codecontext-setup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited codecontext-setup (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Set up codecontext so agents can use it without guessing.
The point of this skill is not just package installation. The real job is to make the repo's agent contract coherent:
AGENTS.md tells agents when and how to use it@context is treated as the required structured layerDo not invent required sidecar document schemas. Do not require .ctx.md. Refs can point to Markdown, HTML, text, diagrams, exported docs, or any other resolvable file the repo uses.
Use this skill when the user asks to:
codecontextAGENTS.md or agent guidance around @contextcodecontext setupBy the end of this workflow, the repo should have:
AGENTS.md section for codecontextInspect:
@recallnet/codecontext-cli@recallnet/codecontext-eslint-plugincheckers where codecontext enforcement belongs
AGENTS.md exists at repo root and in subtrees/worktrees@context, codecontext, ADRs,contexts/, or decision logs
Look for the two common failure modes:
does not exist
Install the minimum useful surface:
@recallnet/codecontext-cli when agents should run --scope, --diff, or--report
@recallnet/codecontext-eslint-plugin when the repo uses ESLint and wantscomment validation
surface is Python, Go, Rust, or something else outside ESLint
@recallnet/codecontext-parser only if the repo has custom code that importsparser APIs directly
Do not add packages the repo is not going to use.
AGENTS.md before or alongside package changescodecontext setup is incomplete without agent instructions.
Every repo-level AGENTS.md section should cover:
@context is forIf subtree AGENTS.md files point to a repo-level policy, make sure that policy actually exists.
AGENTS.md contractKeep it short. A good section usually fits in 8-14 bullets.
Use something close to this:
- **codecontext**: Use inline `@context` annotations for non-obvious,
high-value reasoning that future edits could easily erase.
- Required for:
- critical decision logic and invariants
- security-sensitive behavior and hard-won lessons
- external integration quirks and contract mismatches
- regression guards explaining why a simpler change would be wrong
- Preferred forms: `@context decision`, `@context risk`,
`@context requirement`, `@context history`
- Keep notes short and specific: what is true, why it matters, and what
would break if changed
- Use `{@link ...}` for supporting material when helpful, but refs are just pointers
to repo files or docs. Do not require any special doc schema.
- Before editing critical files, run:
`npx @recallnet/codecontext-cli --scope <file>`
- After editing, run:
`npx @recallnet/codecontext-cli --diff HEAD <file>`
- For broader orientation in larger repos, run:
`npx @recallnet/codecontext-cli --report`
- Do not use `@context` for obvious narration, duplicated ADR prose, or
generic comments.Adjust the taxonomy only if the repo clearly needs more than the baseline (decision, risk, requirement, history). Add extra categories sparingly.
If the repo already uses ADRs, plans, runbooks, or architecture docs:
@context as the inline agent-facing layerThe correct model is:
@context carries the structured local signalBe explicit:
.md, .html, .txt, diagrams, exports, orother repo artifacts
Do not write guidance that implies:
.ctx.md is requiredRecommend these commands in agent docs when the CLI is installed:
npx @recallnet/codecontext-cli --scope path/to/file.ts
npx @recallnet/codecontext-cli --diff HEAD path/to/file.ts
npx @recallnet/codecontext-cli --reportUse --report for repo orientation and decision review. Use --scope and --diff around concrete edits.
If the repo already has a shared ESLint config, integrate the plugin there. Prefer enforcing syntax and stale/invalid ref checks centrally rather than telling agents to self-police.
If the repo does not use ESLint, do not force it just for codecontext. Prefer the native enforcement surface for the repo's actual stack:
golangci-lint integrationThe important question is not "did we install the ESLint plugin?" It is "what actually enforces @context correctness in this ecosystem?"
Flag these as setup defects:
AGENTS.md files pointing to a missing repo policy@context but give no workflow--report in large reposWhen you finish setup or audit work:
AGENTS.md guidance you fixedIf the repo has no existing codecontext guidance, prefer creating a codecontext-setup section in the root AGENTS.md rather than scattering instructions across multiple child docs first.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.