work-report-generator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited work-report-generator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Turn unstructured daily notes and commit messages into a formal reports/YYYY-MM-DD/REPORT.md. Strict no-inference: every task, project assignment, and per-project hour count comes from the user, asked explicitly. Report template, anti-patterns, and closing checklist in RECIPES.md.
Daily or backfilled work reports written in a formal tone, in any language. Triggered by phrases like "generar reporte", "reporte de trabajo", "work report", "daily report", "reporte del día", or the /work-report slash command.
Skip this skill for: changelogs, release notes, retrospectives, CV/resume writing, stand-up summaries — those have different structures and audiences.
All artifacts live under reports/ at the repository root. Each day gets its own folder.
reports/
├── projects.md persistent catalog of general projects (one bullet per project, with short description)
└── YYYY-MM-DD/
├── LOG.md per-day scratchpad: raw user input, commit dumps, tasks grouped by project, hours per project
└── REPORT.md formal report, generated/regenerated from LOG.mdLOG.md at the end of the session. Never edit it by hand mid-session.Create reports/, projects.md, and the per-day folder lazily on first invocation. Do not pre-seed projects.md with example data.
Follow this order every time. Do not skip steps even if inputs are obviously inferable — inference is forbidden (§5).
Ask: "¿En qué idioma quieres el reporte?" (default question in Spanish; switch to English if the user opened the conversation in English).
REPORT.md only. LOG.md keeps the raw input verbatim in its source language — never translate the LOG, never normalize its formatting. Translation rules (§7) apply only when emitting the report.Ask: "¿Para qué fecha es el reporte?" Accept YYYY-MM-DD, "today", "yesterday", or a relative reference. Convert to absolute YYYY-MM-DD and confirm before continuing.
One date per invocation. If the user wants to backfill several days, run the full flow (§3.1 onward) once per date — do not batch multiple days in a single session, do not interleave inputs for different dates. The reason: per-day artifacts (LOG.md, REPORT.md) and per-project hours must stay scoped to a single calendar day.
reports/projects.md. If missing or empty, state explicitly: "El catálogo de proyectos está vacío. Vamos a construirlo conforme aparezcan en tus notas."projects.md before moving on. Each entry is one line: - <Project Name> — <one-line description>.Ask the user to paste:
<sha> <subject>\n\n<body> — full body, not just the subject line (only as input — see §6).Append everything verbatim to LOG.md under a ## Raw input section. Preserve the original formatting, language, indentation, and line breaks of what the user pasted. Do not reformat, translate, summarize, or de-duplicate at this stage.
This is the preliminary analysis phase. Its only valid output is a list of candidate tasks surfaced as questions for the user. Specifically:
For each candidate task, ask one question:
projects.md and confirm the short description.Do not ask hours per task. Hours are tracked at the project level (§3.6).
Record confirmed tasks under a ## Tasks by project section in LOG.md, grouped by project, one bullet per task. Use the user's wording from the clarification, not your paraphrase.
Once every task is grouped, walk through the projects with at least one task today. For each, ask:
Record under a ## Hours section in LOG.md.
Never estimate, round, or derive hours from the number/size of tasks. Ask.
Before generating REPORT.md, ask explicitly: "¿Algo más que agregar antes de cerrar el día?" Wait for an affirmative close — "listo", "ciérralo", "no, genera", "all done", or equivalent — before proceeding to §3.8.
LOG.md for that date and resume from the last completed step. Never skip the §3.7 confirmation just because earlier steps already ran.Only after the explicit close confirmation from §3.7 and after every project with tasks today has a recorded hours figure, generate REPORT.md (§4).
Print the report path and a one-line summary of project totals + day total. Ask if the user wants edits before closing.
The report must be readable as raw text. No tables, no HTML, no emojis, no bold/italic decorators, no code fences, no horizontal rules, no nested bullets, no sub-headings. Only:
1. Título, 2. Título, etc.- prefix.Tiempo del proyecto line per section; one Tiempo total del día line at the very end.Section header content. The header after each N. is the project name verbatim from projects.md. Nothing else on that line — no parenthetical decoration ((5h), (crítico), (Q2)), no trailing summary, no duplicated descriptor. Example: 1. Detector de Anomalías Online — not 1. Detector de Anomalías Online (4h 30min).
Task bullets describe the result, not the source artifact. Each bullet says what the work accomplished, in formal prose. Never reference commits, tickets, issues, PRs, or branches as the subject of the bullet — those are inputs to the report, not its content. The user can request explicit commit references via §6, in which case they land in a dedicated Referencias section at the end of the report, never inline in task bullets.
- Cerró el ticket OPS-142.- Mergeó el commit que arregla el bug del worker.- Completó el PR de refactor.- Resolvió el timeout en el worker de despacho de la cola de publicaciones.- Refactorizó el módulo de despacho para separar la capa de transporte.Full template, tone examples, hours-arithmetic rules in RECIPES § 1–2.
Tiempo del proyecto is the value the user gave directly for that project today — do not derive from anything else.Tiempo total del día.90min → 1h 30min; 2h 0min → 2h; 0h 45min → 45min.The user's hard rule: never infer what was done. Concretely:
feat(api): add /reports endpoint, do not write the report based on the commit — ask the user what they did and how to frame it.When in doubt, ask one specific question. Better to ask twice than to fabricate once.
Boundary with §3.5. The preliminary analysis phase (§3.5) enumerates candidate tasks as questions. That is not inference — surfacing "is this one task or two?" is the legitimate way to extract structure from raw input. Inference is filling in an answer the user never gave: inventing a task, merging two items because they look related, picking a project because it was the most recent one, or paraphrasing a commit subject into a finished bullet.
Commits help the user remember what they did, but they do not appear in the report unless explicitly requested ("incluye los commits", "list the commits", "agrega los SHAs").
LOG.md under a ## Commits subsection for traceability. Include the full message — subject, blank line, body — not the subject line alone. Same rule for issue/ticket dumps: title + body.Referencias section at the very end of REPORT.md, listing <short-sha> <subject> one per line, no decoration. References live only in that section — never inline inside task bullets.Scope. These rules govern REPORT.md only. LOG.md is verbatim source-language input and is never translated, normalized, or rewritten — translating the LOG would destroy the audit trail.
The report is written in the language chosen in §3.1. Technical English terms follow four rules:
throttling → limitación de tasa (throttling)).keep-alive, timeout, endpoint).OPC UA, SCADA, Raspberry Pi).Full examples per category in RECIPES § 3. When the output language is English, this section is a no-op.
At the end of a session:
reports/projects.md — updated with any new projects added during the session.reports/<date>/LOG.md — ## Raw input, ## Commits (if any), ## Tasks by project (grouped), ## Hours (per project).reports/<date>/REPORT.md — formal report regenerated from LOG.md, following §4 strictly.If the user comes back the next day or week to amend a past report, re-read LOG.md for that date first and re-run the task extraction loop only on new input. Re-ask per-project hours only for projects whose task list changed.
Full anti-pattern table (12 common mistakes) in RECIPES § 4. Pre-close review checklist in RECIPES § 5.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.