token-formatter — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited token-formatter (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Convert verbose documentation, markdown, and text files into token-efficient formats while preserving essential information.
Invoke this skill when:
/token-format, /compress, /toonBefore:
## Introduction
In this document, we will explore and discuss the various different ways
that you can implement authentication in your application. We will cover
multiple approaches and methods that are available to developers.After:
## Auth Implementation
Methods covered:
- JWT tokens
- Session-based
- OAuth2| Verbose | Compressed | |
|---|---|---|
| function | fn | |
| return | ret | |
| string | str | |
| number | num | |
| boolean | bool | |
| array | arr | |
| object | obj | |
| parameter | param | |
| configuration | config | |
| environment | env | |
| authentication | auth | |
| authorization | authz | |
| application | app | |
| database | db | |
| repository | repo | |
| directory | dir | |
| reference | ref | |
| implementation | impl | |
| documentation | docs | |
| information | info | |
| example | ex | |
| required | req | |
| optional | opt | |
| default | def | |
| maximum | max | |
| minimum | min | |
| and | & | |
| or | \ | |
| with | w/ | |
| without | w/o | |
| versus | vs | |
| approximately | ~ | |
| greater than | > | |
| less than | < | |
| equals | = | |
| not equals | != | |
| therefore | => | |
| because | bc |
Before:
The following features are included:
- User authentication with JWT tokens
- Role-based access control for authorization
- Password hashing using bcrypt algorithm
- Session management with Redis store
- Two-factor authentication supportAfter:
Features:
- JWT auth
- RBAC authz
- bcrypt passwords
- Redis sessions
- 2FA supportRemove these words when possible:
Before (prose):
The API endpoint accepts three parameters. The first parameter is called
"userId" which is a required string that identifies the user. The second
parameter is "limit" which is an optional number that defaults to 10.
The third parameter is "offset" which is also optional and defaults to 0.After (structured):
Params:
- userId: str (req) - user ID
- limit: num (opt, def=10)
- offset: num (opt, def=0)Before:
// This function validates the user input
// It checks if the email is valid and the password meets requirements
function validateUserInput(email: string, password: string): boolean {
// Check if email is valid
const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
const isEmailValid = emailRegex.test(email);
// Check if password is at least 8 characters
const isPasswordValid = password.length >= 8;
// Return true if both are valid
return isEmailValid && isPasswordValid;
}After:
fn validateUserInput(email: str, password: str): bool {
return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email) && password.length >= 8;
}Before:
| Parameter Name | Type | Required | Default Value | Description |
|---------------|------|----------|---------------|-------------|
| userId | string | yes | none | The unique identifier for the user |
| limit | number | no | 10 | Maximum number of results to return |
| offset | number | no | 0 | Number of results to skip |After:
| Param | Type | Req | Def | Desc |
|-------|------|-----|-----|------|
| userId | str | Y | - | user ID |
| limit | num | N | 10 | max results |
| offset | num | N | 0 | skip count |Before:
# Comprehensive Guide to User Authentication and Authorization
## Chapter 1: Introduction to Authentication Concepts
### Section 1.1: Understanding the Basics of User IdentityAfter:
# Auth Guide
## 1. Intro
### 1.1 Identity BasicsBefore:
The configuration file is located at `/Users/username/Documents/Projects/MyApp/config/settings.json`After:
Config: `~/Projects/MyApp/config/settings.json`Before:
Error: The authentication token that was provided in the request header
is either invalid, expired, or has been revoked. Please obtain a new
token by logging in again through the authentication endpoint.After:
Err: Invalid/expired token. Re-authenticate at /auth/login# [Compressed Title]
## Summary
[1-2 line summary]
## Content
[Compressed content using rules above]
---
Original: X tokens | Compressed: Y tokens | Saved: Z%Original (847 tokens):
Welcome to the User Management API documentation. This comprehensive guide will walk you through all the available endpoints and explain how to use them effectively in your application.
Before making any API requests, you need to authenticate your application. Authentication is handled through JWT (JSON Web Tokens). To obtain a token, send a POST request to the /auth/login endpoint with your credentials.
The request should be sent as JSON with the following structure: {"email": "[email protected]", "password": "your_password"}
A successful authentication will return: {"token": "eyJhbGciOiJIUzI1NiIs...", "expiresIn": 3600, "tokenType": "Bearer"}
Compressed (312 tokens):
JWT-based. Get token via POST /auth/login
Req: {"email": "[email protected]", "password": "..."} Res: {"token": "eyJ...", "expiresIn": 3600, "tokenType": "Bearer"}
Saved: 63%
Original:
This project was created to solve the problem of managing user data in a scalable and efficient manner. It provides a comprehensive set of tools and utilities that developers can use to build robust applications.
To install this project, you will need to have Node.js version 18 or higher installed on your system. Run: npm install && npm run dev
Compressed:
Scalable user data management tools.
Requires: Node.js 18+ Run: npm install && npm run dev
Two Python scripts are available in the scripts/ directory to help automate the compression and validation process.
For accurate token counting (optional but recommended), install tiktoken:
pip install tiktoken(If not installed, scripts will fallback to character count estimation).
compress.py)Automatically applies common compression rules (filler removal, abbreviations, symbols).
Usage:
# Compress a file
python .claude/skills/token-formatter/scripts/compress.py input.md > compressed.md
# Compress input from pipe
cat input.md | python .claude/skills/token-formatter/scripts/compress.py --level 2
# Show stats
python .claude/skills/token-formatter/scripts/compress.py input.md --statscount_tokens.py)Counts tokens in files or text input.
Usage:
# Count tokens in files
python .claude/skills/token-formatter/scripts/count_tokens.py document.md README.md
# Count tokens from pipe
echo "Hello World" | python .claude/skills/token-formatter/scripts/count_tokens.pyTOON replaces data serialization formats when sending to LLMs. ~40% fewer tokens.
Uniform arrays of objects (same fields per item) from JSON/YAML/XML.
JSON:
{"users":[{"id":1,"name":"John","role":"admin"},{"id":2,"name":"Jane","role":"user"}]}TOON:
users[2]{id,name,role}:
1,John,admin
2,Jane,user"This contains JSON/YAML/XML data for LLM input. Convert to TOON for ~40% token savings?"
See: .claude/skills/document-skills/toon/SKILL.md
fn=function ret=return str=string num=number
bool=boolean arr=array obj=object param=parameter
config=configuration env=environment
auth=authentication authz=authorization
db=database repo=repository dir=directory
req=required opt=optional def=default
max=maximum min=minimum ex=example
impl=implementation docs=documentation& = and | = or
w/ = with w/o = without
=> = therefore ~ = approximately
Y = yes N = no
- = none/null~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.