hugo-architect — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited hugo-architect (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Targets Hugo Extended 0.161 (Go-templated static-site generator). Theme styling integrates with ui-ux-architect; Go template syntax overlaps with go-architect; deploy pipelines follow ci-cd-architect. Concrete skeletons in RECIPES.md; pinned versions in STACK.md.
content/, layouts/, assets/, static/, data/, i18n/, archetypes/, themes/ (if not module-mounted), hugo.toml. Skeleton in RECIPES § Project tree.content/posts/, content/docs/) become URL prefixes; taxonomies are inferred from front matter, not folder names.assets/ and goes through Hugo Pipes. Truly static files (robots.txt, favicon.ico, prebuilt PDFs) go in static/.site.Data.<file>. Use for author lists, sponsor logos, redirect maps; do not use for content (that belongs in content/).+++ delimiters). Matches hugo.toml config syntax — one parser to learn. YAML is acceptable for theme authors who must support broader ecosystems; pick one per repo and don't mix.title, date, draft (default false once published). Drafts are excluded from production builds.tags = ["x", "y"], never comma-separated strings. Taxonomies auto-generate listing pages.date.params is the supported namespace for site-specific extensions; top-level keys collide with future Hugo additions.Hugo's lookup order resolves templates from most-specific to most-generic. Internalize the order; don't memorize it — the Hugo template lookup docs are the source of truth.
{{ define "main" }}.{{< name >}}. Use for figures, callouts, embeds; do not use to inject styling.layouts/posts/single.html beats layouts/_default/single.html. The _default/ folder is the fallback, not the convention.Skeletons in RECIPES § Template hierarchy.
hugo mod get resolves; go.mod records.git submodule update --init after every clone, and break on theme repo reorganizations. Modules give SemVer + automatic dependency resolution.hugo mod vendor writes _vendor/; commit it for hermetic builds (mirrors Go's vendor/ discipline per go-architect).Skeleton in RECIPES § Hugo Module setup.
content/posts/launch-day/index.md plus cover.jpg, diagram.svg in the same folder.index.md) — a single page; resources are bundle-local._index.md) — a section page; child pages are independent.resources.Get, .Resources.GetMatch) are scoped to the bundle, image processing works on co-located files, and content + assets move together.Hugo Pipes is the built-in asset pipeline — no Webpack, no Vite. Extended edition required for Sass/SCSS.
resources.Get "css/app.scss".toCSS (or js.Build) → postCSS (optional, for Tailwind/autoprefixer) → minify → fingerprint → render <link> / <script> with Permalink + Data.Integrity (SRI).--minify and rely on the fingerprint for cache busting..Resize, .Fit, .Fill, .Filter. Pair with srcset for responsive images. WebP/AVIF output via format conversion. Use q= for JPEG quality; don't blow the byte budget.postcss.config.js + package.json. Hugo invokes the binary; keep the toolchain pinned via repo-tooling-architect.Skeleton in RECIPES § Asset pipeline chain.
hugo --templateMetrics) and audit the slowest partial/shortcode.loading="lazy" and srcset.weight, languageName, contentDir, languageDirection.post.en.md + post.es.md) or by content directory (content/en/ + content/es/). Pick one per site; filename mode is simpler, directory mode scales better past three languages.{{ i18n "key" }}. Don't hardcode strings in templates.translationKey (front matter) when filenames diverge.defaultContentLanguageInSubdir = true. Decide early — changing later breaks every existing URL.render-link.html, render-image.html, render-codeblock-<lang>.html, render-heading.html.[markup.goldmark].Skeleton in RECIPES § Render hook examples.
public/ folder.wrangler.toml. Free tier is generous.peaceiris/actions-hugo is the standard workflow action. Custom domains require a CNAME file in static/.--baseURL in CI to inject per-environment.hugo --minify → upload public/.Skeleton in RECIPES § GitHub Pages deploy workflow.
hugo-theme-architect skill if demand emerges.text/template + html/template; same syntax, same gotchas.public/ artifact.mise or proto for pinning the Hugo binary version; Task / just for the local build commands._Adapted from the Hugo documentation (v0.161)._
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.