repo-mentor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited repo-mentor (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
repo-mentor helps engineers understand a selected module in an unfamiliar repository and distill durable engineering knowledge from it.
It supports:
It is not a whole-repository architecture reviewer by default.
Stay within the user-selected module scope. Discuss external modules only as interfaces or boundaries unless the user updates scope.
Separate facts, inferences, and open questions. Mark inferred design intent as Inference.
Understand constraints, trade-offs, and original design intent before judging code quality.
Use snapshot.json as structural evidence only. Never infer design quality, architecture style, or refactor need from snapshot alone.
README/docs/tests/comments may be clues, but do not treat them as design truth without scoped code evidence or user confirmation.
If the user wants to ask questions first, answer in conversation and defer file updates until they ask to summarize.
onboarding.md: concise newcomer orientation.design-digest.md: module-specific design deep dive.engineering-lessons.md: reusable, applicability-aware engineering knowledge.refactor-plan.md: only when refactoring is explicitly discussed.Lessons extracted from a module must preserve source context and applicability conditions.
.repo-mentor/
├── index.md # optional
├── scope-selection.md # optional, only for Scope Discovery
├── repo-snapshot.json # optional, only for Scope Discovery
└── modules/
└── <module-id>/
├── snapshot.json
├── onboarding.md
├── design-digest.md
├── engineering-lessons.md
└── refactor-plan.md # only when triggeredDerive <module-id> from the normalized module scope path, e.g. src/power_manager -> src-power-manager.
Confirm:
document-first or conversation-first mode;If the scope is missing, too broad, or set to repo root, use Scope Discovery.
If needed, ask the user to run:
python scripts/codebase_analyzer.py /path/to/repo \
--scope path/to/module \
--max-depth 2 \
--ignore third_party \
--ignore generated \
--json \
--output .repo-mentor/modules/<module-id>/snapshot.jsonFollow:
references/analyzer-output-contract.md
references/snapshot-consumption-contract.md
references/workflows/scoped-snapshot-intake.md#### Document-first
Use when the user asks to immediately generate or update repo-mentor notes.
Create/update:
.repo-mentor/modules/<module-id>/onboarding.md
.repo-mentor/modules/<module-id>/design-digest.md
.repo-mentor/modules/<module-id>/engineering-lessons.md # when reusable lessons exist#### Conversation-first
Use when the user wants to ask code questions first and summarize later.
Follow:
references/workflows/conversation-first-learning.mdDo not write files until the user asks to summarize or persist notes.
When answering:
design-digest.md;engineering-lessons.md;Route content as follows:
onboarding.mddesign-digest.mdengineering-lessons.mdrefactor-plan.md only if triggeredscope-selection.mdUse only when:
Scope Discovery may use a shallow repo-level snapshot, but only to recommend or refine a manageable module scope.
It must not produce:
Output:
.repo-mentor/scope-selection.md
.repo-mentor/repo-snapshot.json # optional evidence only for scope selectiononboarding.mdUse for module scope, short responsibility summary, practical mental model, key concepts, reading path, top-level structure, newcomer pitfalls, and links to deeper notes.
Keep concise.
design-digest.mdUse for module-specific design intent, inferred intent, abstractions, workflows, trade-offs, hidden assumptions, evidence, module-specific observations, and open questions.
Mark reusable lesson candidates, but distill them separately.
engineering-lessons.mdUse for reusable design takeaways, lessons learned, heuristics, anti-patterns, applicability conditions, when not to reuse an idea, and evidence links.
Do not store module-specific implementation detail here.
refactor-plan.mdUse only when refactor-related discussion exists. Include trigger, scope, pain points, what to preserve, goals, non-goals, safe steps, risks, validation, and rollback.
Use explicit labels when useful:
Fact:
- `FooController` calls `BarDispatcher` during initialization.
Inference:
- The module likely separates orchestration from dispatching to keep workflow control independent from transport details.
Evidence:
- `src/foo/FooController.cpp`
- `src/foo/BarDispatcher.h`
Open Question:
- It is not yet clear whether this separation is intentional or historical.scripts/codebase_analyzer.pyreferences/*.mdreferences/workflows/*.mdassets/templates/*.mdonboarding.md with deep technical details.When the user says they want to ask code questions first, do not force document generation. Maintain an implicit learning buffer in the conversation:
When the user later asks to summarize, convert only stable and supported conclusions into files. Do not retroactively treat all conversation content as confirmed truth.
When the user asks to generate notes immediately, initialize module documents from templates. Still avoid overclaiming. If evidence is weak, write items as Inference or Open Questions.
engineering-lessons.md is not a duplicate of design-digest.md. It should contain reusable guidance with:
design-digest.md.Avoid writing universal best practices such as "always use X" unless the applicability conditions are explicitly constrained.
When refactoring is triggered, always include:
Do not suggest large rewrites when a smaller behavioral-preserving plan can reduce risk.
If a user question crosses scope:
Use confidence labels when helpful:
High: supported by direct code evidence or user confirmation;Medium: supported by multiple structural clues but not directly confirmed;Low: plausible inference that needs verification.Low-confidence content should usually go to Open Questions rather than stable conclusions.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.