docent-doctor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited docent-doctor (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are responsible for getting docent ready to render a film, or for confirming it still is. Two paths to walk depending on whether docent is already on PATH:
docent not on PATH)The user just installed the skills via apm install and has never used docent before. You need to clone the engine, bootstrap the cascade, and put the docent CLI on PATH.
Detect this case by running command -v docent. If it returns nothing, take Path A.
Execute these steps in order. Walk through each with the user so they see what's happening; do not paste the whole block silently.
DOCENT_HOME="${XDG_DATA_HOME:-$HOME/.local/share}/docent/engine"Tell the user this is where the engine will live — about 1 GB after bun install + uv sync + Kokoro weights. They can override by exporting DOCENT_HOME before re-running.
command -v bun returns nothing, stopand tell the user:
docent requires bun. Install it first:
curl -fsSL https://bun.sh/install | bash
exec $SHELL -l
Then re-invoke /docent-doctor.Bun is the only prerequisite docent itself can't bootstrap (it is the runtime that runs the bootstrap).
mkdir -p "$(dirname "$DOCENT_HOME")"
if [ -d "$DOCENT_HOME/.git" ]; then
git -C "$DOCENT_HOME" pull --ff-only
else
git clone https://github.com/benelser/docent "$DOCENT_HOME"
fiuv sync pullstorch + transformers + kokoro, Kokoro downloads ~300 MB of voice weights, and bun install materializes Remotion. Allow 3-8 minutes on a warm machine, longer on a cold one.
cd "$DOCENT_HOME" && bun packages/agent/scripts/doctor.ts --install --yesThat command installs uv, ffmpeg, gh, apm if missing; writes ~/.local/bin/docent (the shim that lets you call docent <cmd> from any cwd); and records DOCENT_HOME at ~/.config/docent/home. Show the user the live output — every step is labeled.
command -v docent && docent env | head -5If command -v docent returns nothing, the shim is installed but ~/.local/bin is not on PATH. Print:
Add ~/.local/bin to PATH:
echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc
exec $SHELL -land stop.
$DOCENT_HOME)failing check ids
/docent-explain <subject>" as the next stepdocent already on PATH)The user has docent installed and wants a health check or a repair.
docent doctor --install --yesThis re-runs every check and installs anything missing — Kokoro weights got evicted, node_modules got blown away by a clean-slate, ffmpeg got upgraded oddly, etc. Show the user the raw output (it is already formatted with per-stage grouping and remediation hints on every failure).
If docent doctor exits 0, print Ready and suggest /docent-explain <subject>.
If it exits non-zero, list the failing check ids by stage so the user can resume mid-setup, and explain what each one means in one line.
Required by cascade stage:
bun, gitclaude or codex on PATH (the agentthat authors the spec); apm (the install channel)
uv, the .venv materialized, the Kokoro voice weightscached
ffmpeg, ffprobe, Remotion (from bun install), andthe docent shim on PATH
Optional (warnings, not failures): gh-auth (interactive — docent ar and the PR poster need it eventually), manim (only films with a manim/<id> directory use it).
These are not docent bugs — they are how the codex plugin CLI behaves today. Knowing them up front saves debugging time when something is silently wrong:
An absolute path is silently accepted by codex plugin marketplace add but codex plugin list -m <name> then shows "no plugins found in marketplace <name>" — no error, no warning. The docent repo's .agents/plugins/marketplace.json uses ./packages/agent (relative) for this reason.
directory path. If the user already has a marketplace named docent (e.g. from a prior install), codex plugin marketplace add <newpath> refuses to add a second one with the same name. They can either codex plugin marketplace remove docent first, or accept that the existing one will be re-resolved.
Cached files live at ~/.codex/plugins/cache/<marketplace>/. If a re-install gets stuck reading stale skills, the fix is rm -rf ~/.codex/plugins/cache/docent/ and re-running codex plugin add docent-agent@docent.
If the user reports "I installed but /docent-doctor doesn't show up in Codex", check these three before anything else.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.