doccraft-update-79aa1f — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited doccraft-update-79aa1f (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Managed by doccraft —doccraft updateregenerates this file. Local edits will be overwritten. Seedoccraft.jsonto override project-specific vocabulary and paths without touching this file.
in doccraft.json against the latest npm release).
doccraft-config or other skills mention features that do not seem towork — you may be running an older skill body.
Read doccraft.json at invocation. The version field is this skill's primary input — it determines which migration entries apply. If the file is missing, treat the local version as unknown, warn the user, and proceed.
Relevant keys:
version — the currently installed doccraft version. Used to filter themigration manifest. Default: none (required; treat as unknown if absent).
docsDir — root folder for all docs. Default: docs. Used post-updatefor context when checking extension fragments in installed skills.
Read "version" from doccraft.json at the project root. If the file does not exist, treat the local version as unknown and warn the user — then proceed.
Run exactly once:
npx doccraft@latest llmParse the JSON output. The relevant fields are:
version — the latest doccraft version.migrations — array of { from, to, summary, steps[] } entries.If the invocation fails (no network, npx error), report the error and stop. NEVER guess at migration steps.
Filter migrations to entries where the local version falls within the from range and the latest version falls within the to range.
Treat from as a semver range (e.g. "0.x" covers 0.1.0, 0.9.3). If you cannot parse the range, surface it as a step the user MUST review manually rather than blocking the update.
If the filtered list is empty:
npx doccraft@latest update(The CLI handles the version bump in doccraft.json and installs skills and openspec instructions — no manual file edit needed.)
If the filtered list is non-empty:
summary — one sentence.steps[] — numbered list.a. Run: npx doccraft@latest update (The CLI handles the version bump and skill install.) b. Report the new version and what was installed.
migrations[] inthe manifest declares. If the array is empty, there are no user actions required.
migrations) MUST run without prompting — that is the whole point.
treated as unknown; warn the user and proceed.
npx doccraft@latest llm more than once per update run.
npx doccraft@latest updatesurgically updates "version" and "$schema" in doccraft.json automatically. MUST NOT duplicate that edit.
Before running the update, MUST complete these checks:
doccraft.json in full before fetchingthe manifest. NEVER rely on memory or assumption for the local version.
npx doccraft@latest llm outputcontains the expected version and migrations fields. If the output is not valid JSON or missing these fields, report the parsing error and stop — NEVER proceed with a broken manifest.
version is differentfrom the local version. If they match, report "already up to date" and stop — no npx doccraft@latest update needed.
from range cannot be parsed, surfacethat entry for manual review rather than silently skipping or incorrectly including it.
npx doccraft@latest llm fails with anetwork error, report the error and stop. NEVER cache and reuse an old manifest.
migrations[] is empty — NEVER; noentries means no manual steps are needed.
npx doccraft@latest llm more than once per update run — NEVER;cache the result in memory.
and report the error.
"version" or "$schema" in doccraft.json after theCLI has run — NEVER; the CLI already performed the surgical edit.
npx doccraft@latest update without user approval when migrationentries are present — NEVER; gate on approval.
npx doccraft@latest update when the local version alreadymatches the latest — NEVER; report "already up to date" and stop.
The task is complete when:
npx doccraft@latest llmexactly once.
npx doccraft@latest update has run and the outputconfirms the new version plus installed components (skills refreshed, openspec version).
(same as dominant path), or the user has rejected and no files were changed.
refreshed.
doccraft.json was missing before the update and the CLI did notscaffold it, invoke doccraft init to create the config file with the current version stamp.
doccraft.json declares an extensions array, verify the extensionfragments were baked correctly by checking the injected blocks in .claude/skills/*/SKILL.md after the update.
doccraft-queue-audit if the project uses docs/stories/ — new skill bodies may interpret frontmatter fields differently.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.