doc-daemon — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited doc-daemon (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
internal/daemon/)Background agent that onboards with the server, maintains a WebSocket connection, manages Docker image builds, spawns Claude CLI chat sessions, and manages git worktrees.
domain/)OnboardingResult — AccessToken, RefreshToken, NodeID, NodeName, ModeProjectInfo — ID, Name, GitURLDaemonState — StateDisconnected, StateOnboarding, StateConnectedBuildID, BuildStatus — pending, building, success, failedDockerBuild — ID, DockerfileSlug, Version, ImageHash, ImageSize, Status, BuildLog, timestampsServerAuth — RefreshDaemonToken(nodeID, refreshToken) → accessTokenServerOnboarding — CompleteOnboarding(code, nodeName) → OnboardingResultServerConnection — RunWithReconnect(ctx), Send(msg)ProjectFetcher — GetProject(token, projectID) → ProjectInfoChatUploader — UploadJSONL(token, projectID, featureID, sessionID, filePath)config/config.go)~/.config/agach/daemon.yml (or AGACH_SERVER_URL env var)app/)app.go)States: Init → Onboarding → Connected → Reconnecting → Stopped
Run(ctx) — onboard → connect WS → handle events until stoppedchat.start, chat.user_msg, chat.end, chat.ping
tokens.go)~/.config/agach-daemon/tokens.json (0600 permissions)chat.go)--output-format stream-jsonChatSession tracks: ID, FeatureID, ProjectID, ClaudeSessionID, WorktreePath,token counts, model, message count, timestamps
docker.go)ListImages(ctx) — groups builds by dockerfile slugRebuild(ctx, slug, eventCh) — creates build record, streams eventsGetBuildLogs(ctx, buildID) — returns build logPruneNonLatest(ctx, eventCh) — removes all but latest per sluggit.go)~/.cache/agachEnsureWorktree(projectID, gitURL, mainBranch) — clone or fetch+pullclient/)AuthClient — POST /api/daemon/refreshOnboardingClient — POST /api/onboarding/complete (error codes: CODE_NOT_FOUND, CODE_EXPIRED, CODE_ALREADY_USED)ProjectClient — GET /api/projects/{projectID}WSClient — WebSocket with exponential backoff reconnect (1s → 30s max)ChatUploadClient — POST multipart JSONL uploadinbound/ws/)func(ctx, daemonws.Message) (daemonws.Message, error)outbound/sqlite/)builds table: id, dockerfile_slug, version, image_hash, image_size, status, build_log, timestampspkg/daemonws/)docker.list / docker.rebuild / docker.logs / docker.prunebuild.event (slug, build_id, status, log), prune.event (slug, removed, total)chat.start → ChatStartRequest (session_id, feature_id, project_id, node_id, resume_session_id)chat.user_msg → ChatUserMessage (session_id, content)chat.end → EndSessionchat.ping → RefreshActivitychat.message, chat.stats, chat.end, chat.error, chat.ttl_warninginit.go)-init flag (create default config)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.