wiki-update — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited wiki-update (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are distilling knowledge from the current project into the user's Obsidian wiki. This skill works from any project directory, not just the obsidian-wiki repo.
llm-wiki/SKILL.md (walk up CWD for .env → ~/.obsidian-wiki/config → prompt setup). This gives OBSIDIAN_VAULT_PATH, OBSIDIAN_WIKI_REPO, OBSIDIAN_LINK_FORMAT (wikilink default or markdown), and optional QMD settings such as QMD_WIKI_COLLECTION. Works from any project directory.$OBSIDIAN_VAULT_PATH/.manifest.json to check if this project has been synced before.$OBSIDIAN_VAULT_PATH/index.md to know what the wiki already contains.When writing internal links in Steps 4–5, apply the link format from llm-wiki/SKILL.md (Link Format section) using the OBSIDIAN_LINK_FORMAT value.
Figure out what this project is by scanning the current working directory:
README.md, docs/, any markdown filespackage.json, pyproject.toml, go.mod, Cargo.toml or whatever defines the project.claude/ in the project)Derive a clean project name from the directory name.
Check .manifest.json for this project:
last_commit_synced. Before computing the delta, verify the stored SHA is still reachable: git merge-base --is-ancestor <last_commit_synced> HEADgit log <last_commit_synced>..HEAD --oneline to see what changed.last_commit_synced to the current HEAD SHA at the end of Step 6.If nothing meaningful changed since last sync, tell the user and stop.
This is the core question from Karpathy's pattern: what would you want to know about this project if you came back in 3 months with zero context?
Worth distilling:
Not worth distilling:
The heuristic: if reading the codebase answers the question, don't wiki it. If you'd have to re-derive the reasoning by reading git blame across 20 commits, wiki it.
Goes under $VAULT/projects/<project-name>/:
projects/<project-name>/
├── <project-name>.md ← project overview (named after the project, NOT _project.md)
├── concepts/ ← project-specific ideas, architectures
├── skills/ ← project-specific how-tos, patterns
└── references/ ← project-specific source summariesThe overview page (<project-name>.md) should have:
Things that aren't project-specific go in the global categories:
| What you found | Where it goes |
|---|---|
| A general concept learned | concepts/ |
| A reusable pattern or technique | skills/ |
| A tool/service/person | entities/ |
| Cross-project analysis | synthesis/ |
Every page needs YAML frontmatter:
---
title: >-
Page Title
category: concepts
tags: [tag1, tag2]
sources: [projects/<project-name>]
summary: >-
One or two sentences (≤200 chars) describing what this page covers.
provenance:
extracted: 0.6
inferred: 0.35
ambiguous: 0.05
base_confidence: 0.59
lifecycle: draft
lifecycle_changed: TIMESTAMP_DATE
created: TIMESTAMP
updated: TIMESTAMP
---
Use folded scalar syntax (summary: >-) for title and summary to keep frontmatter parser-safe across punctuation (:, #, quotes) without escaping rules.
Keep the title and summary contents indented by two spaces under summary: >-.
# Page Title
- A fact the codebase or a doc actually states.
- A reason the design works this way. ^[inferred]
Use [[wikilinks]] to connect to other pages.Write a `summary:` frontmatter field on every new/updated page (1–2 sentences, ≤200 chars), using >- folded style. For project sync, a good summary answers "what does this page tell me about the project I wouldn't guess from its title?" This field powers cheap retrieval by wiki-query.
Apply provenance markers per llm-wiki (Provenance Markers section). For project sync specifically:
Compute the rough fractions and write the provenance: block on every new/updated page.
updated timestamp and add the new source.index.md to see what's already there before creating anything new.After creating/updating pages:
[[wikilinks]] from new pages to existing related pages[[wikilinks]] from existing pages back to the new ones where relevant.manifest.jsonAdd or update this project's entry:
{
"projects": {
"<project-name>": {
"source_cwd": "/absolute/path/to/project",
"last_synced": "TIMESTAMP",
"last_commit_synced": "abc123f",
"pages_in_vault": ["projects/<project-name>/<project-name>.md", "..."]
}
}
}index.mdAdd entries for any new pages created.
log.mdAppend:
- [TIMESTAMP] WIKI_UPDATE project=<project-name> pages_updated=X pages_created=Y source_cwd=/path/to/projecthot.mdRead $OBSIDIAN_VAULT_PATH/hot.md (create from the template in wiki-ingest if missing). Rewrite Recent Activity with what was just synced — last 3 operations max. Update Active Threads if this project is an ongoing focus. Update Key Takeaways with the most important architectural insight or decision surfaced during this sync. Update updated timestamp.
Write conceptually: "Synced obsidian-wiki — added wiki-capture and wiki-research skills, core new capabilities are autonomous web research and conversation capture."
QMD_WIKI_COLLECTION)GUARD: If `$QMD_WIKI_COLLECTION` is empty or unset, skip this step. The markdown vault is the source of truth; QMD is only a search index.
Run this step only after pages, .manifest.json, index.md, log.md, and hot.md have been written. If Step 2 found no meaningful changes and the sync stopped early, do not refresh QMD.
This refresh currently requires the local QMD CLI. Use $QMD_CLI if set; otherwise use qmd. If the CLI is unavailable or returns an error, do not roll back the wiki update; report that the wiki was updated but QMD refresh was skipped or failed.
For CLI refresh:
${QMD_CLI:-qmd} updateIf the output says new hashes need vectors, or if pages were created/updated and embeddings may be stale, run:
${QMD_CLI:-qmd} embedVerify at least one created or materially updated page is visible in the wiki collection:
${QMD_CLI:-qmd} get "qmd://$QMD_WIKI_COLLECTION/projects/<project-name>/<page>.md" -l 5If the exact qmd:// path is uncertain, use:
${QMD_CLI:-qmd} ls "$QMD_WIKI_COLLECTION" | grep "<project-name>"Record QMD refresh in the final report as one of:
QMD refreshed: update + embed + verifiedQMD skipped: QMD_WIKI_COLLECTION unsetQMD skipped: qmd CLI unavailableQMD failed: <short error summary>concepts/react-server-components.md already exists. Update the existing one and add this project as a source.$VAULT/_meta/taxonomy.md if it exists, and use canonical tags.<project-name>.md file is what you'd read to get oriented. Make it good.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.