docs-update — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited docs-update (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
How to get productive in an unfamiliar (or returning) codebase as fast as possible by reading structured documentation before touching any code. Also covers keeping docs current so the next session costs fewer tokens.
When entering a repo cold, read docs in this order — stop as soon as you have enough context for the task:
1. README.md ← what the project is, how to run it
2. ARCHITECTURE.md ← system topology, agent/service boundaries
3. PENDING.md ← what's disabled, what's blocked, what's planned
4. CLAUDE.md ← AI-specific instructions and constraints
5. docs/*.md ← deep dives on specific subsystems
6. CHANGELOG.md ← what changed recently (last 5 entries)
7. <subdir>/README.md ← module-level context (check if it exists)Read code only when docs leave a specific question unanswered.
# Find all .md files in the repo (sorted by size — larger = more useful)
find /opt/myrepo -name "*.md" -not -path "*node_modules*" -not -path "*.git*" \
| xargs wc -l 2>/dev/null | sort -rn | head -20| File | What to extract |
|---|---|
README.md | Stack, quick-start commands, port numbers, env setup |
ARCHITECTURE.md | Service names, data flows, which agent does what |
PENDING.md | Disabled features (don't fix what's intentionally off), blockers, credentials needed |
CLAUDE.md | Constraints the AI must follow, naming conventions, off-limits areas |
CHANGELOG.md | Recent breakage, recently added features, migration notes |
.env.example | Every external dependency (API keys = external services used) |
Makefile | Runnable commands the team actually uses day-to-day |
docker-compose.yml | Services, ports, volumes — the runtime topology |
package.json / pyproject.toml | Exact dependencies and versions |
pytest.ini / vitest.config.ts | How tests are structured and run |
After the MD pass, if the task still needs clarification, read one specific file rather than exploring broadly:
"The README says the API runs on :9002 — so I read api/main.py to see the routes."
"PENDING.md says email capture is disabled — so I read email-capture.php to understand the guard."
"ARCHITECTURE.md mentions an event bus — so I read core/redis.py to see the channel names."Never read the whole src/ tree to answer a question that docs already answer.
Docs go stale. Before trusting a doc claim, cross-check:
# When was this doc last touched vs the code it describes?
git log --oneline -5 -- ARCHITECTURE.md
git log --oneline -5 -- app/core/
# Does the doc mention a file that no longer exists?
grep -oE '`[^`]+\.py`' ARCHITECTURE.md | sed "s/\`//g" | while read f; do
[ -f "$f" ] || echo "MISSING: $f"
done
# Does the port in README match docker-compose?
grep -E "port|PORT" README.md docker-compose.ymlIf a doc is more than 30 commits behind the code it describes, treat it as advisory only.
After any non-trivial change, update docs in the same commit:
| Change type | Doc to update |
|---|---|
| New feature added | README.md (if user-visible), CHANGELOG.md |
| Feature enabled (was in PENDING.md) | Remove from PENDING.md, add to README.md |
| New env variable added | .env.example + relevant section in README.md |
| New service / agent added | ARCHITECTURE.md |
| API endpoint added or changed | docs/api.md or inline OpenAPI description |
| New npm/pip dependency | No doc needed — package.json/requirements.txt are self-documenting |
| Breaking change | CHANGELOG.md with migration notes |
# Good commit — docs and code together:
git add src/integrations/ringba.php wp-content/themes/keto-and-healthy/inc/integrations.php
git add PENDING.md README.md
git commit -m "feat: enable Ringba call tracking — remove from PENDING, document setup"PENDING.md is the most valuable doc in a project because it explicitly captures intentional incompleteness. Keep it accurate.
## Feature Name
**Status:** Disabled / In Progress / Blocked on: <dependency>
**Files affected:**
- `path/to/file.py` — what the stub does
**To enable:**
1. Step one (credential, config, etc.)
2. Step two
**ETA / Owner:** <if known>When enabling a pending feature:
PENDING.mdREADME.md under the relevant sectionCHANGELOG.md: ## [unreleased] — feat: enabled X# Architecture
## Services
| Service | Port | Description |
|---|---|---|
| FastAPI API | 9002 | Core backend, JWT auth |
| Astro frontend | 8080 | SSR frontend |
| PostgreSQL | 5432 | Primary data store |
| Redis | 6379 | Job queues, pub/sub |
## Data Flow
1. User → Nginx (443) → Frontend (:8080)
2. Frontend → API (:9002) via Bearer token
3. API → PostgreSQL for persistence
4. API → Redis to enqueue Celery tasks
5. Celery workers → External APIs (Apollo, Instantly, etc.)
## Agent Pipeline (if applicable)
E1 (crawl) → E2 (brief) → E3 (entity) → E2.5 (write) → E6 (publish)
↑ Redis pub/sub ↑
## Key Files
- `app/main.py` — FastAPI entry point
- `app/core/config.py` — All env vars (Pydantic BaseSettings)
- `app/agents/` — One file per autonomous agent
- `docker-compose.yml` — Full service topology# 1. What changed while I was gone?
git log --oneline -20
git diff HEAD~10 --stat
# 2. Any new env vars?
git diff HEAD~10 -- .env.example
# 3. Any new pending items?
cat PENDING.md
# 4. Are services running?
docker compose ps
pm2 status
# 5. Any failing tests?
pytest tests/ -m unit --tb=line -qThis sequence costs ~5 minutes and gives a complete picture without reading any source code.
README.md has: what it is, how to run, port numbers, env setup stepsPENDING.md exists and lists every intentionally disabled featureARCHITECTURE.md exists for any multi-service project.env.example has every key used in code, grouped and commentedCHANGELOG.md updated for every feature-complete or breaking change.md files~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.