📚 Only Cite what you can verify
SaferSkills independently audited onecite (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill to turn raw references, DOI lists, arXiv IDs, PMID/ISBN-like identifiers, GitHub URLs, Zenodo/DataCite DOIs, or existing BibTeX into verified BibTeX output through the OneCite pipeline.
canonical metadata lookup.
API-layer check before being trusted.
.bib file, reference audit, or template discovery.or be reported as a failure.
against academic APIs; it does not prove that a citation supports a claim.
onecite benchmark --json first for deterministic offline regressionchecks; it uses bundled fixtures and does not require network access.
onecite process ... for citation metadata lookup; unless test fixturesor mocks are explicitly configured, process mode may contact upstream APIs.
onecite benchmark --live --json only when the user explicitly wantscurrent upstream source behavior.
From the repository root:
python -m pip install -e ".[dev]"Use the repository's virtual environment when one exists:
.venv/bin/python -m onecite.cli --helpProcess a plain-text reference file:
onecite process references.txt -o references.bib --quietProcess an existing BibTeX file:
onecite process references.bib -o cleaned.bib --quietProcess a direct identifier:
onecite process "10.1038/nature14539"List available fallback templates:
onecite templates --jsonRun the deterministic benchmark regression check:
onecite benchmark --jsonCheck the local install, bundled resources, skill package, and offline benchmark gate:
onecite doctor --jsonProduce an automation-friendly validation envelope:
onecite process references.txt --json --fail-on-unresolvedStream newline-delimited events:
onecite process references.txt --ndjsonUse live APIs for an upstream spot check:
onecite benchmark --live --jsontraceability.
references.txt, or use theuser's existing .bib file directly.
onecite process ... --quiet to generate BibTeX.onecite process ... --json --fail-on-unresolved when a script needsa strict machine-readable gate.
onecite benchmark --json before reporting regression-check results.onecite doctor --json before reporting that the local installationhas the expected automation or CI resources.
failed_entries, warnings, and duplicates in the processreport, benchmark case failures, and doctor failed checks.
warnings with type text_metadata_mismatch: the entry resolved from itsDOI, but the surrounding input text appears to describe a different work — the classic hallucinated title+DOI pairing. Surface this to the user for review; do not silently accept the entry.
duplicates: the same work appeared more than once in the batch (bareDOI, PMID, formatted citation). It was emitted once; cite the listed bib_key.
failed_entries[].reason tells you the correct follow-up:doi_not_found — the DOI does not exist in CrossRef or DataCite;likely fabricated or mistyped. Do not retry unchanged; flag it.
no_strong_identifier — ambiguous plain text; run onecite suggestand have the result reviewed. Never promote a candidate to verified output yourself.
source_error — a source errored; retrying later may succeed.pmid_unresolved / isbn_unresolved — the lookup found no record(nonexistent identifier or source unavailable/rate-limited).
onecite suggest returns **candidates for review, not verifiedcitations**. Check each suggestion's sources list: a status other than ok (and an entry status ending in _incomplete) means a scholarly index was rate-limited or errored and the correct match may be missing from the list entirely.
match_score as no-confidence: do not present a topcandidate as "the match" just because it ranks first. A year_conflict flag in score_breakdown means the candidate's year contradicts the year the query cites.
onecite process "<doi>" — never hand-assemble an entry from candidate fields.
Run the labelled non-fabrication evaluation (offline, deterministic):
onecite benchmark --anti-hallucination --jsonIt reports the resolution rate on real identifiers, the non-fabrication rate on ambiguous/fabricated inputs, and the mismatch detection rate on real DOIs paired with a different paper's title.
README.md; choose one scoped Roadmapitem or one explicit maintenance follow-up.
python -m pytest
flake8 src/onecite tests --statistics --count
onecite benchmark --json
onecite doctor --json
python -m build --wheelgenerated archive or wheel hashes.
references or failed checks are reported explicitly.
For automation handoff, include:
.bib path when one was written,onecite benchmark --json,onecite doctor --json,onecite process --json status when strict validation was used,For repository changes to OneCite itself, do not mark the Roadmap done unless these checks pass from the repository root:
python -m pytest
flake8 src/onecite tests
onecite benchmark --json
onecite doctor --json
python -m build --wheelFor handoff, include the exact commands run, the pass/fail summary, the commit or diff reference, and any ZIP/wheel hash. Do not use live APIs for the default gate unless the user explicitly requests upstream-current behavior.
.bib file is being treated as text, pass --input-type bib.--google-scholar; otherwise leave it off for deterministic runs.
--live.onecite doctor --json fails, fix the missing resource or failingbenchmark before relying on package-level results.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.