planning-queue — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited planning-queue (Rules) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Documentation and project-story skills for Claude Code and Cursor, layered on OpenSpec.
docs/stories/ with typed YAML frontmatter.docs/adr/, Nygard-style.doccraft.json to your project. Analyse mode proposes values; edit mode validates targeted changes against the embedded JSON Schema.Pass `--features` on `doccraft init` (comma-separated) to opt into extra modules. Choices are `business` (startup-advisor skill and docs/business/ integration in core skills) and `design` (installs designer-skills and enables designer-related story guidance). Selected values are stored in doccraft.json under features and replayed on `doccraft update`.
Skills install to .claude/skills/ (read natively by Claude Code; auto-discovered by Cursor 2.4+). Cursor also gets rule stubs under .cursor/rules/ that auto-attach when editing docs.
npx doccraft initThen invoke the `doccraft-config` skill in Claude Code or Cursor to tailor doccraft.json to your project.
Requires Node.js >= 22.14.0.
Invoke the `doccraft-update` skill. It reads the version stamp in doccraft.json, runs the upgrade silently when possible, or summarises and gates when a release declares a migration. OpenSpec is upgraded transitively. No local install required — skills use npx doccraft@latest under the hood.
doccraft.json{
"$schema": "https://cdn.jsdelivr.net/npm/[email protected]/schema/doccraft.schema.json",
"version": "0.9.0",
"_hint": "Edit with the doccraft-config skill.",
"docsDir": "docs",
"story": { "areas": ["..."], "themes": ["..."] }
}$schema is pinned to the same version as the version stamp and served by jsDelivr — IDEs (VS Code, JetBrains) validate and show field descriptions out of the box.version and the URL's version segment are managed by doccraft (init writes them, update bumps them together; nothing else in the file is touched).Optional `story.modelHints` points at a markdown file (for example docs/reference/model-hints.md) that describes which models suit which work in your environment. When set, the installed doccraft-story skill gains a short Model hints section that tells the agent to read that file and append plain markdown at the end of story Notes. Doccraft does not validate the registry file — it is entirely project-owned.
doccraft.json, installs skills, runs openspec init.upgrade) — refreshes skills, runs openspec update, bumps the version stamp.doccraft-update skill. No flags, no arguments.Common flags on init / update: --tools <claude|cursor|all|none>, --force, --skip-openspec. See doccraft <cmd> --help for full options.
See CLAUDE.md for the dev loop and conventions. Releases are automated via semantic-release on conventional-commit messages.
MIT — changelog at CHANGELOG.md.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.