project-journal — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited project-journal (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A skill for the substantive operations on a project's journal/ directory: bootstrap, weekly summary writing, and INDEX refresh.
The journal lives at <repo-root>/journal/ and has three artifact types:
The full spec — purpose of each artifact, voice rules, when each one gets written — lives in ~/Developer/CLAUDE.md under "Project journal — journal/ directory". Read that section first before doing any journal work. This skill is procedural; that file is canonical.
journal/ directory and its initial INDEX + first entry on a project that doesn't have one.weekly/YYYY-Www-summary.md file.INDEX.md when it's gone stale.What this skill does NOT do:
~/Developer/CLAUDE.md handles that. The user shouldn't invoke a skill to write one entry.When the user asks to set up the journal on a project that doesn't have one yet.
~/Developer/CLAUDE.md "Project journal" section if you haven't already this session.AGENTS.md and CLAUDE.md (at repo root) for journal: disabled. If present, stop and tell the user.journal/ already exists at the repo root. If it does, ask whether the user wants the refresh workflow instead — bootstrap will create new files alongside existing ones, which is messy.Read enough of the repo to reconstruct an honest first entry. In rough order of value:
README.md — usually gives the elevator and the "what this is."package.json / pyproject.toml / equivalent — stack, project name.git log --oneline -100 — chronology of meaningful moves.git log --since="3 months ago" --pretty=format:"%h %ad %s" --date=short — recent activity in date order.WORKLOG.md if it exists — pre-digested session history./docs/prd.md, /docs/architecture.md if they exist — declared truth.AGENTS.md / CLAUDE.md at repo root — project conventions.Don't run heavy analysis on the codebase. The journal is a narrative summary, not an audit.
mkdir -p journal/entries journal/weeklyFile: journal/entries/<today-date>-<current-time>-bootstrap.md
Filename format: YYYY-MM-DD-HHMM-bootstrap.md. Use the actual current date and time.
The entry covers the project's arc up to today, based on what the repo shows. Use the daily entry template (in ~/Developer/CLAUDE.md's journal section, or fall back to the structure: What happened / Where we are now / What I believe / Open questions). No "Previous" pointer — this is the first entry.
Critical rules:
<verify: ...>. The user will fill these in.File: journal/INDEX.md
Use the INDEX structure from ~/Developer/CLAUDE.md:
Show the user both files. Walk through:
Ask: "Does this match how you'd describe the project? Anything to rewrite before I commit?"
Do not commit. The user reviews and commits.
When the user asks for a weekly summary, or when the start-of-Monday auto-offer fires.
journal/weekly/YYYY-Www-summary.md.If the target week file already exists, stop and ask whether the user wants to overwrite it (which breaks the immutability rule and should be a deliberate exception).
List the daily entries: ls journal/entries/ and filter to that week's date range. Read each one fully. Do not skim — the synthesis depends on understanding the through-line.
Find the most recent weekly summary file before this week, if any. Its filename goes in the "Previous week" pointer. If this is the first weekly summary, omit the pointer.
Use the weekly template structure: The week in one paragraph / What happened / State at end of week / Beliefs that changed / Carry-overs / Daily entries from this week.
Critical rules:
The weekly summary doesn't fully replace INDEX work, but it does require an INDEX update:
Same review/sign-off step as bootstrap. Do not commit.
When the user says INDEX is stale, or when you notice it's drifted significantly from current state.
Read INDEX.md end-to-end. Read the most recent 3-5 daily entries and the latest weekly summary. Categorize what's stale:
Refresh is more invasive than bootstrap. Show the diff before applying.
Write the updated INDEX.md. Update "Last refreshed" timestamp. Do not touch entries/ or weekly/ — those are frozen.
Show the user the final INDEX. Same review/sign-off pattern.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.