keploy-docs — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited keploy-docs (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 6 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 6 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
keploy/keploy alters user-visible behavior: a new or renamed CLI flag, a changed default, a new command, a new configuration field, a new on-disk file format.Do not touch docs for internal refactors, CI changes, performance work, or bug fixes that don't change user-visible behavior. The docs are a contract with users — edit only when the contract changes.
github.com/keploy/docs — Docusaurus 2 site, published at https://docs.keploy.io..nvmrc pins the project; the CI workflows use Node 20. Use nvm use before yarn.yarn (classic — yarn.lock present). npm install also works and is what CI runs.keploy-docs/
├── docs/ # Shared content (components, GSoC, Hacktoberfest). NOT feature docs.
├── versioned_docs/
│ ├── version-4.0.0/ # ← LATEST VERSION. All feature-doc edits go here.
│ ├── version-3.0.0/ # Archived. Touch only for explicit back-ports.
│ ├── version-2.0.0/ # Archived.
│ └── version-1.0.0/ # Archived.
├── versioned_sidebars/
│ ├── version-4.0.0-sidebars.json # Sidebar for v4 — update when adding a new page.
│ └── ...
├── versions.json # Ordered list; first entry ("4.0.0") is current.
├── src/ # Site React code (theme, components). Infrastructure, not content.
├── plugins/ # Docusaurus plugins. Infrastructure.
├── static/ # Images, binary assets.
├── STYLE.md # Keploy-specific prose rules (see §Style).
├── CONTRIBUTING.md # Contribution flow.
├── ADDING_A_QUICKSTART.md # Checklist for new quickstart guides.
└── .vale.ini, vale_styles/ # Vale prose linter config.This is non-negotiable. The current version listed in versions.json is 4.0.0, and the first entry in that file is always the live one. Editing version-3.0.0/ (or older) only changes archived pages that users see under a banner explaining they are out of date.
Before editing, run head -n1 versions.json (or open the file) and confirm the current version. If it has rolled over to 5.0.0 by the time you read this, edit versioned_docs/version-5.0.0/ instead.
Do not put new feature docs under the top-level docs/ directory — that folder holds components and programme pages (GSoC, Hacktoberfest), not product content.
Grep versioned_docs/version-4.0.0/ for the feature name (and its synonyms) before creating a new file. Most features have a home.
Add a new page only when:
When you add a page you must also:
versioned_sidebars/version-4.0.0-sidebars.json under the correct section.id, title, sidebar_label, description, tags, keywords.my-new-feature, not myNewFeature).ADDING_A_QUICKSTART.md step by step.STYLE.md)Docs follow the Google Developer Documentation Style Guide and the Microsoft Writing Style Guide for anything Google doesn't cover. On top of that:
Test-Case, Test-Set, Test-Run, Mock, Normalise when referring to the feature. Generic usage stays lowercase and should be rare.How to record your first test, not How To Record Your First Test.Install Keploy, not Installing Keploy.Keploy records the calls, not The calls are recorded by Keploy.5–10 GB, not 5-10 GB.bash, go, yaml, json).Vale enforces a subset of this (see §CI).
NOTE: ONLY REPRODUE THESE CI PIPELINES IF YOU ARE NOT CONFIDENT THAT IT WILL PASS IN CI/CD.
Every PR against keploy/docs runs the following GitHub Actions. All must be green before merge. Each one is listed below with what it checks and how to reproduce it locally so you fix problems before the CI cycle.
Deploy PR Build and Check (.github/workflows/build_and_check.yml)npm install && npm run build.Reproduce locally:
yarn # or: npm install
yarn build # same as CI's `npm run build`If yarn build is slow, yarn start (dev server at http://localhost:3000) catches most issues faster and lets you visually verify the page renders.
Check Docusaurus docs with Vale linter (.github/workflows/vale-lint-action.yml)versioned_docs/ with filter_mode: diff_context and fail_on_error: true. It only flags lines you added or modified, not pre-existing issues..vale.ini and vale_styles/. Uses the Google style pack plus a custom vocabulary (vale_styles/config/Vocab/Base/).error — warnings do not fail the build, but fix them anyway.Reproduce locally (Vale via Homebrew: brew install vale):
vale versioned_docs/version-4.0.0/<path-to-your-edit>.mdCommon failures: unspelled Keploy-specific terms (add them to vale_styles/config/Vocab/Base/accept.txt), capitalization of Keploy terms, passive voice in Google-pack rules.
Lint Codebase (.github/workflows/lint.yml)wagoid/commitlint-github-action@v5 on every commit in the PR.<type>(<scope>): <subject> with type in feat | fix | docs | style | refactor | test | chore | build | ci | perf | revert.docs:.just be careful writing the commit messages — the rules are not surprising.
Prettify Code (.github/workflows/prettify_code.yml)--check mode on changed .js and .md files..prettierrc.json: printWidth: 80, proseWrap: preserve, tabWidth: 2, semi: true, no bracketSpacing, double quotes, trailing commas (es5), arrowParens: always.Reproduce locally:
npx [email protected] --check versioned_docs/version-4.0.0/<path-to-your-edit>.md
# To auto-fix:
npx [email protected] --write versioned_docs/version-4.0.0/<path-to-your-edit>.mdPin Prettier to 2.8.8 — a newer version will reformat differently and the CI diff will fail.
CLA (.github/workflows/cla.yml)CodeQL (.github/workflows/codeql.yml)greetings.ymlRun all of these from the docs repo root before pushing:
yarn # install
yarn build # pipeline 1
vale versioned_docs/version-4.0.0/<your-file>.md # pipeline 2
git log origin/main..HEAD --format='%s' # eyeball pipeline 3
npx [email protected] --check versioned_docs/version-4.0.0/<your-file>.md # pipeline 4Only push when all four are clean.
docs/<short-kebab> — e.g. docs/rename-test-sets-clarify.docs: <what changed> in present-tense imperative, under ~70 chars. Use docs(<scope>): if a scope helps (docs(quickstart): add flask-redis sample).git commit -s. Do not hand-construct the Signed-off-by trailer.--amend past a failing hook — fix and create a new commit.--no-verify.Follow the PR template that is followed in docs repository.
Same rules as keploy-pr-workflow. Docs are read by everyone — even the most innocent-looking example can leak a real customer. Before committing:
example.com, app.example.com, localhost:8080.sk-xxxxxxxx, Bearer <token>.[email protected], user-123.10.*, 192.168.*), loopback, or TEST-NET (192.0.2.1).If you're unsure whether something is customer-derived, it is. Replace it.
proseWrap: preserve deliberately keeps hand-chosen line breaks; changing them adds noise.keploy-pr-workflow — commit format, sign-off, customer-data hygiene. Same rules apply here; this skill specializes them for the docs pipeline.keploy-e2e-test — if you are documenting a behavior change, verify the behavior against a real sample before writing the doc. Don't document from source-reading alone.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.