okf — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited okf (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
OKF represents knowledge as a directory of markdown files with YAML frontmatter. It is minimal by design: no schema registry, no runtime, no SDK. Your job is to produce, maintain, and consume OKF bundles conformant with the spec, not your memory of it.
Always read the canonical spec before non-trivial work: reference/SPEC.md. It is the verbatim OKF v0.2 specification and the source of truth for every rule below.
A bundle is conformant (§11) iff: every non-reserved .md file has a parseable YAML frontmatter block, and every such block has a non-empty `type` field. Everything else is soft guidance. Consumers MUST tolerate missing optional fields, unknown types, and broken links — never reject a bundle over them.
.md) is the concept ID.type is required. Add title, description, tags whenthey aid consumption; add resource (a canonical URI) only for concepts bound to a real asset — omit it for abstract concepts.
Conventional headings: # Schema, # Examples, # Computation.
form (/services/auth-api.md). A link asserts a relationship; its kind lives in the surrounding prose, not the link.
index.md (directory listing, no frontmatter, except thebundle-root index, which may carry okf_version and this plugin's upkeep: enforced opt-in flag, plus recursive: true (or a depth n: levels below the root, true is 6) to make the hook watch nested git repos) and log.md (ISO-dated history, newest first). Never use these names for concepts.
log.md: a bundle created, a concept deprecated or retired, one concept superseding another, concepts regenerated after their source changed, a verification pass. Routine edits to a concept do not get an entry: its generated and git already record them. A log is append-only, so never rewrite or drop an existing entry.
generated: { by, at } — who produced the current contentand when. verified: [{ by, at }] — who confirmed it since (a bare mapping is one entry). Write by in the actor convention (§7): <producer>/<version> for an agent, human:<id> for a person, process:<id> for an automated job. Use human: whenever a person authored or signed off — consumers key trust tiers off that prefix.
status: draft|stable|deprecated (absent meansstable) and stale_after, an absolute ISO 8601 datetime (a bare date is tolerated), not a TTL.
usage_count, last_modified }] plus a usage_window: { from, to } sibling of sources framing every usage_count (an entry may carry its own to override it); a usage_count without a window warns. resource is required per entry and may be a URL, a bundle path, or a scope descriptor. Attribute a specific claim with a markdown footnote whose label is the source's id: …sharded daily.[^ga4-schema] plus a [^ga4-schema]: … definition. The label is the join key, it must match a sources[].id`.
type: Attested Computation, carrying runtime (required), parameters, executor, attester, and the computation itself under # Computation (or a computation: path). Concepts that need the value link to it. Never inline a number's SQL into the concept that narrates it.
Reading a v0.1 bundle? Two constructs were superseded (§13.1): timestamp is now generated.at, and a body # Citations list is now sources. Read both, write v0.2 — and when you touch a legacy concept in maintain mode, migrate its frontmatter as part of the edit. The validator warns on both.
Templates to copy: concept, index, log.
Use .okf/ at the repository root unless the project already uses another location. Commit it alongside the code it describes — knowledge as code.
Starting a brand-new bundle? Use the init fast-path instead of hand-writing the first files — it scaffolds a conformant index.md, log.md, and a getting-started.md concept with full recommended frontmatter in one shot:
uv run "${CLAUDE_SKILL_DIR}/scripts/okf_init.py" <target-dir> [--title "..."]It refuses to touch a directory that already has .md files unless --force is given. Then extend it:
docstrings, config), docs/wiki (distill pages into concepts, record the originals in sources), manual (decisions, playbooks, metrics).
services/, datasets/,decisions/). One concept per file.
descriptive type, fill recommended fields, record generated and the sources you actually read, cross-link related concepts.
index.md per directory (and okf_version: "0.2" in the rootindex). A new bundle gets a dated Creation entry in log.md. Extending an existing one does not.
resource, path, ortopic). This bookkeeping is exactly what agents are good at — touch every affected file in one pass.
generated.at (with your own actor in generated.by);fix or add cross-links; create new concepts for new assets; mark removed assets status: deprecated and note the deprecation in log.md rather than silently deleting context. Facing a whole v0.1 bundle rather than a stray field? Do not hand-edit it — run the validator's --migrate once.
index.md files. Append a dated log.md entry only ifthe change is a lifecycle event (see What goes in `log.md`).
index.md first for progressive disclosure, then followlinks only into the concepts relevant to the task.
status: draft/deprecated, a stale_after alreadypast, or no verified entry all mean "check before relying on this". Treat broken links as not-yet-written knowledge, not errors.
Attested Computation covers? Run its computation withvalues bound to the declared parameters — never write your own query.
write it back.
Never eyeball conformance — run the deterministic checker. Invoke the companion `validate` skill (/okf:validate <bundle-dir> --strict), which ships the checker. If that skill is not installed, run it directly:
uv run "${CLAUDE_SKILL_DIR}/../validate/scripts/okf_validate.py" <bundle-dir> --strictResolve every ERROR (hard §11 failures). Under --strict warnings also fail the run (exit 1), so clear them too; drop --strict (or use --max-warnings N) if you only want §11 conformance gated.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.