docx-processing-superdoc — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited docx-processing-superdoc (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use SuperDoc CLI for DOCX work. Use v1 commands (canonical operations and their helper wrappers). Do not default to legacy commands unless explicitly needed for v0-style bulk workflows.
Use superdoc if installed, or npx @superdoc-dev/cli@latest as a fallback.
For unknown commands or flags, inspect runtime metadata first:
superdoc describe
superdoc describe command find
superdoc describe command "comments add"Use describe command for per-command args and constraints.
superdoc open ./contract.docx
superdoc query match --select-json '{"type":"text","pattern":"termination"}' --require exactlyOne
superdoc replace --target-json '{"kind":"text","blockId":"p1","range":{"start":0,"end":11}}' --text "expiration"
superdoc save --in-place
superdoc closequery match (not find) to discover mutation targets — it returns exact addresses with cardinality guarantees.open, commands run against the active/default session when <doc> is omitted.superdoc session list|set-default|save|close for explicit session control.close on dirty state requires --discard or a prior save.superdoc get-text ./proposal.docx
superdoc get-markdown ./proposal.docx
superdoc info ./proposal.docxsuperdoc replace ./proposal.docx \
--target-json '{"kind":"text","blockId":"p1","range":{"start":0,"end":5}}' \
--text "Updated" \
--out ./proposal.updated.docx<doc> provided), mutating commands require --out unless using --dry-run.--dry-run to preview any mutation without applying it.--expected-revision <n> with stateful mutations for optimistic concurrency checks.find --type text --pattern "..." or find --query-json '{...}'query match --select-json '{...}' --require exactlyOneblocks list, get-node, get-node-by-idget-text, get-markdown, get-htmlreplace --target-json '{...}' --text "..."insert --block-id <id> --offset <n> --value "..."delete --target-json '{...}'blocks delete, blocks delete-rangemutations apply --steps-json '[...]' --atomic true --change-mode directcreate paragraph --text "..." (with optional --at-json)create heading --input-json '{"level":<n>,"text":"..."}'format apply --block-id <id> --start <n> --end <n> --inline-json '{"bold":true}'format bold, format italic, format underline, format strikethroughlists list, lists getlists insert --node-id <id> --position after --text "..."lists indent, lists outdent, lists set-level, lists set-type, lists convert-to-textcomments add, comments replycomments get, comments listcomments edit, comments resolve, comments move, comments set-internalcomments delete (canonical) or comments remove (alias)track-changes list, track-changes gettrack-changes accept, track-changes reject, track-changes accept-all, track-changes reject-allhistory get, history undo, history redocall <operationId> --input-json '{...}' (JSON output only — --pretty is not supported)Not all --*-file variants are available on every command. Use describe command <name> to check.
Always supported alongside their -json counterpart (use one, not both):
| Flag pair | Available on |
|---|---|
--query-json / --query-file | find, lists list |
--address-json / --address-file | get-node, lists get |
--input-json / --input-file | call, create paragraph |
--at-json / --at-file | create paragraph |
--target-json is widely available on mutation commands but has no --target-file counterpart. Use flat flags (--block-id, --start, --end) as an alternative to --target-json.
--pretty for human-readable output (not supported by call).--output <json|pretty>, --session <id>, --timeout-ms <n>.<doc> can be - to read DOCX bytes from stdin.Legacy v0.x bridge commands still exist:
superdoc search <pattern> <files...>
superdoc replace-legacy <find> <to> <files...>
superdoc read <file>Use these only when you specifically need v0-style behavior (especially multi-file glob search/replace). For new automations, prefer v1 operations.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.