weekly-work-log — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited weekly-work-log (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Builds and refreshes the Weekly Work Log at brycewatson.com/report: a per-project feed of the specific work Bryce did last week, each item with an honest status badge and an expandable evidence drawer, a git-derived commits/day chart for the week, and per-project archive pages. Each week's report is snapshotted; brycewatson.com/log is the index of all past weekly reports.
Routes: /report (live, current week) · /report/<project> (per-project commit-history archive) · /log (index of weekly reports) · /log/<week> (an archived week).
Target project: %USERPROFILE%\Projects\brycewatson.com. The page + build scripts live there; this skill is the reusable orchestrator + the weekly scheduler.
The report always covers the most recently completed Monday–Sunday week (a week completes on Sunday). Run on a Sunday night, that is the week that just ended; run any other day, it is the previous full week. Discovery (handoffs + git), the chart, and the per-project metrics all use this same week. It is anchored on the calendar week, never a rolling window walking back from today.
Everything runs LOCALLY (it reads ~/.claude handoffs + the sibling repos under %USERPROFILE%\Projects\); GitHub Pages CI cannot. The committed JSON is what CI builds, exactly like art.json/books.json.
<repo>/src/data/work-log.source.json — AUTHORED, approval-gated content (the human gate).<repo>/src/data/work-log.json — GENERATED + committed (every number re-derived + git-verified).<repo>/src/data/reports/<weekStart>.json + reports/index.json — committed per-week snapshots (the /log archive series); the generator writes these.<repo>/src/components/ReportPanel.astro — the report panel, shared by /report and /log/<week>.<repo>/src/pages/report.astro + report/[project].astro + log.astro + log/[week].astro — the pages.<repo>/scripts/draft-work-log-from-handoffs.mjs — discover (handoffs → redacted digest).<repo>/scripts/build-work-log.mjs — build (re-derive + verify every commit, redact).<repo>/scripts/work-log-weekly.mjs — open the review PR (never main, never deploy).<repo>/scripts/lib/work-log-redact.mjs — shared secret/leak scrubber.source.json → build → preview. This is where new items get WRITTEN (judgment).node scripts/draft-work-log-from-handoffs.mjs (from <repo>). Scans the week's session-end handoffs across the allowlisted repos, extracts tagged claims + reversals + cited commits, redacts, writes the gitignored src/data/work-log.drafts.json digest.source.json. For each strong, git-verifiable, leak-clean candidate not already present, write a distilled item into source.json. Conservative: when unsure, leave it out. Obey every rule below.node scripts/build-work-log.mjs. Re-derives every date/number from git, rewrites commit snippets to the real subject, verifies all cited commits resolve (aborts if any do not), redacts. Writes work-log.json.pnpm dev, open http://localhost:4321/report (archive index at /log).work-log.json (+ source.json if edited). A merge to main deploys via CI. (Unattended: node scripts/work-log-weekly.mjs opens the PR instead of committing to main.)shipped (built, merged, verified), in progress, designed, not proven (machinery exists, no real result yet). The most interesting work is often the least finished; let it wear the badge openly. Map a handoff's [verified] claim → shipped; [assumed]/[unverified]/[handoff-claimed] → designed-not-proven.[email protected] / [email protected]) aborts the build. Item dates come from the commit, not the prose.archive → link to /report/<project> (6-month commit history). Dark console aesthetic; the shared site header uses headerVariant="dark-canvas". No "projects these came from" strip (its content lives in the project cards).main and never deploys. It only opens a PR. Bryce reviews + merges; CI deploys the merge.A local Windows scheduled task runs the deterministic weekly flow.
node ~/.claude/skills/weekly-work-log/install.cjs — registers a schtasks job ClaudeWeeklyWorkLog for Sundays at 22:00 that runs weekly-run.cmd (cd to the repo → draft-work-log-from-handoffs.mjs → work-log-weekly.mjs → PR), logging to .local-state/weekly.log.cmd /c "%USERPROFILE%\.claude\skills\weekly-work-log\weekly-run.cmd" — runs the flow once; opens a PR only if the committed data changed.node ~/.claude/skills/weekly-work-log/uninstall.cjs (or schtasks /Delete /TN ClaudeWeeklyWorkLog /F).HEAD.gh authenticated; git push credentials for the user; the repo on a clean main.main; never deploy; only ever open a PR.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.