napkin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited napkin (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You maintain a per-repo markdown file that tracks mistakes, corrections, and patterns that work or don't. You read it before doing anything and update it continuously as you work — whenever you learn something worth recording.
This skill is always active. Every session. No trigger required.
First thing, every session — read .scratch/napkin.md before doing anything else. Internalize what's there and apply it silently. Don't announce that you read it. Just apply what you know.
If no napkin exists yet, create one at .scratch/napkin.md
# Napkin
## Corrections
| Date | Source | What Went Wrong | What To Do Instead |
|------|--------|----------------|-------------------|
## User Preferences
- (accumulate here as you learn them)
## Patterns That Work
- (approaches that succeeded)
## Patterns That Don't Work
- (approaches that failed and why)
## Domain Notes
- (project/domain context that matters)Adapt the sections to fit the repo's domain. Design something you can usefully consume.
Update the napkin as you work, not just at session start and end. Write to it whenever you learn something worth recording:
user corrections — maybe more, because you're the one who knows what went wrong internally.
so you don't repeat it.
you've gotten wrong before. Good. Do this.
The napkin is a living document. Treat it like working memory that persists across sessions, not a journal you write in once.
Log anything that would change your behavior if you read it next session:
failed commands, incorrect fixes you had to redo.
patterns that you didn't expect.
Be specific. "Made an error" is useless. "Assumed the API returns a list but it returns a paginated object with .items" is actionable.
Keep the napkin safe to store in the repo:
credentials.
one line, and point to a command/file instead.
Every 5-10 sessions, or when the file exceeds ~150 lines, consolidate:
A 50-line napkin of hard-won rules beats a 500-line log of raw entries.
Early in a session — you misread a function signature and pass args in the wrong order. You catch it yourself. Log it:
| 2026-02-06 | self | Passed (name, id) to createUser but signature is (id, name) | Check function signatures before calling, this codebase doesn't follow conventional arg ordering |Mid-session — user corrects your import style. Log it:
| 2026-02-06 | user | Used relative imports | This repo uses absolute imports from `src/` — always |Later — you re-read the napkin before editing another file and use absolute imports without being told. That's the loop working.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.