/_build/*'
find . -name "*.pdf" -not -path '*/node_modules/*' — note themfor step 5.
work from its summary.
git log -1 --format="%aI %s" -- <path>each tier); do not skip low-churn files — they may still have broken claims.
For each doc file (Critical and High tiers always; Medium and Low if feasible):
grep/Glob/Read on therelevant source files or manifests.
? unclear / ∅ missing).
or legal PDFs).
as findings but do not propose edits to the PDF.
but have no corresponding documentation in any audited file.
consistency — a mismatch means at least one is wrong even if the individual check was inconclusive.
Present findings in this order, grouped by doc importance tier:
For each finding:
✗ Wrong / ∅ Missing / ? UnclearThen a summary section:
<date>")For each finding with a proposed targeted edit:
audit-agent-docs's domain.every uncertain similarity as a finding.
full-file rewrites.
context overload; never read every file in the main thread.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.