docmd-dev — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited docmd-dev (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when the user wants to modify the docmd framework itself, not a site that consumes it. This skill is loaded by npx docmd-skills dev <dir> and adds docmd-dev/ alongside an existing docmd-skills/ install.
Use it when any one of these signals is true:
docmd/ (the GitHub path is docmd-io/docmd/). Telltale markers: pnpm-lock.yaml, packages/core/src/, packages/ui/src/, packages/api/src/, packages/plugins/<name>/, packages/engines/. To clone it: git clone https://github.com/docmd-io/docmd.git docmd && cd docmd.packages/core/src/, packages/api/src/, packages/ui/src/, packages/plugins/*/src/, or packages/engines/*/ of the docmd monorepo.If the user wants framework help but no `docmd/` clone exists in the working directory, ask before doing anything: would they like you to clone the monorepo (git clone https://github.com/docmd-io/docmd.git docmd) or refresh an existing one (git -C docmd pull)? Do not start editing framework source without an up-to-date local clone.
Do not use it for: site-level configuration or operations (use docmd-skills), or for page-prose quality (use docmd-writer).
pnpm commands against the monorepo.Each row is a reference file. The CLI column shows which install subcommand adds this file.
| Reference | CLI install subcommand | Use it for |
|---|---|---|
references/api-dev.md | docmd-skills dev | Public Node API for framework authors: EngineLoader, URL utilities, createActionDispatcher, TemplateSlot, hook/action contracts |
references/plugin-development.md | docmd-skills dev | Authoring a docmd plugin: package shape, manifest, apply() lifecycle, template capability, hooks, testing |
references/template-development.md | docmd-skills dev | Authoring a docmd theme/template: 12 template slots, asset pipeline, manifest.json, template plugins |
references/engines.md | docmd-skills dev | JS vs Rust build engines, swapping engines, engine-specific config, performance trade-offs |
No clone yet — clone and install:
git clone https://github.com/docmd-io/docmd.git docmd
cd docmd
pnpm installExisting clone — refresh and re-install dependencies if needed:
git -C docmd pull
pnpm installTo check whether a clone is behind before deciding, run git -C docmd status (look for "Your branch is behind") or git -C docmd log -1 --oneline and compare to <https://github.com/docmd-io/docmd/commits/main>.
The local clone directory is docmd/ (not docmd-io/docmd/). Inside it you will find the canonical package layout referenced throughout this skill.
references/plugin-development.md end-to-end before scaffolding.packages/plugins/<name>/ and copy its shape.references/api-dev.md for the Plugin type, hook names, and the template capability introduced in 0.8.7.tests/; the monorepo's pnpm prep runs the universal failsafe.references/template-development.md for the 12 template slots and the asset pipeline.packages/templates/summer/ is the reference).references/api-dev.md for the TemplateSlot union (no header slot — there are 12).references/engines.md first — confirms which engine you're targeting and its config keys.references/api-dev.md § "Engine Loader API".~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.