univer-cli — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited univer-cli (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Terminal-native authoring and inspection for multi-Unit .univer files. The CLI provides isolated worktrees, version-matched Facade guidance, model readback, and browser review.
Install:
npm install -g univer-cli
univer doctorUse these commands to compare the installed CLI with the latest public release:
univer --version
npm view univer-cli@latest version --registry=https://registry.npmjs.org/When a newer version is available, complete the current Univer task before updating:
univer update
univer doctor --json
univer skills get coreIf univer update reports that the shared daemon must stop, rerun it with --force after confirming that stopping the daemon is safe. Reload core and the target Unit Skill after every update.
This file is the discovery entry, not the operational guide. Before using Univer commands for a task, load the complete core Skill from the installed CLI:
univer skills get core # shared model, workflow, evidence, and handoff
univer skills get core --full # include direct references and templatesRuntime Skills ship with the CLI so their commands and Facade APIs match the installed version.
.univer path is the authoritative multi-Unit target. Always address the file explicitly.unitId; sheet names, pages,tables, ranges, shapes, and records live inside that Unit.
trunk is the reviewed main line. A worktree is an isolated scope for agent changes; there is noimplicit current worktree.
assertions, and inspect rendered output when appearance matters.
Use public CLI and Facade surfaces. The worktree commit path is the durable write boundary, and merge remains an explicit review decision.
After core, load the Skill matching the target top-level Unit before authoring:
univer skills get sheet
univer skills get doc
univer skills get slide
univer skills get base
univer skills get boardUse univer skills list to discover the installed set. Each Unit Skill owns its creation recipe, Facade entrypoints, readback guidance, and visual verification requirements.
For cross-Unit composition, load the additional Topic Skill after the host and child Unit Skills:
univer skills get embedFor a cross-Unit formula in a Sheet cell or formula-driven Shape, load its Topic Skill after the Host and Sheet or Base Source Unit Skills:
univer skills get cross-unit-formula| Task | Load and use |
|---|---|
| Inspect or edit spreadsheet values, formulas, formatting, charts, or tables | core + sheet |
| Create or refine document paragraphs, rich text, tables, charts, or page layout | core + doc |
| Build or review presentation pages, shapes, text, or images | core + slide |
| Create or edit structured Base tables, fields, records, or views | core + base |
| Create or edit a Board canvas, charts, and other elements | core + board |
| Embed one Unit inside another Unit | core + host Unit + child Unit + embed |
| Read a Sheet range or Base table column from a Sheet cell or formula-driven Shape | core + Host Unit + Source Unit + cross-unit-formula |
.univer target can contain Sheet, Doc, Slide, Base, and Board Units addressed by unitId.api show / api find resolves exact Facade symbols for the installed SDK.Do not edit .univer storage directly or substitute unrelated writers. Follow the loaded core and Unit Skills for the supported path.
univer --help
univer doctor
univer skills list
univer skills pathUse univer help <command> for exact syntax. If the CLI is unavailable or doctor reports a blocking runtime failure, stop and report the diagnostic instead of switching tools.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.