okf — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited okf (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center">
*Author, maintain, and validate portable knowledge bundles your agents and your team can read.*
</div>
Knowledge as code. OKF is an open, vendor-neutral format that represents knowledge — the metadata, context, and curated insight around your systems — as a directory of markdown files with YAML frontmatter. No schema registry. No runtime. No SDK. If you cancata file you can read it; if you cangit clonea repo you can ship it.
This plugin teaches Claude Code to produce, maintain, and validate OKF bundles correctly — driven by the verbatim spec, backed by a deterministic conformance checker.
Project knowledge lives scattered across wikis, code comments, and people's heads. Agents re-discover it from scratch every session. OKF gives you one durable, diffable, portable home for it — versioned next to the code it describes. This plugin makes keeping that home accurate a normal part of how Claude works.
| Component | What it does |
|---|---|
/okf:okf skill | Produce / maintain / consume bundles, applying the spec and templates. Auto-triggers when a repo has an OKF bundle. |
/okf:validate skill | Deterministic §9 conformance check (not an eyeball pass). |
/okf:visualize skill | Render a bundle to a self-contained interactive HTML graph (viz.html). |
skills/validate/scripts/okf_validate.py | Standalone, zero-config validator (uv run, PyYAML via PEP 723). |
skills/visualize/scripts/okf_visualize.py | Standalone bundle→viz.html renderer (Cytoscape + marked via CDN). |
skills/okf/reference/SPEC.md | The OKF v0.1 spec, vendored verbatim — the source of truth. |
templates/CLAUDE-okf.md | Snippet that turns on automatic consume/maintain in your project. |
examples/sample-bundle/ | A tiny conformant bundle (code + docs + decisions). |
As a Claude Code plugin (one-plugin marketplace):
/plugin marketplace add scaccogatto/okf-skills
/plugin install okf@scaccogattoAs agent skills via [skills.sh](https://skills.sh) (Claude Code, Cursor, Codex, and 20+ agents):
npx skills add scaccogatto/okf-skills # installs the okf + validate skillsLocal development (no marketplace):
claude --plugin-dir /path/to/okfBoth layouts coexist in this single repo: .claude-plugin/ makes it a plugin marketplace; skills/<name>/SKILL.md makes it skills.sh-discoverable. The validator lives inside the validate skill and is referenced via ${CLAUDE_SKILL_DIR}, so it works identically in either install path.
Requires uv for the validator (or python3 + pyyaml).
Capture knowledge — ask Claude to "document the auth service in OKF", or run:
/okf:okf produce .okfValidate before committing:
/okf:validate .okf --strict
# or directly:
uv run skills/validate/scripts/okf_validate.py .okf --strictVisualize the knowledge graph (self-contained viz.html, opens in any browser):
/okf:visualize .okf
# or directly:
uv run skills/visualize/scripts/okf_visualize.py .okf -o viz.htmlTurn on automatic upkeep (soft mode). This plugin ships no hooks by design. To have Claude consult .okf/ before tasks and write knowledge back after changes, paste templates/CLAUDE-okf.md into your project's CLAUDE.md (or ~/.claude/CLAUDE.md for all projects).
.okf/
├── index.md # progressive disclosure (root carries okf_version)
├── log.md # ISO-dated change history, newest first
├── services/
│ ├── index.md
│ └── auth-api.md # one concept = one file; path is its ID
└── decisions/
└── use-okf.mdEach concept needs only one thing to be conformant: YAML frontmatter with a non-empty type. Everything else is optional and tolerated when missing.
---
type: Service
title: Auth API
description: Issues and verifies short-lived access tokens.
resource: https://github.com/acme/auth
tags: [auth, platform]
timestamp: 2026-06-14T10:00:00Z
---
# Endpoints
| Method | Path | Description |
|--------|----------|----------------------------|
| `POST` | `/token` | Exchange creds for a JWT. |okf-skills/
├── .claude-plugin/{plugin.json, marketplace.json}
├── skills/okf/{SKILL.md, reference/SPEC.md, templates/}
├── skills/validate/{SKILL.md, scripts/okf_validate.py}
├── skills/visualize/{SKILL.md, scripts/okf_visualize.py}
├── examples/sample-bundle/
├── templates/CLAUDE-okf.md
└── .github/workflows/ci.ymlIssues and PRs welcome — new templates, producers for more sources, validator improvements. CI validates the plugin manifest and the example bundle on every push.
team, released under Apache-2.0. skills/okf/reference/SPEC.md is vendored verbatim from the reference repository with attribution.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.