integrations-lifecycle — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited integrations-lifecycle (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The pipeline that turns source metadata into the integration pages, the umbrella pages, and the in-app catalog. This skill owns the mechanics and the delivery rules; what a collector metadata.yaml field should say is .agents/skills/collectors-metadata-yaml/, and config_schema.json is .agents/skills/collectors-go-design/config-schema.md.
Apply AGENTS.md#skill-selection. For review, select the affected pipeline or artifact contract below and inspect source plus existing validation evidence. Loading recipes does not require regeneration, dependency installation, commits or publication. Authorized validation uses current inputs and preserves existing outputs through isolation.
Shared delivery facts:
metadata.yaml is the input. Hand-authored for most integrations; generated for ibm.d modules (from contexts.yaml,config.go, module.yaml) and for the NPM catalog (from SNMP profiles by integrations/gen_npm_catalog.py). Edit the authoritative source, never a generated file.
<dir>/integrations/<slug>.md, every README that is a symlink or whose <!--startmeta block carries amessage: "DO NOT EDIT..." line (a <!--startmeta block alone is not the marker; hand-authored Learn pages have one too), and the umbrella pages src/collectors/COLLECTORS.md, SECRETS.md, SERVICE-DISCOVERY.md (no banner) are generated. Do not edit them.
integrations-regen PR. Validatewith gen_integrations.py and the tests during authorized changes; preview pages in isolation using how-tos/preview-collector-page.md (selected collectors or its non-collector route). Preserve existing generated-file edits and keep them out of the source commit. The one place this boundary is written out, with its ibm.d runtime-output exception, is consistency.md.
taxonomy.yaml, gen_taxonomy.py) is a dormant early implementation kept for later work;nothing runs it. Do not author, extend, or seed taxonomy content (consistency.md, "The dormant collector taxonomy").
| Read | For |
|---|---|
consistency.md | which artifacts move together, the delivery boundary, what CI enforces, the review checklist, the dormant taxonomy |
integrations/README.md | dependencies and the command list for a local run |
how-tos/preview-collector-page.md | selected collector prose; its non-collector route covers flows and other types in an isolated source copy |
description-authoring.md | the catalog sentence and the generated page meta description (the two cross-type description contracts) |
recipes/add-go-collector.md, recipes/update-collector.md | step-by-step for a new or changed go.d collector |
ibm-d.md | the ibm.d generation chain |
how-tos/INDEX.md | retiring a collector, tracing a missing published section, auditing Learn links, Prometheus profiles and the catalog |
| Read | For |
|---|---|
pipeline.md | stages, sources per integration type, validation and rendering, outputs and banners, page locations and learn_rel_path, umbrella pages, both workflows |
schema-reference.md | what each schema validates and the behavior the schema file does not show |
gotchas.md | dead code, silent behaviors, validation traps, the MDX incident |
in-app-contract.md | how cloud-frontend consumes integrations.js and what it treats as a contract |
how-tos/INDEX.md | adding an integration type, the NPM catalog generator |
Citations in this skill name files and symbols, never line numbers; open the file and search for the symbol.
Capture timing and authorization follow AGENTS.md#knowledge-capture. Pipeline recipes live in how-tos/ and are listed in ./how-tos/INDEX.md; prefer updating an existing guide when it already covers most of the question.
.agents/sensitive-data-discipline.md applies: repository files repo-relative, sibling Netdata-org repositories as ${NETDATA_REPOS_DIR}/<repo>/..., no workstation paths.
collectors-authoring: read first when authoring a brand-new collector; this skill covers the integration side.collectors-metadata-yaml: the words on the page, field by field.collectors-go-design/config-schema.md: the DynCfg form.docs-learn-site-structure: how the generated pages reach learn.netdata.cloud (docs/.map/map.yaml, ingest,redirects).
collectors-prometheus-profiles: the profile side of the Prometheus catalog.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.