docs-writer — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited docs-writer (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Create clear, useful documentation for developers.
BEFORE writing any documentation, you MUST:
README.md (project root)
docs/ (existing docs)
src/[domain]/@_[domain]-README.md (feature-specific READMEs)Use Glob to find existing README files:
Glob: "**/*README.md" to find all READMEs
Glob: "**/*.md" in docs/ to find documentation patternsRead the actual code being documented to ensure accuracy:
Before writing docs, state:
"Pre-documentation check:
- Existing docs read: [list]
- Documentation pattern identified: [pattern from existing READMEs]
- Code verified: [files read to ensure accuracy]"# Project Name
Brief description of what this project does.
## Features
- Feature 1
- Feature 2
- Feature 3
## Quick Start
\`\`\`bash
# Install
npm install
# Run
npm start
\`\`\`
## Installation
### Prerequisites
- Node.js >= 18
- npm or pnpm
### Setup
\`\`\`bash
# Clone repository
git clone https://github.com/user/project.git
cd project
# Install dependencies
npm install
# Set up environment
cp .env.example .env
# Edit .env with your values
# Run development server
npm run dev
\`\`\`
## Usage
### Basic Example
\`\`\`typescript
import { Widget } from 'project';
const widget = new Widget({ option: 'value' });
widget.render();
\`\`\`
### Advanced Configuration
See [Configuration Guide](./docs/configuration.md)
## API Reference
See [API Documentation](./docs/api.md)
## Contributing
See [Contributing Guide](./CONTRIBUTING.md)
## License
MIT## createUser
Create a new user account.
### Signature
\`\`\`typescript
function createUser(params: CreateUserParams): Promise<User>
\`\`\`
### Parameters
| Name | Type | Required | Description |
|------|------|----------|-------------|
| name | string | Yes | User's display name |
| email | string | Yes | Valid email address |
| role | 'admin' \| 'user' | No | User role (default: 'user') |
### Returns
`Promise<User>` - The created user object
### Example
\`\`\`typescript
const user = await createUser({
name: 'John Doe',
email: '[email protected]',
role: 'admin'
});
\`\`\`
### Errors
| Error | Cause |
|-------|-------|
| `ValidationError` | Invalid email format |
| `ConflictError` | Email already exists |/**
* Calculate the total price including tax and discounts.
*
* @param items - Array of cart items
* @param taxRate - Tax rate as decimal (e.g., 0.1 for 10%)
* @param discount - Optional discount code
* @returns Total price in cents
*
* @example
* const total = calculateTotal(items, 0.1, 'SAVE10');
*/
function calculateTotal(
items: CartItem[],
taxRate: number,
discount?: string
): number {
// Sum up item prices
const subtotal = items.reduce((sum, item) => sum + item.price, 0);
// Apply discount if valid
const discountAmount = discount ? getDiscountAmount(discount, subtotal) : 0;
// Calculate tax on discounted amount
const taxableAmount = subtotal - discountAmount;
const tax = Math.round(taxableAmount * taxRate);
return taxableAmount + tax;
}# Architecture Overview
## System Components
\`\`\`
┌─────────────┐ ┌─────────────┐ ┌─────────────┐
│ Client │────▶│ API │────▶│ Database │
│ (React) │ │ (Node) │ │ (Postgres) │
└─────────────┘ └─────────────┘ └─────────────┘
│
▼
┌─────────────┐
│ Cache │
│ (Redis) │
└─────────────┘
\`\`\`
## Data Flow
1. Client sends request to API
2. API checks cache for data
3. If cache miss, query database
4. Store result in cache
5. Return response to client
## Key Decisions
### Why PostgreSQL?
- ACID compliance for financial data
- JSON support for flexible schemas
- Strong ecosystem
### Why Redis?
- Fast read performance
- Session storage
- Pub/sub for real-time features# ❌ Too verbose
This function is responsible for taking an array of user objects
and filtering them based on the active status property, returning
only those users who have an active status of true.
# ✅ Concise
Filter users by active status.# ❌ Abstract description
The function accepts configuration options.
# ✅ With example
Configure the logger:
\`\`\`typescript
const logger = createLogger({
level: 'info',
format: 'json',
output: 'stdout'
});
\`\`\`# ❌ Wall of text
To install the package you need to run npm install, then create
a .env file with your configuration, then run the migrations...
# ✅ Structured steps
## Setup
1. Install dependencies
\`\`\`bash
npm install
\`\`\`
2. Configure environment
\`\`\`bash
cp .env.example .env
\`\`\`
3. Run migrations
\`\`\`bash
npm run migrate
\`\`\`\`\`\`mermaid
flowchart LR
A[User] --> B[Frontend]
B --> C[API]
C --> D[Database]
C --> E[Cache]
\`\`\`\`\`\`mermaid
sequenceDiagram
User->>+API: POST /login
API->>+DB: Verify credentials
DB-->>-API: User data
API-->>-User: JWT token
\`\`\`# In PR template:
## Documentation
- [ ] README updated (if needed)
- [ ] API docs updated (if endpoints changed)
- [ ] Code comments added (for complex logic)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.