trail-scriber — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited trail-scriber (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this when the user asks for any version of:
This skill is for reconstruction from evidence, not generic summarization.
You are turning scattered agent conversations into a durable work trail:
The work is interpretive. Tools can locate candidate conversations, dates, roots, and session ids, but they must not replace judgment.
Read like a colleague reconstructing a workday from traces, not like a keyword classifier.
Prefer the user's messages. Assistant answers are optional evidence: read them only when the user's message is ambiguous, when a tool result is needed to confirm what happened, or when provenance matters.
Do not lazily assign domains by hard-coded keyword rules. Keywords may help triage candidates, but the final agenda/domain call must come from the conversation's intent, repository context, date context, and follow-up corrections.
Before deep extraction, identify:
days/, agendas/, domains/, conversations/, months/, event-ledger.md, README.mdIf the user wants to discuss structure first, pause extraction and reason about topology before writing.
The core behavior is host-agnostic. Codex skills, Claude commands, shell wrappers, and future scheduled runners should all resolve into one of these modes.
Use normal mode when the user gives an explicit date or date range.
Examples:
$extra:trail-scriber May 14 day by day/extra:trail May 14 day by dayUse trail-scriber to do May 14 day by day.Normal mode should not infer a backlog from state unless the user asks for it.
Use catch-up mode only when the user explicitly says:
catch-upcatch upbackfill from last scanscan from last trail pointprocrastinateprocrastinate is an alias for catch-up mode. It is a friendly invocation word, not a separate workflow.
Examples:
$extra:trail-scriber catch-up$extra:trail-scriber procrastinate/extra:trail catch-up/extra:procrastinateUse trail-scriber procrastinate mode.In catch-up mode:
<output-root>/.trail-scriber/state.json if it exists.last_scanned_through_date.last_scanned_through_date through today.If no state file exists, do not guess an unbounded backlog. Ask for a starting date, or use the explicit date/range supplied in the same request.
State file shape:
{
"schema": 1,
"last_scanned_through_date": "2026-05-17",
"last_successful_run_at": "2026-05-18T03:10:00+08:00",
"last_mode": "catch-up"
}Always establish one output root before writing notes. Do not write trail notes outside that root.
Resolve the output root in this order:
TRAIL_SCRIBER_OUTPUT_ROOT from the environment.~/.config/trail-scriber/config.toml with:output_root = "$HOME/dev/hadi/trail"days/, agendas/, domains/, conversations/, or months/.Treat public plugin docs as examples only. Do not hardcode a private absolute path into the skill itself.
Use commands only to create a map of candidate material:
Do not generate final summaries directly from command output. The map is a reading queue.
For each date, read the relevant user messages in chronological clusters. If a conversation spans multiple dates, split the evidence by date and link the same source note to multiple days only when both dates have real user activity.
Dates are not agenda identity. A three-day conversation can contain one agenda, several agendas, or one agenda that shifts into another. Decide from the user's intent.
When assigning the workstream, weigh:
If confidence is weak, say so in the note instead of forcing certainty.
Use the existing vault style under the resolved output root when present. Default topology:
<output-root>/days/YYYY-MM-DD.md
<output-root>/agendas/<agenda-slug>.md
<output-root>/domains/<DOMAIN-NAME>.md
<output-root>/conversations/<host-or-breadcrumb-id>-<short-slug>.md
<output-root>/months/YYYY-MM.md
<output-root>/event-ledger.md
<output-root>/README.mdDay notes should answer, plainly:
Agenda notes should gather repeated work across days without becoming a dump of every link.
Domain notes should stay higher-level. They explain the bigger shape, not every task.
Conversation notes should preserve source identity and enough context to re-find the raw trace without leaking secrets.
Link for meaning, not maximum edge count.
Use links that help navigation:
Avoid linking every note to every other note. Dense graphs become unusable even when every individual link is technically true.
If a date or month has no local evidence, do not invent work. Add a quiet no-evidence note only when it helps the continuity of the trail.
Example posture:
No local Codex/Claude evidence found for this month in the available logs.
This is a coverage marker, not proof that no work happened.Codex sessions usually keep richer local transcripts. Use session paths and ids as source anchors. Prefer local date from the user's timezone, not just UTC path segments, when exact day boundaries matter.
Claude may prune heavy project transcripts. If only history.jsonl, todo files, or other breadcrumbs remain, treat them as lower-fidelity evidence. It is valid to create notes from breadcrumbs, but label the confidence and do not pretend a full transcript was available.
When Codex and Claude both touched the same agenda, preserve host provenance. The question is not "which agent owns the agenda"; it is "what did the user orchestrate, and through which tools?"
Never copy raw secrets from transcripts into trail notes.
Redact or generalize:
Write "API key setup", "database URL", "wallet seed material", or "provider credentials" instead of the secret value.
Run a focused secret scan before committing if raw conversation material was read.
Before calling the trail done:
git diff --checkgit status --short and separate your changes from unrelated dirty filesBe plain and chronological. Do not over-formalize the user's life into corporate categories.
Good language:
Bad language:
Call this workflow Trail Scriber.
Display name: Conversation Trail Scriber.
The name pairs with memory-scriber: memory-scriber captures one session's durable residue; trail-scriber reconstructs a multi-day evidence trail across many sessions.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.