cli-forge-doc — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited cli-forge-doc (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Optimization: This skill uses on-demand loading. Heavy content lives in references/ and is loaded only when needed.Language rule: Skill instructions are written in English. When generating user-facing output, detect the project's primary language (from README, comments, docs, commit messages) and produce the documentation in that language. If the project is bilingual, ask the user which language to use before proceeding.
Diacritics rule: When the chosen output language uses diacritics (French, Spanish, Portuguese, etc.), render them correctly — including on capitals (É, À, Ç, Ô…). Never strip accents to ASCII: write "sécurité" not "securite", "Rôle" not "Role". ASCII-flattened French is a defect, not a style.
Writing style: Favor clarity — short sentences, one idea per sentence, plain words. A metaphor only when it clarifies. Keep one consistent register (impersonal/infinitive for operational docs). Separate narrative prose, meant to make the reader understand, from telegraphic content (tables, commands, checklists) which stays terse for action.
No fabricated output: Never invent command output, console captures, API responses, metrics, or logs. When real output is needed, emit a clearly-marked placeholder (🚧 "replace with a real capture"), never plausible-but-fake text presented as real.
Generate production-grade documentation for any Git project, optimized for both AI agents and human readers.
Four principles stolen from the best, plus one operational rule:
../gotchas.md before producing output to avoid known mistakes$ARGUMENTS is the path to the Git repository (or current directory if empty).
If no argument: look for a Git repo in the current working directory.
Before writing a single line of doc, read the project. This is non-negotiable.
1. List the root directory
2. Read: README.md, CONTRIBUTING.md, Cargo.toml, package.json, pyproject.toml, go.mod, Makefile, Dockerfile, docker-compose.yml, .gitlab-ci.yml, .github/workflows/*, justfile
3. Identify: primary language(s), build system, CI/CD, test framework, deployment method
4. Sample 10-15 key source files (entry points, public API, core modules)
5. Read: docs/ directory if it exists
6. Check: git log --oneline -20 for recent activity focus
7. Check: git remote -v for repo URLBuild a mental model of:
Before generating, score what exists. Use the Documentation Completeness Index (DCI).
DCI = Σ(wᵢ × sᵢ) / Σ(wᵢ) × 10
Where:
wᵢ = weight of item i (importance)
sᵢ = score of item i (0.0 to 1.0)| # | Item | Weight | What to check |
|---|---|---|---|
| 1 | Project overview (README or equivalent) | 5 | Exists, has purpose statement, not just boilerplate |
| 2 | Getting started / quickstart | 5 | Can a new dev go from clone to running in <10 min? |
| 3 | Architecture overview | 4 | High-level structure documented somewhere |
| 4 | API reference (public surface) | 5 | Doc comments on public items, generated docs |
| 5 | Configuration reference | 3 | All config options documented with defaults |
| 6 | Error handling guide | 3 | Error types, what they mean, how to fix |
| 7 | Deployment / operations guide | 3 | How to deploy, monitor, troubleshoot |
| 8 | Contributing guide | 2 | How to contribute, code style, PR process |
| 9 | Changelog / release notes | 2 | History of changes |
| 10 | License | 1 | Exists and is clear |
| 11 | CI/CD documentation | 2 | Pipeline stages, environments, secrets needed |
| 12 | Security documentation | 3 | Threat model, auth flows, secrets management |
| 13 | Troubleshooting / gotchas guide | 3 | Known issues, workarounds, common mistakes documented |
| 14 | Examples / tutorials | 4 | Working, tested, progressive complexity |
| 15 | Inline doc coverage (public API) | 4 | % of public items with doc comments |
| 16 | Cross-references & linking | 2 | Types linked, related items connected |
Scoring guide: 0.0 = absent, 0.25 = stub/placeholder, 0.5 = exists but incomplete, 0.75 = good but gaps, 1.0 = excellent.
Output the DCI score table and overall score before proceeding.
Beyond raw scoring, run a compliance gap analysis based on project type:
| Project type | Required docs (gap analysis target) |
|---|---|
| Library | README, CHANGELOG, LICENSE, API_REFERENCE, CONTRIBUTING, SECURITY |
| CLI tool | README, --help, man page or equivalent, CHANGELOG, LICENSE, examples |
| Service | README, ARCHITECTURE, DEPLOYMENT, OPERATIONS, SECURITY, MONITORING, RUNBOOK |
| Infrastructure | README, ARCHITECTURE, NORMS_DEVIATIONS, OPERATIONS, TROUBLESHOOTING, CIS_AUDIT (if applicable) |
Output:
Gap Analysis — {project-type}
Compliance: 7/10 required docs present (70%)
Missing (prioritized by impact):
1. SECURITY.md (high — required for production)
2. RUNBOOK.md (medium — required for on-call)
3. CHANGELOG.md (low — semantic-release may auto-generate)All project knowledge is distributed into standard documentation files. No AI-specific markers are generated by default.
OPSEC rationale: Files named AGENTS.md, CLAUDE.md, or llms.txt score DREAD 8.8/10 — they expose full architecture, credential patterns, and gotchas in files explicitly labeled for AI consumption. During a security audit (CIS, SOC 2, PCI-DSS, ISO 27001, defense contracts), these files signal AI involvement in development, raising accountability and supply chain concerns. Standard documentation files carry the same content with zero signal.
When the requested documentation is an operations/exploitation pack (signals: exploitation, operations, runbook, N1/N2/N3, support tiers, PDF, DOCX, export, livrable documentaire), generate a self-contained dossier rather than a link-only index.
Rules for this mode:
input to an external PDF/DOCX export tool. Do not add repository export scripts, Make targets, Pandoc wrappers, or generated PDF/DOCX artifacts unless the user explicitly asks for export automation.
operations dossier must contain the minimum operational facts needed to act: scope, roles, severity, triage, commands, escalation, rollback, closure, request/change flow, known errors, and continual improvement.
needed for N1/N2/N3 to act, include the usable version directly in the pack. Do not put external source/provenance paths in operator-facing pages by default; they make the pack look dependent on files outside the dossier.
Role:, Quand utiliser cette page:, and `Sortieattendue: (or project-language equivalents). Role: must describe the page's operational function in the dossier, such as INDEX N1, PROCEDURE N2 ROLLBACK, KEDB N2, or RACI EXPLOITATION; do not use abstract doc-maintenance roles like CANON, MAP, or NEW for operations packs. Sortie attendue:` must be an actionable operational output, not "open the canonical source".
operational content to be usable on its own within its support level. Keep maintenance provenance outside operator-facing pages unless explicitly asked.
tier codes like T0/T2/T3/T4 with plain operational labels such as local quick test, integration test, target/VM test, or release gate unless the pack defines the shorthand locally.
.artifacts/incident-*, status.txt, logs.txt) when writing N1/N2/N3 procedures. Operators usually already have ITSM, monitoring, on-call, or evidence tools. Specify the required information to capture and transmit, not the storage tool or file layout, unless the user explicitly asks for a project-local evidence convention.
LIVRET.md by default. The directory is thedeliverable: README.md is the entry point, and each module/procedure file is part of the self-contained pack. Create a linear printable synthesis only if the user explicitly asks for one. Keep export mechanics outside the project unless explicitly requested.
All project context is placed in standard files. An AI agent reads these files naturally — no special format needed.
| Content | Standard destination |
|---|---|
| Stack, Architecture | docs/explanation/architecture.md |
| Domain Concepts | docs/explanation/glossary.md or docs/reference/glossary.md |
| Key Patterns, Conventions | docs/explanation/architecture.md (section "Conventions") |
| Commands | README.md (section "Usage" or "Commands") |
| Gotchas, known issues | docs/TROUBLESHOOTING.md |
| Commit rules, git workflow | CONTRIBUTING.md |
| CI/CD validation | docs/reference/ci-cd.md |
Rules:
docs/ for details, don't inline everythingIf any AI-specific files exist in the project, absorb their content and delete them:
| File | Tool | Absorb into |
|---|---|---|
CLAUDE.md | Claude Code | CONTRIBUTING.md |
GEMINI.md | Gemini CLI | CONTRIBUTING.md |
AGENTS.md | Codex/multi-tool | docs/explanation/architecture.md |
llms.txt, llms-full.txt | Generic | docs/index.md |
.cursorrules, .cursor/rules/*.mdc | Cursor | CONTRIBUTING.md (coding conventions) |
.windsurfrules, .windsurf/rules/*.md | Windsurf | CONTRIBUTING.md |
.github/copilot-instructions.md | Copilot | CONTRIBUTING.md |
.aider.conf.yml | Aider | Discard (tool config, not project knowledge) |
After absorption:
.gitignore (.cursor/, .windsurf/, .aider*, .claude/, .continue/, .junie/)cli-git-conventional --audit-markers for cleanup options--ai-markers flag)When explicitly requested with --ai-markers, additionally generate:
AGENTS.md — flat LLM context file (< 300 lines) with Stack, Architecture, Domain Concepts, Key Patterns, Commands, Gotchasllms.txt — documentation index following llmstxt.org standardllms-full.txt — (optional, small projects) single concatenated file with all doc content inlineThese files duplicate content already in the standard docs. They exist only for convenience when OPSEC is not a concern.
This layer serves humans — from newcomers to experts. Follow the Diátaxis framework strictly: tutorials, how-to guides, reference, explanation. Never mix modes.
Read references/diataxis.md for the full directory structure, writing rules per quadrant, design doc template, and progressive complexity funnel.
After generation, run the doc-audit framework on the result. See reference.md for the full audit methodology.
This checklist + the Doc Debt threshold form this skill's post-verification gate before publishing; the 3-phase definition-of-done structure (pre → during → post) is canonical in ../shared/done-gate.md.
For each generated file, verify:
? not unwrap()?Doc Debt = (Public Items − Documented Items) / Public Items × 100
Thresholds:
0-10% → Green (healthy)
10-25% → Yellow (needs attention)
25-50% → Orange (significant debt)
50%+ → Red (documentation emergency)At minimum, produce:
CONTRIBUTING.md — Commit rules, git workflow, PR processdocs/explanation/architecture.md — Full architecture, domain concepts, conventionsdocs/TROUBLESHOOTING.md — Gotchas, known issues, workaroundsdocs/index.md — Human landing pagedocs/tutorials/getting-started.md — First-contact tutorialdocs/reviews/DCI-REPORT.md — Documentation completeness index with scores and recommendationsIf the project warrants it (public API, library, complex system), also produce:
docs/design/000-template.md — Design doc template for the team to reusePresent the DCI score first, then the generated files. Summarize:
| Condition detected | Recommend | Why |
|---|---|---|
| Project has shell scripts undocumented | /cli-audit-shell | Assess script quality for doc accuracy |
| Architecture section reveals coupling concerns | /cli-audit-tangle | Topology audit |
| README needs rewrite | /cli-forge-readme | Focused README generation |
Rule: Recommend, don't auto-execute.
reference.md).<!-- NEEDS-REVIEW: [reason] --> rather than guessing.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.