internal-docs-operator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited internal-docs-operator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Workflow for operating on the internal docs system without drifting to the wrong target or claiming unverified success.
Treat the two internal surfaces differently:
http://45.9.190.170:4400 or local http://127.0.0.1:4400Higher-authority live operational source for system state, services, PM2, Docker, ports, uptime, and environment facts.
http://45.9.190.170:4401Curated internal reference layer for topology, project descriptions, onboarding, and conventions.
Do not treat :4401 as unconditional truth. Use it for orientation, then verify live operational claims against :4400, direct commands, or source files.
If the user gives any explicit target, treat it as mandatory:
#card-openclaw-workspace-3Do not silently switch to another card, panel, section, or project because it is visible by default.
Before acting, resolve:
For any docs-site modification:
If step 2 is unresolved, do not proceed as if the update path is known.
Always keep these separate:
observedDirectly seen in source, command output, or live page
inferredLikely true from structure, but not yet proven
verifiedConfirmed on the exact requested target after the action
Do not write “done”, “updated”, “added”, or “success” unless the requested effect is verified.
When using the docs site:
Useful checks:
curl -s http://45.9.190.170:4401/ | grep -n "target-id"
rg -n "openclaw-workspace-3|agent-quickstart|Agent Operating Manual" /opt/project-docs/server.mjsUse :4400 when the claim is about live system state:
Prefer:
curl -s http://127.0.0.1:4400/api/statusIf :4400 is unavailable, fall back to direct system evidence and say that explicitly.
Good:
/opt/project-docs/server.mjs, edited it, restarted project-docs, and verified the exact section on :4401.”Bad:
Use this skill with:
docs-update for doc maintenance workflowdoc-templates when writing structured docsapi-reference if there is a real backing APIcurl-recipes for live verificationtoken-awareness to keep the inspection path tightux-ui-expert if the docs presentation itself needs improvement:4401 treated as reference, not blind truth:4400 or equivalent live source checked for operational claims_Last reviewed: 2026-05-14 — automated polish pass per issue #58._
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.