creating-corpus — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited creating-corpus (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A corpus is the unit of self-contained material the matrix operates on: sources, references, distillations, lenses, builds, and packaged releases all live inside one folder. This skill scopes a new corpus—tier, domain, naming, task axes—and then invokes scripts/create-corpus.py to do the deterministic filesystem scaffold.
Dialogue skill, not a generator. The operator is in the conversation throughout. The skill produces scoping decisions captured in the corpus-level README.md; the script produces the directory tree.
corpus.commons/ or corpus.local/ and wants to talk through the tier decision before committing.python scripts/create-corpus.py {target} --tasks t1,t2 directly.ingesting-resources, not this skill.creating-tasks (scope the axis) plus creating-applications (assemble the application), not this skill.corpus.commons/demo/ or with an operator's existing corpus.local/ corpora.Three things, in order:
State what's coming. Read aloud to the operator:
A corpus is a self-contained directory: sources, references, distillations, lenses, builds, packaged releases, all inside one folder. The first decision is tier:corpus.commons/is tracked and shareable,corpus.local/is gitignored and private. The second is task axes: what does this corpus help its consumer do? After this dialogue we'll invoke the deterministic scaffolder; you'll fill in sources separately via the ingesting-resources skill.
Confirm the operator wants to proceed.
The corpus lives in one of two tiers:
corpus.commons/ must be redistributable under an open or open-nc licence. Future contributors PR new corpora here.Three diagnostic questions sharpen the choice:
a. Is every source you intend to ingest covered by an open or open-nc licence? If yes, corpus.commons/ is admissible. If no, or if any source is copyrighted, confidential, or personal, the corpus belongs in corpus.local/.
b. *Do you have explicit permission to redistribute the derived artefacts (deep references, distillations) as well as the sources? Some licences allow citation but not redistribution of substantive paraphrase. If unclear, default to `corpus.local/` and decide later. Folder moves between tiers* are the only re-tier operation; nothing structural changes.
c. Is this corpus material you want to make available to other operators? Even open-licensed material doesn't have to go in corpus.commons/: that tier is for material the operator is willing to vouch for under their handle as part of the public repo's contribution surface. corpus.local/ is fine for "this is open-licensed but I don't want to maintain it as a public artefact."
Commit the tier in one short paragraph: which tier, and why. The tier is provisional through Phase 2; if the scope discovery in Phase 4 surfaces material above the tier's admission ceiling, restart this phase.
Every corpus has a domain. Name it in verbs and nouns: what does this corpus help its consumer do? Not "a coaching corpus": that's a genre. "A corpus for facilitating blameless incident reviews and post-action retrospectives in engineering teams, grounded in resilience-engineering and adjacent organisational-behaviour material (Dekker, Edmondson, Cook, Rasmussen).": that's a domain.
Slug conventions:
The dialogue's task: produce a one-paragraph domain statement and confirm the slug.
A task axis is what the consumer of the corpus does with it. One source can be projected onto multiple task axes; each projection is a distinct distillation. Choose deliberately.
Discipline:
Each task axis is a verb-and-noun job (matches the creating-tasks discipline). "Decision-making" is acceptable. "Strategy" is not.
The dialogue's task: name the task axes as comma-separated slugs (kebab-case), confirm each is a verb-and-noun job, and check the count is in [1, 4] unless the operator explicitly defends more.
The scaffold stops at slugs and directory stubs; full task scoping is downstream work in creating-tasks. Stubs include placeholders for both routing layers (phase-routing macro, runtime listener micro); if creating-tasks later produces a task spec with a field-2a seed table, creating-applications seeds the listener-table placeholders from it.
If the operator has a clear set of first sources in mind, name three to five. The point isn't to ingest them now (that's ingesting-resources); it's to:
corpus.commons/, the tier needs to change or the source needs to go elsewhere. If the operator names a CC-BY-SA source while targeting corpus.commons/ with max_scope: open-nc, the build's scope filter will admit it but the operator should know.If the operator doesn't have first sources in mind, that's fine: they can hand off to finding-resources to triage candidates after the scaffold. The skill records this as "first sources TBD" in the README.
Recommend the script invocation. Hand off:
Run python scripts/create-corpus.py {target-path} --tasks {comma-separated-slugs} to scaffold. The script auto-creates the parent tier directory if missing, refuses if the target is non-empty, and lays out the standard tree. The scoping decisions from this dialogue go into the corpus-level README the script generates: paste them in afterwards, or have the skill open the README and edit it directly.After the operator runs the script (or after the skill runs it with operator confirmation), the corpus exists. The dialogue's last act is to populate the corpus-level README with the scoping decisions: domain paragraph, owner, scope range, licence summary, named task axes, intended first sources.
Name the next steps explicitly:
{target-path}/sources/ingest/. The finding-resources skill helps triage candidates before commit.sources/original/, the converted markdown in sources/converted/, deep + light references, and per-task distillations.{target-path}/apps/{profile}/.corpus.commons/ to keep options open. Push back: defaults that leak private material into the public tier are the worst-case outcome. If unsure, scaffold under corpus.local/: moving the folder later is cheap.sources/ingest/ before the dialogue closes. Hold the dialogue line through Phase 5; the scaffold needs the task axes to lay out the right directories.--tier). The skill won't recommend the script invocation until tier is confirmed.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.