jotbook-init — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited jotbook-init (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You're setting up a new jotbook in this project. The procedure writes a starter settings file, offers to handle .gitignore, and tells the user about the restart caveat for hook-affecting fields.
Write the following YAML frontmatter at the top of .claude/jotbook.local.md, followed by a short commented body that the user can replace with their own house-style guidance:
---
jots_dir: docs/jotbook/_jots/
entries_dir: docs/jotbook/
pencils_dir: docs/jotbook/_pencils/
output_format: markdown # markdown | obsidian | html
template_path: # required only when output_format is html, or when penciling with --html
backlog_threshold: 8 # session-start jot nudge fires at this count
pencils_threshold: 3 # session-start pencil nudge fires at this count
---
<!--
House style (optional). Whatever you write below the closing --- above
is treated by jotbook-ink and jotbook-pencil as authoritative guidance
on voice, tone, terminology, and formatting conventions.
Example:
Field-manual voice — restrained, precise, deadpan. No exclamation points.
Cross-link liberally; prefer wikilinks over relative paths.
Code excerpts capped at ~20 lines; longer extracts go in a sibling block.
-->Leave the template_path field empty by default. The user fills it in only when they want HTML output.
.claude/jotbook.local.md already exists, ask the user before overwriting:"A .claude/jotbook.local.md already exists. Overwrite with fresh defaults (your existing settings will be lost), or leave it alone?"Default to leaving it alone. If they pick leave-alone, skip to step 4 (gitignore check is still worth doing in case they need it).
.claude/jotbook.local.md using the template above./jot invocations don't have to surface a surprise mkdir prompt days later: mkdir -p docs/jotbook/_jots docs/jotbook/_pencils docs/jotbookUse the resolved values from the settings file you just wrote (in case the user customizes paths before re-running, though by default they'll be the three above). Skip this step if the user chose "leave alone" in step 1 — their existing settings might point elsewhere and we shouldn't scaffold defaults that don't match.
Before any gitignore work, run a quiet git-repo probe that doesn't emit scary stderr when the directory isn't a repo:
git rev-parse --is-inside-work-tree >/dev/null 2>&1 && echo yes || echo noThen branch:
to your .gitignore` so settings don't get committed."* Move on to step 5..gitignore existence with [ -f .gitignore ] (do NOT cat it blindly — cat on a missing file produces noisy stderr). Then:.claude/*.local.md, .claude/*, or an explicit .claude/jotbook.local.md line). If not covered, ask once: "Add `.claude/.local.md to your .gitignore`?"* and append if they confirm.If the user declines either prompt, mention in one line that the settings file should not be committed and move on.
backlog_threshold, pencils_threshold) take effect on the next Claude Code restart. Other fields (jots_dir, entries_dir, pencils_dir, output_format, template_path) are picked up immediately./jot for staging an explainer after a relevant turn./jotbook-ink for the curation flow once the backlog has grown.index.md landing page in entries_dir and a back-to-index link on each entry, and that /jotbook-link (or /jot link) re-links related entries across the collection..claude/jotbook.local.md is the place to edit defaults./jotbook-template runs a guided design workflow and, on their sign-off, wires template_path for them.cat .gitignore or run git commands without first checking that the file/repo exists. Both can produce big red stderr output that looks like a real error to a user who isn't paying close attention. Use [ -f .gitignore ] for file existence and git rev-parse --is-inside-work-tree >/dev/null 2>&1 for repo existence. Combine multiple discovery probes into a single bash call only if every command in the chain is silent on its failure path./jot or /jotbook-ink after setup completes.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.