contentrain-content — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited contentrain-content (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Generate and save content entries for models already defined in the project.
The user wants to create new content, add entries to a collection, populate a singleton, or says something like "add a blog post", "create content", "fill in the hero section".
contentrain_describe before writing content (know the schema)i18n: truenpx contentrain generate after adding new models or changing fieldsCall contentrain_status to get the full project context:
If .contentrain/ does not exist, stop and suggest running /contentrain-init first.
If the user specified a model, use it. Otherwise:
Call contentrain_describe(model: "<model-id>", include_sample: true) to get:
If the user's request does not match an existing model, offer to create one first with contentrain_model_save.
.contentrain/vocabulary.json for canonical terms. All content must use these terms consistently across locales. Do not use alternative spellings or synonyms for vocabulary-defined terms..contentrain/context.json for tone conventions (professional, casual, technical).contentrain_content_list on the target model and scan existing values. If the value you intend to write already exists under a different key, REUSE the existing key instead of creating a new one. MCP will also warn you via advisories in the save response if duplicates are detected.Create content following the rules in content-quality.md:
min, max, pattern, and options constraints.unique field values do not collide with existing entries..contentrain/context.json → conventions.tone..contentrain/vocabulary.json if it exists.content-quality.md Section 3.contentrain_content_list to match the established style and structure.Relation integrity: For relation and relations fields, verify referenced entries exist by calling contentrain_content_list on the target model.
For fields that affect SEO (from seo-rules.md):
Show the user the content draft before writing. Include:
Wait for user confirmation before proceeding.
Call contentrain_content_save with the approved content. The tool takes model and an entries array:
contentrain_content_save({
"model": "<model-id>",
"entries": [
{ "locale": "en", "data": { "field": "value" } }
]
})Kind-specific entry format:
{ "locale": "en", "data": { "title": "My Site", "cta": "Get Started" } } -- no id or slug.{ "id": "optional-id", "locale": "en", "data": { "name": "John", "role": "CEO" } } -- omit id to auto-generate, provide id to update.{ "slug": "getting-started", "locale": "en", "data": { "title": "Getting Started", "body": "# Welcome\n..." } } -- slug is required, use "body" key for markdown content.{ "locale": "en", "data": { "auth.login": "Log In", "auth.logout": "Log Out" } } -- flat key-value pairs, no id or slug.Critical rules:
status, source, updated_by, approved_by) in data. These are managed in meta files, not content. Temporal data (created/updated timestamps) comes from git history.After contentrain_content_save, check the response for an advisories field. If present:
If the project has multiple supported locales and the model has i18n: true:
i18n-quality.md rules:vocabulary.json for approved term translations.contentrain_content_save for each target locale.If the user defers translations, note incomplete locales in the final summary.
Call contentrain_validate to check all changes:
Fix any errors reported. Acknowledge any warnings.
For large content operations (10+ entries), also recommend running contentrain doctor --usage to detect unused keys and duplicate values across the project.
Call contentrain_submit to push branches to remote:
contentrain_submit pushes unmerged contentrain/* branches to the remote.auto-merge mode, branches are already merged to the base branch during the write operation.review mode, branches are pushed for team review.Report the Studio URL if provided in the tool response -- the user can review and approve content there.
When new models are created or fields change, regenerate the SDK client:
npx contentrain generateThis updates TypeScript types for the new content. See: contentrain-generate skill.
Report to the user:
/contentrain-generate to update SDK types if models changed.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.