documentation-generation — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited documentation-generation (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Good documentation is the gift you give your future self and your team. It is NOT optional.
Core principle: Documentation describes behavior, not code. If the code changes, update the docs.
Iron Law:
DOCS ARE OUTDATED THE MOMENT THEY ARE WRITTEN — AUTOMATE OR ACCEPT THE DEBTA good README answers: What is this? How do I run it? How do I use it?
# Project Name
One-sentence description of what this does and who it's for.
## Quick Start
\`\`\`bash
npm install
npm run dev
\`\`\`
## Features
- Feature 1: Brief description
- Feature 2: Brief description
## Installation
\`\`\`bash
# Prerequisites
node >= 18
npm >= 9
# Install
npm install
# Configure
cp .env.example .env
# Edit .env with your values
# Run
npm start
\`\`\`
## Configuration
| Variable | Required | Default | Description |
|----------|----------|---------|-------------|
| `PORT` | No | `3000` | Server port |
| `DATABASE_URL` | Yes | — | PostgreSQL connection string |
## API Reference
See [API Documentation](./docs/api.md) for full reference.
## Contributing
See [CONTRIBUTING.md](./CONTRIBUTING.md).
## License
MIT# API Reference
## Authentication
All endpoints require Bearer token:
\`\`\`
Authorization: Bearer <token>
\`\`\`
## Endpoints
### GET /users
List all users.
**Parameters:**
| Name | Type | Required | Description |
|------|------|----------|-------------|
| `page` | integer | No | Page number (default: 1) |
| `limit` | integer | No | Per-page count (default: 20, max: 100) |
**Response:**
\`\`\`json
{
"data": [{ "id": "123", "email": "[email protected]" }],
"meta": { "total": 42, "page": 1 }
}
\`\`\`
**Errors:**
| Code | Status | Description |
|------|--------|-------------|
| `UNAUTHORIZED` | 401 | Missing or invalid token |
| `FORBIDDEN` | 403 | Insufficient permissions |# ADR-001: Use NestJS for MCP Server
**Date:** 2024-01-15
**Status:** Accepted
## Context
We need a Node.js framework for the MCP server with dependency injection and testability.
## Decision
Use NestJS with TypeScript.
## Rationale
- Built-in dependency injection for testable code
- Decorator-based approach matches MCP patterns
- Strong TypeScript support
- Module system aligns with MCP's separation of concerns
## Consequences
- Higher initial complexity than Express
- Requires understanding of NestJS modules
- Excellent testing support out of the boxFollow Keep a Changelog format:
# Changelog
## [Unreleased]
### Added
- New feature X
## [1.2.0] - 2024-01-15
### Added
- Support for SSE transport mode
- Bearer token authentication for SSE
### Changed
- Improved error messages for invalid rules
### Fixed
- Memory leak in rule file watcher
### Security
- Fixed token exposure in debug logs
## [1.1.0] - 2024-01-01
...# Understand the project structure
ls -la
cat package.json
git log --oneline -20 # Recent changes for CHANGELOG
# Find existing documentation
find . -name "*.md" -not -path "*/node_modules/*"For TypeScript projects, extract JSDoc/TSDoc:
/**
* Search rules by query string.
* @param query - Search term to match against rule content
* @param options - Optional filters
* @returns Matching rules sorted by relevance
*/
async searchRules(query: string, options?: SearchOptions): Promise<Rule[]>For configuration:
// Extract environment variables
grep -rn "process.env\." src/ | grep -o "process\.env\.[A-Z_]*" | sort -uPrinciples:
- [ ] All code examples are runnable
- [ ] Environment variables list matches .env.example
- [ ] API endpoints match actual routes
- [ ] Prerequisites match actual requirements
- [ ] Links are not broken| Mistake | Fix |
|---|---|
| Documenting code, not behavior | Describe what it does, not how |
| Outdated examples | Add docs to definition of done |
| No quick start | First 5 minutes → working system |
| Wall of text | Use tables, code blocks, lists |
| Missing error docs | Document failure modes |
| Internal jargon | Write for a new team member |
# TypeScript → API docs
npx typedoc --out docs/api src/
# Markdown linting
npx markdownlint-cli "**/*.md"
# Link checking
npx markdown-link-check README.md
# CHANGELOG generation from git log
npx conventional-changelog-cli -p angular~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.