markdown-html-orchestrator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited markdown-html-orchestrator (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Thariq Shihipar's argument (Claude Code HTML output essay, Medium 2026): markdown collapses past 100 lines for agent-generated artifacts. Long specs, code reviews, and architecture explainers lose density, hierarchy, and lightweight interaction the moment they exceed a screen of text. HTML restores all three — single-file, browser-native, shareable.
This orchestrator forks context, classifies the input markdown deterministically, routes to the right converter sub-skill, and returns a digest with the output path. Heavy intake (full markdown bodies, diffs, slide decks) stays in the forked context.
Domain status (complete): all five skills are live — orchestrator + design-system (onboarding + shared brand tokens) + the three converter sub-skills (md-document, md-review, md-slides). Always route conversions to the shipped converter's scripts; never hand-render HTML inline.
| Symptom | Sub-skill |
|---|---|
| "Convert this RFC / spec / report / explainer to HTML" — long-form doc | md-document |
| "Turn this PR writeup / code review into HTML" — markdown with diff blocks | md-review |
"Make a slide deck from this markdown" — --- boundaries or H1 cadence | md-slides |
below_min_lines: true and route_explainer.py refuses. Tell the user to keep their input as markdown.~/.config/markdown-html/design-system.json doesn't exist (or its setup_completed_at is null), refuse. Point the user at python3 markdown-html/skills/design-system/scripts/onboard.py (or --defaults for a zero-touch run).output_path_resolver.py refuses if the configured default_output_dir (or --out override) isn't writable.Two-signal threshold pattern lifted from research-ops/skills/research-ops-skills/SKILL.md. Filename hint = 2 points; each content signal = 1 point. Silent-route allowed when winner ≥ 3 AND (runner-up = 0 OR winner ≥ 2× runner-up). Below threshold → one clarifying question with a recommended answer.
| Signal class | Filename hints | Content signals | Sub-skill |
|---|---|---|---|
| DOCUMENT | report.md, *-doc.md, spec.md, rfc-*.md, *-analysis.md, *-explainer.md | ## Table of Contents (2), ^# , ^## , markdown table rows, > [!NOTE]/[!TIP]/[!IMPORTANT] callouts | md-document |
| REVIEW | review.md, *-pr-*.md, *.diff.md, code-review*.md | `diff (2), ^[-+]{3} (2), ^@@ (2), > [!BLOCKER]/[!MAJOR]/[!MINOR]/[!NIT] (2), LGTM/nit:/blocker: | md-review |
| SLIDES | deck.md, slides.md, *-talk.md, presentation*.md | ^---$ ≥ 3 (2 + per-boundary), <!-- notes: (2), H1 count ≥ 5 with median gap ≤ 12 lines (2) | md-slides |
The pipeline:
python3 markdown-html/skills/markdown-html-orchestrator/scripts/doctype_classifier.py \
--input <path>.md --output json \
| python3 markdown-html/skills/markdown-html-orchestrator/scripts/route_explainer.pyroute_explainer.py checks the design-system status, applies the < 100-line refusal, and prints one of: ROUTE_SILENTLY -> md-<type>, ASK_USER one question: ..., or REFUSE — fix the issues above.
If the user has never run onboarding, surface the one-time setup:
python3 markdown-html/skills/design-system/scripts/onboard.pyTen questions, 1-2 minutes. Captures brand primary + accent + heading/body Google Fonts + design style (editorial/technical/minimal/playful) + default output dir + syntax theme + TOC behavior + optional logo/company. Stored at ~/.config/markdown-html/design-system.json. Re-runnable with --scope project for per-repo overrides.
Run doctype_classifier.py on the markdown. Inspect the verdict.
Pipe the classification into route_explainer.py. If it says ROUTE_SILENTLY, forward the original markdown + the design-system config into the named sub-skill's renderer in the forked context. If it says ASK_USER, ask ONE question with the recommended answer.
python3 markdown-html/skills/markdown-html-orchestrator/scripts/output_path_resolver.py \
--input <path>.md --doctype <document|review|slides>Collision handling defaults to -2 / -3 / ... suffix; --on-collision timestamp for stamped names.
The routed converter sub-skill's renderer (md-document/scripts/, md-review/scripts/, or md-slides/scripts/) takes the input markdown, the design-system config, and the resolved output path, and writes a single self-contained HTML file. The orchestrator returns a ≤ 100-word digest: input lines, output path, design style applied, top 3 features used (TOC, search, code-copy, etc.), and one forcing question for the user. Never render HTML by hand — the converter scripts own the rendering.
Walk these one at a time, with a recommended answer per question, citing the canon. Lift this list into /cs:grill-markdown-html for plan-stage interrogation.
Recommended: name it first; density follows from purpose. Canon: Shihipar — "match output format to consumption context"; Tufte — Visual Display of Quantitative Information, ch. 1.
Recommended: yes — below that, keep it as markdown. Canon: Shihipar — markdown still wins under 100 lines.
Recommended: yes, globally (~/.config/markdown-html/design-system.json). Canon: research-ops onboarding pattern (research-ops/CLAUDE.md §8); WCAG 2.2 §1.4.3 (text contrast 4.5:1).
Recommended: the configured default_output_dir with --on-collision suffix. Canon: Matt Pocock handoff skill — never silently overwrite a working artifact.
Recommended: silent-route only when the classifier's verdict is one of document/review/slides AND silent_route_allowed: true. Otherwise ask. Canon: research-ops two-signal threshold (research-ops/skills/research-ops-skills/SKILL.md §"Routing logic").
Never run a sub-skill before the lane is locked.
~/.config/markdown-html/design-system.json exists with setup_completed_at populated).marketing/landing/).playground plugin).@media print; user prints from browser)./playground) — builds interactive controls (sliders, knobs, drag-drop) for prompt tuning, with a copy-prompt-back loop. This plugin converts existing markdown documents to HTML. Different tools for different jobs.| Sub-skill | Artifact | Status |
|---|---|---|
md-document | doc-<slug>.html (single file, sticky TOC, collapsibles, search, code-copy, scrollspy) | ✓ live |
md-review | review-<slug>.html (2-col diff + severity margin notes + jump-nav) | ✓ live |
md-slides | deck-<slug>.html (arrow-key nav + presenter mode + print-to-PDF) | ✓ live |
-2, -3, …; --on-collision overwrite is opt-in only.research-ops/skills/research-ops-skills/SKILL.md (context: fork, two-signal routing)research-ops/skills/clinical-research/scripts/ (onboard.py, config_loader.py)marketing/landing/skills/landing/scripts/brand_palette_validator.py (WCAG + HSL derive)thariqs.github.io/html-effectiveness/ gallery; Wattenberger interactive essays; Maggie Appleton digital gardens~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.