audit-clerk-skill — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited audit-clerk-skill (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Cross-check skills/core/clerk-cli/ in this repository against the actual Clerk CLI source and propose precise edits where the skill has drifted. The CLI is the source of truth; the skill is maintainer documentation that must track it.
This task needs a complete command inventory, not a quick grep pass. Build the source model first, then compare it to the skill's current claims.
clerk/cli checkout containing packages/cli-core/src/commands/**, plus packages/cli-core/src/cli.ts, cli-program.ts, mode.ts, and any referenced files in packages/cli-core/src/lib/.skills/core/clerk-cli/SKILL.md and skills/core/clerk-cli/references/*.md.Resolve the CLI source checkout in this order:
--source <path> when supplied. The path must contain packages/cli-core/src/commands/.packages/cli-core/src/commands/, use the current repository root.CLERK_CLI_REPO is set, use that path. Do not print the variable value if it contains sensitive path fragments.../cli/*/packages/cli-core/src/commands/. If multiple match, ask which one to use..context/clerk-cli-source:mkdir -p .context
cd .context
git clone --depth 1 https://github.com/clerk/cli.git clerk-cli-sourceIf none of these work, stop and ask the user for a CLI source path. Do not audit against the installed clerk binary alone, because the binary may be stale and does not expose every source-level branch.
Walk packages/cli-core/src/commands/ and build a structured inventory. For each top-level command and subcommand capture:
clerk config patch or clerk api ls.isAgentMode(), CLERK_MODE, TTY detection, or related helpers.--dry-run, --yes, or production-targeting guidance.Read packages/cli-core/src/commands/<name>/README.md as secondary context only. Use those files to flag mocked or stubbed commands and to cross-check API endpoint claims in references/recipes.md. Do not propose copying command READMEs into this repository; they include internal implementation detail and would bloat the skill.
Also capture cross-cutting behavior:
--app, and --instance targeting.doctor checks and --json output shape.clerk init --prompt or equivalent handoff behavior if the skill mentions it.Prefer reading source over running the binary. When runtime behavior is unclear, use tests under packages/cli-core/src/**/*.test.ts or packages/cli-core/src/test/ as supporting evidence.
Read skills/core/clerk-cli/SKILL.md and each file under skills/core/clerk-cli/references/. Extract every concrete claim:
SKILL.md and references/*.md.Produce a structured diff with four buckets:
clerk <cmd> --help, generated examples, or referenced files cover better.For buckets 1 through 3, cite both the source file and line and the target skill location.
Route changes by maintenance value:
SKILL.md.references/recipes.md or a new reference file.references/agent-mode.md; SKILL.md gets only a concise summary.references/auth.md.Prefer clerk <command> --help over duplicating generated help. Flags with destructive semantics, hidden interactions, or agent-mode divergence deserve skill coverage. Self-explanatory flags should usually be removed from prose and delegated to --help.
Treat skill shrinkage as a valid proposal when it reduces drift risk. The goal is an accurate, durable skill, not a larger one.
Emit a review-ready proposal. For each change include:
skills/core/clerk-cli/SKILL.md or skills/core/clerk-cli/references/agent-mode.md.drift, gap, or polish.packages/cli-core/src/commands/<cmd>/<file>.ts:<line>.Group the proposal by target file. Do not rewrite accurate neighboring sections just because they are nearby.
Default behavior: present the proposal and stop for review.
If invoked with --apply, apply drift and gap edits directly, then list polish suggestions for review. After applying edits, run available formatting or validation commands for this repository. If no formatter exists, validate Markdown and JSON structure with lightweight checks.
clerk-cli skill's terse, third-person voice.skills/core/clerk-cli/SKILL.md near the 500-line guidance. Move detailed material to references/ instead of bloating the main skill.clerk binary as authoritative over source. Use --help only to confirm generated presentation when source and tests leave ambiguity.Return the proposal as:
# clerk-cli skill audit - <YYYY-MM-DD>
## Summary
<counts per bucket, plus the largest drift>
## skills/core/clerk-cli/SKILL.md
### <section name>
- [drift|gap|polish] <one-line description>
- source: packages/cli-core/src/commands/<...>:<line>
- target: skills/core/clerk-cli/SKILL.md:<line>
- change: <diff or concise before/after>
## skills/core/clerk-cli/references/<file>.md
...
## New files
...
## Open questions
...Keep the result skimmable so a maintainer can approve, reject, or apply each entry independently.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.