spec-index — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited spec-index (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill to turn one-off discoveries into durable project memory and to retrieve that memory when a later task would benefit from it.
This skill is about memory with reuse value, not generic note taking. Capture decisions, setup knowledge, root causes, fix patterns, and constraints in a form that future planning and correction work can actually use.
references/template.md defines the canonical Markdown entry shape, YAML frontmatter, category field, and trigger tag fields.scripts/index.py provides deterministic add, best-match search, audit, and rebuild commands for Markdown knowledge bases.Prefer the script for creating, searching, auditing, and rebuilding the index when the local environment can run Python. If the script cannot run, follow the same template manually and explain why the deterministic helper was not used.
Before retrieving or saving memory, look for a SPEC.md in the target repository root.
If it exists, treat it as the repository-specific preference layer for:
If it is missing, use the built-in defaults for this skill series instead of blocking on the missing file.
If it is partial, use the fields it defines and fall back to defaults for the rest.
When no repository root SPEC.md is available, use these defaults:
docs/knowledge-base/docs/knowledge-base/index.mdreferences/template.mdscripts/index.pyspec-plan and spec-crlp.Choose one mode from the user's intent:
If the user asks to "整理", "调查", "audit", "clean up", "review existing knowledge", "update old notes", "merge duplicates", or "fix tags", use investigate mode.
Use one primary category per entry:
decision: durable architecture, product, workflow, or tooling decisionconstraint: requirement boundary or non-obvious long-term limitationsetup: environment, dependency, installation, or configuration prerequisiteroot-cause: confirmed cause of an observed failurefix-pattern: reusable correction strategy for a recurring class of bugsimplementation-pattern: reusable implementation approachpitfall: known trap, anti-pattern, or edge case to avoidvalidation: lint, test, build, CI, or verification ruleIf an entry seems to fit multiple categories, choose the category that best explains why future work should retrieve it.
Trigger tags are retrieval hooks, not documentation prose.
Build tags from signals that future users, logs, or code searches are likely to contain:
type:<category>phase:planning, phase:correction, phase:setup, or phase:retrievaldomain:<area>component:<component-name>framework:<framework-name>tool:<tool-name>symptom:<observed-behavior>error:<normalized-error-name>file:<normalized-file-name>env:<environment-name>Prefer lowercase, hyphenated tags. Keep them specific enough to retrieve the entry later, but avoid one-off tags that no future query is likely to use.
scripts/index.py search against the knowledge-base root when Python is available.SPEC.md when present, otherwise use the built-in default location.Use scripts/index.py search --explain when the reason for a match matters. The search helper uses weighted best-match scoring across trigger tags, titles, frontmatter fields, summaries, Applies When, root-cause sections, resolutions, and validation text. Treat search results as candidates to inspect, not as proof.
references/template.md.scripts/index.py add when Python is available so the entry and index are updated deterministically. The helper automatically adds the type:<category> trigger tag if it is missing.Use this workflow when maintaining an existing knowledge base:
SPEC.md when present, otherwise use the built-in default location.index.md and scan all memory entries under the knowledge-base root.Applies When, and add validation context.scripts/index.py audit when Python is available to get a deterministic structural report.scripts/index.py rebuild when Python is available.Check each entry for:
typetrigger_tagsSummaryApplies When section that explains retrieval conditionsDecision Or Root Cause section with validated knowledge, not speculationResolution Or Rule section that is actionableValidation section that explains how the knowledge was confirmed or should be checkedCheck the index for:
index.mdPrefer this structure after investigating existing memory:
# Knowledge Base Investigation
## Scope
## Summary
## Entries Reviewed
## Changes Applied
## Recommended Updates
## Duplicates Or Conflicts
## Broken Or Missing Index Links
## Needs Human Review
## Rebuild StatusPrefer the bundled references/template.md when saving or presenting memory. The entry should include this shape:
# Memory Entry
## Title
## Context
## Applies When
## Decision Or Root Cause
## Resolution Or Rule
## Validation
## Tags
## Related Files Or SystemsPrefer a structure like this when returning matches:
# Relevant Memory
## Match
## Why It Matters
## Key Takeaway
## Recommended Next StepUse the storage location defined in the repository root SPEC.md when present.
If no repository root SPEC.md is available, default to docs/knowledge-base/ and docs/knowledge-base/index.md.
When adding or changing entries, use scripts/index.py rebuild after manual edits to keep index.md synchronized.
If the default storage location is clearly unsuitable for the task or the repository is read-only, present the normalized memory entry in the response and explain that persistent storage could not be updated.
spec-plan when they are worth preserving.spec-crlp.spec-plan when planning a new task with similar constraints.spec-crlp when debugging a failure that resembles a known issue.SPEC.md when repeated memory entries reveal a repository-specific convention that should become explicit.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.