okf — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited okf (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
OKF represents knowledge as a directory of markdown files with YAML frontmatter. It is minimal by design: no schema registry, no runtime, no SDK. Your job is to produce, maintain, and consume OKF bundles conformant with the spec, not your memory of it.
Always read the canonical spec before non-trivial work: reference/SPEC.md. It is the verbatim OKF v0.1 specification and the source of truth for every rule below.
A bundle is conformant (§9) iff: every non-reserved .md file has a parseable YAML frontmatter block, and every such block has a non-empty `type` field. Everything else is soft guidance. Consumers MUST tolerate missing optional fields, unknown types, and broken links — never reject a bundle over them.
.md) is the concept ID.type is required. Add title, description, tags,timestamp (ISO 8601) when they aid consumption; add resource (a canonical URI) only for concepts bound to a real asset — omit it for abstract concepts.
Conventional headings: # Schema, # Examples, # Citations.
form (/services/auth-api.md). A link asserts a relationship; its kind lives in the surrounding prose, not the link.
index.md (directory listing, no frontmatter — except thebundle-root index may carry only okf_version) and log.md (ISO-dated change history, newest first). Never use these names for concepts.
Templates to copy: concept, index, log.
Use .okf/ at the repository root unless the project already uses another location. Commit it alongside the code it describes — knowledge as code.
docstrings, config), docs/wiki (distill pages into concepts, link the originals under # Citations), manual (decisions, playbooks, metrics).
services/, datasets/,decisions/). One concept per file.
descriptive type, fill recommended fields, cross-link related concepts.
index.md per directory (and okf_version: "0.1" in the rootindex). Append a dated entry to log.md.
resource, path, ortopic). This bookkeeping is exactly what agents are good at — touch every affected file in one pass.
timestamp; fix or add cross-links; create new conceptsfor new assets; mark removed assets (**Deprecation**) rather than silently deleting context.
index.md files and append a dated log.md entrydescribing what changed.
index.md first for progressive disclosure, then followlinks only into the concepts relevant to the task.
write it back.
Never eyeball conformance — run the deterministic checker. Invoke the companion `validate` skill (/okf:validate <bundle-dir> --strict), which ships the checker. If that skill is not installed, run it directly:
uv run "${CLAUDE_SKILL_DIR}/../validate/scripts/okf_validate.py" <bundle-dir> --strictResolve every ERROR (hard §9 failures). Warnings are soft; fix them when cheap, but they never block.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.