oma-docs — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited oma-docs (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Keep documentation aligned with repository behavior and report verification limits.
Check references, update docs for a code diff, identify translation drift, or lint localized prose.
Repository documentation verification, diff-based synchronization, and translation maintenance.
Mode (verify, sync, i18n, or lint), target paths or diff range, and authorized edit scope. Use verify when no mode is specified.
Findings with paths and evidence, authorized patches when requested, and unresolved checks. CLI reports remain distinct from host-authored interpretation.
The oma docs CLI, Git for diff-based work, and repository docs. lychee is optional for URL verification. Read resources/commands.md for flags and output files of the selected mode.
verify: extract and resolve references, then summarize the report.sync: obtain candidates, read relevant docs and diffs, and apply only authorized corrections.i18n / lint: report drift or style issues; use oma-translation for authorized corrections.| Failure | Recovery |
|---|---|
| Missing CLI | State up front that the automated check is unavailable, then inspect manually anyway: list the target markdown files, extract [text](path), , and href/src targets, resolve each relative to its containing file, and report which resolved paths are missing. Skip http(s) URLs and note them as unverified scope. Label the result "manual inspection — oma docs verify did not run"; never present it as CLI output and never make installing the CLI a prerequisite |
| Missing lychee or incomplete URL scan | Report core results and the unverified URL scope |
| One document cannot be parsed | Record the skipped file and continue other documents |
| Patch does not apply | Re-read the affected current content and make the equivalent authorized correction |
| Index write fails | Report the failure; do not claim the index or check is complete |
Report verified findings, edits made, and remaining gaps. A clean reference scan does not establish semantic correctness or complete translation quality.
resources/commands.md.oma docs verify --json, oma docs sync <range> --json, oma docs i18n --json, or oma docs lint --json as appropriate. For sync, use the requested range; otherwise staged changes, then HEAD~1..HEAD.docs.sync-patch-approval; bind instanceId and verification --instance to the doc path plus current patch revision (workflow Step 4 owns the command template). Existing authorization remains sufficient. Ask only about material missing decisions or new scope; continue independent work while waiting.Verification regenerates docs/generated/doc-refs.json; optional URL results go to docs/generated/url-drift.json. Sync's CLI emits candidate data; the host drafts and applies patches. i18n/lint commands report only. A workflow hook runs only when docs.auto_verify is enabled and is warn-only.
../_shared/core/execution-policy.md for authorization and completion..env*, private keys, credentials) in diff reports.oma-docs: skip, and configured exclusions. Missing gitignored runtime outputs are skipped, not broken references.resources/commands.md (selected operation only).../oma-translation/SKILL.md (localized correction).../_shared/core/execution-policy.md (when not already provided).~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.