doccraft-config-9a4b6c — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited doccraft-config-9a4b6c (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
doccraft.json to the project's actual subsystems, surfaces, and themes.
plain-English request ("add slice:billing", "set maxStoryFiles to 10").
output references unfamiliar vocabulary — the config is probably stale.
The full JSON Schema for doccraft.json is embedded below. Use it for validation in Edit mode instead of calling any CLI.
{{DOCCRAFT_CONFIG_SCHEMA}}package.json scripts/workspaces,git remote, conventional-commit scope history if a .git/ dir is present.
story.areas — one entry per logical subsystem (aligns with commit scopes).story.slices — one entry per user-facing product surface; [] forpurely technical tools.
story.themes — recurring cross-cutting concerns from the tree.story.id.tiers — e.g. [p0,p1,p2] for most projects; more tiers onlywhen severity levels are meaningfully distinct.
queueAudit.scale — lower thresholds for small repos, higher for large.sessionWrap.capture — disable categories for folder trees the projectdoes not maintain.
doccraft.json diff (or full file if none exists yet).doccraft.json at the project root. MUST NOT rewriteversion or $schema — preserve those bytes exactly.
doccraft.json (use defaults if missing).invalid, report the violation and stop — do not write.
all other bytes (key order, whitespace, comments are not present in JSON but formatting should be preserved).
doccraft.json and confirm what changed.When doccraft.json declares an extensions: [...] array, each entry points at a project-local directory containing an extension.yaml manifest. At doccraft update, doccraft bakes fragments declared by those manifests into skill bodies at named injection points and scaffolds any declared folders. The extension framework is the supported way to add project-specific guidance (additional frontmatter fields, body sections, instructions) to the four core skills (doccraft-story, doccraft-adr, doccraft-queue-audit, doccraft-session-wrap) without forking doccraft.
When editing the extensions array:
each injection point — surface that to the user when adding a new entry.
the directory must already exist (or be about to be created in the same change). doccraft does not scaffold extension directories; the user authors them.
malformed manifests surface on the next update.
for the installed version. Reaching for @latest could propose fields not yet supported.
doccraft update / bumpConfigVersion. Preserve them verbatim.
create the file in Analyse mode.
may apply without a gate for single-field changes unless the change is destructive (e.g. clearing an entire array).
Before writing or updating doccraft.json, MUST complete these checks:
doccraft.json exists, read it in fullbefore proposing any changes. NEVER write from assumptions about current values.
embedded schema above. If any field violates the schema, report the violation and stop — MUST NOT write an invalid file.
version and $schemaare byte-identical to the existing file. If the file is new, omit both (they are set by doccraft update).
extensions array, verifyeach path directory exists on disk (or is being created in the same change). Flag missing directories rather than writing a broken config.
story.areas, story.slices,story.themes MUST NOT contain duplicate values. Deduplicate silently and note what was removed.
npx doccraft@latest llm or any CLI to fetch the schema —NEVER; the embedded schema is authoritative.
version or $schema — NEVER; those are managed bydoccraft update.
doccraft.json in Analyse mode without user approval —NEVER; gate on approval first.
story.status that duplicates an existing entry(e.g. adding todo when it already exists) — NEVER; deduplicate.
fields will confuse future doccraft update runs.
destructive changes MUST be gated.
extensions[].path to a non-existent directory withoutflagging it — NEVER; the user MUST create the directory first.
The task is complete when:
user has approved, and doccraft.json has been written at the project root with version and $schema preserved.
validates against the embedded schema, and doccraft.json has been written with only the intended change applied.
story.areas, story.slices, or story.themes,existing stories with tags not in the new vocabulary are still valid — do not retroactively edit story files. The new vocabulary applies to future stories only.
story.status, story.urgency, or story.impact,verify no existing story uses a value that was removed. If any do, flag them so the user can update those stories.
queueAudit.scale thresholds, the nextdoccraft-queue-audit run will use the new limits — no further action needed.
extensions entry, remind the user torun doccraft update to bake fragments into skill bodies.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.