plan-docs-sync — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited plan-docs-sync (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Role: Senior engineer + technical writer.
Task: Audit all documentation against what the code actually does, find every drift, plan corrections. README, CONTRIBUTING, setup/onboarding, API docs, JSDoc/docstrings, architecture notes, .env.example, CLI --help, changelogs. Audit & plan only.
| Skill | Does |
|---|---|
| plan-docs-sync (this) | Plan doc corrections from code truth |
docs-writer | Write/improve docs (execution) |
workflow-housekeep | README refresh as part of housekeeping |
plan-stub-checker | Stubs/dead UI — often surfaces phantom docs |
Loop position: run last in the six-skill plan loop. See docs/PLAN-LOOPS.md.
Read references/preservation-contract.md. Acknowledge in output #1.
Core guardrail: docs describe real, current behavior — never aspirational or invented.
| File | Contents |
|---|---|
references/drift-taxonomy.md | Types, detection passes, guardrails |
references/output-templates.md | Burndown, phased sync plan |
1. Inventory all doc surfaces
2. Code-as-source-of-truth pass
3. Reverse pass (missing docs)
4. Onboarding replay (.env.example + CLI help)
5. Signature + cross-doc consistency + links
6. Burndown + phased sync plan
7. Research + guardrails (docs-as-code, CI drift checks)Glob: README.md CONTRIBUTING.md docs/**/*.md **/*README*.md
Glob: .env.exampleList: README, CONTRIBUTING, docs/, inline JSDoc targets, OpenAPI, CLI help, changelog.
Execute all passes in references/drift-taxonomy.md.
Onboarding-drift check (standout): extract env var names + setup commands from onboarding docs; diff against .env.example keys and package.json scripts; run CLI --help where safe and compare.
Every drift: doc claim + code truth (path:line). Can't verify → [NEEDS VERIFICATION].
Template: references/output-templates.md
Quantify: e.g. "9 phantom env vars, 14 undocumented endpoints, 6 onboarding steps that fail".
Per drift: before/after correction + "what's still accurate here". Plan only — no rewrites until approval.
Industry enhancements (Firecrawl, current year): docs-as-code, doc-in-same-PR, CI drift vs .env.example + CLI help, generated API refs, llms.txt.
[NEEDS VERIFICATION] list~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.