md-document — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited md-document (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The general-purpose converter — handles the 90% case Shihipar describes (specs, plans, RFCs, reports, explainers). Three stdlib tools pipeline together:
markdown_parser.py → html_renderer.py → interactivity_injector.py
(md → JSON AST) (AST + tokens → HTML) (HTML + JS behavior)Output is one .html file with sticky TOC, search filter, scrollspy, code-copy buttons, and the user's 12 derived brand tokens. Externals limited to Google Fonts CSS + Prism.js CDN.
| Symptom | Action |
|---|---|
markdown-html-orchestrator routes input as DOCUMENT | Invoke this skill |
User runs /cs:md-document <path>.md directly | Invoke this skill |
| User says "convert this spec/report/RFC/plan to HTML" | Invoke this skill |
Input is a code review (has `diff blocks) | Route to md-review instead |
Input is a slide deck (clear --- boundaries) | Route to md-slides instead |
| Input is < 100 lines | Refuse (Shihipar threshold — markdown still wins) |
| Design-system not onboarded | Refuse, surface /cs:design-system |
# 1. Parse markdown → JSON AST
python3 markdown-html/skills/md-document/scripts/markdown_parser.py \
--input <path>.md --output sections.json
# 2. Render AST + design-system config → single-file HTML
python3 markdown-html/skills/md-document/scripts/html_renderer.py \
--sections sections.json --output document.html
# 3. Inject lightweight JS (search, copycode, smoothscroll, scrollspy)
python3 markdown-html/skills/md-document/scripts/interactivity_injector.py \
--file document.html \
--features search,copycode,smoothscroll,scrollspyOr all-in-one (sample render):
python3 markdown-html/skills/md-document/scripts/html_renderer.py --sample \
| python3 markdown-html/skills/md-document/scripts/interactivity_injector.py \
--file /dev/stdin --output document.htmlCommonMark subset sufficient for agent-generated artifacts:
code / links / images `python ) with Prism.js highlighting on demand> [!NOTE], > [!TIP], > [!IMPORTANT], > [!WARNING], > [!CAUTION])Out of scope: nested lists, HTML inlines, footnotes, definition lists, task list checkboxes (rendered as plain text), reference-style links.
config_loader.setup_completed() must return True. Otherwise surface /cs:design-system.fonts.googleapis.com and cdn.jsdelivr.net (Prism). Anything else is a regression.design_style=editorial produces 720px-wide layout with 1.75 line-height; playful rounds the callouts and adds shadow; technical is dense with 0.875rem code. Smoke-tested.prefers-color-scheme). Canon: WCAG 2.2 §1.4.3.<title> and is excluded from the TOC.--- boundaries into slides. This one renders one continuous document.{default_output_dir}/doc-{slug}.html (path resolved by orchestrator's output_path_resolver.py; collision suffix -2, -3, … by default).
references/ for full citations~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.