context-files — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited context-files (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Before writing any line, ask:
"Can an agent discover this on its own by reading the codebase?"
If yes, delete the line. Agents read package.json, tsconfig.json, directory trees, linter configs, and README files. They know every popular framework. Restating this wastes tokens and dilutes the instructions that matter.
If unclear, ask the user which mode they need.
Ask the user which file they need, or infer from their project:
| File | Platform | Notes |
|---|---|---|
AGENTS.md | Universal (Codex, Cursor, Copilot) | Preferred for multi-platform teams |
CLAUDE.md | Claude Code | Supports @path import syntax |
GEMINI.md | Gemini CLI | Configurable name via settings.json |
If the project uses multiple platforms, recommend AGENTS.md as the canonical file with bridge files for others. See references/platform-formats.md for platform-specific details. CLAUDE.md or GEMINI.md is usable though if the project only needs one platform support or if the user prefers.
Script paths in this document (e.g. scripts/) are resolved relative to this SKILL.md file, not to your current working directory. If a relative command fails to resolve, prefix it with the path your platform loaded this SKILL.md from.
Fallback. If python3 cannot be located, analyze the script's purpose and logic and execute its intent with available tools, but warn the user that python is not available and the logic was executed with a fallback approach that may not be perfect.
Scan the codebase for non-discoverable knowledge. Your value is finding what agents miss.
Skip the surface layer (agents already read these):
package.json, composer.json, go.mod, requirements.txt, pyproject.tomltsconfig.json, .eslintrc, .prettierrc, linter configsREADME.md, directory structureDig into the deep layer using references/archaeological-checklist.md:
Makefile, Justfile, Taskfile.yml, scripts/, package.json scripts, CI configs. Find test commands that differ from the obvious one, build steps with side effects, CI-only steps that must be replicated locally..nvmrc, .node-version, .tool-versions, .env.example, docker-compose.yml. Find required runtime versions, environment variables needed to start the app, Docker quirks..husky/, .pre-commit-config.yaml, CONTRIBUTING.md. Find pre-commit hooks, branch naming conventions, commit message formats enforced by hooks.pnpm-workspace.yaml, lerna.json, nx.json, turbo.json. Find build order constraints, shared configs that must not be overridden.HACK, FIXME, XXX, WORKAROUND, DO NOT, NEVER, WARNING, DEPRECATED in comments. Find off-limits areas, intentional workarounds that look wrong..npmrc, .yarnrc.yml, composer.json config, .editorconfig. Find private registry URLs, resolution overrides, patched dependencies.Collect findings silently. Do not output analysis results yet.
Present findings from Phase 1 as context. Ask these questions and stop to wait for the user's response:
Question 1: Landmines. "What breaks if an agent does the obvious thing? What traps does a new developer hit on day one?" Provide 3-5 suspected traps from your analysis.
Question 2: Sacred areas. "What files, directories, or patterns must an agent NEVER touch without permission?" Provide candidates from your analysis (generated code dirs, migration files, shared configs).
Question 3: Non-obvious commands. "Which commands differ from what an agent would guess? (test, build, lint, deploy, migrate)" Provide candidates found in build scripts and CI configs.
Question 4: Unwritten conventions. "What team conventions exist that no linter enforces and no documentation captures?" Give 2-3 examples of what you mean: naming conventions, PR processes, module ownership, error handling philosophy.
Question 5: Refactoring strategy. "When an agent touches legacy code, what should it do?" Options: Strict (enforce current standards on new code, contain old code), Consistent (follow existing patterns), Rewrite (aggressively refactor everything touched).
Synthesize analysis and user answers. Use the template from the Output template section below.
Hard constraints:
For CLAUDE.md or GEMINI.md, adapt the template following the platform-specific conventions in references/platform-formats.md.
Before presenting the file, review every line against the golden rule checklist:
package.json, config files, or the directory tree? → Delete it.Count the remaining lines. If the file exceeds 100 lines, split reference material into separate docs and link from the "Reference docs" section.
Run the validation script on the generated file:
python3 scripts/validate_context_file.py <path-to-generated-file>If the script is unavailable, use the manual checklist below.
If the user needs multi-platform support, generate bridge files:
@AGENTS.mdRefer to [AGENTS.MD](../AGENTS.md) in .github/copilot-instructions.mdcontext.fileName to ["CLAUDE.md", "AGENTS.md", "GEMINI.md"] in .gemini/settings.jsonDo not duplicate content across platform files. One source of truth, references everywhere else.
When the user asks to review an existing context file:
Read the context file and the project's codebase (package.json, config files, README, directory structure).
python3 scripts/validate_context_file.py <path-to-context-file>If the script is unavailable, proceed with manual review.
For each line in the file, check:
Check against the quality checklist:
Present findings grouped by severity:
Use the template in assets/context-file-template.md. Omit any section that has nothing non-discoverable to say.
For CLAUDE.md or GEMINI.md, adapt the template following the conventions in references/platform-formats.md.
These constraints apply to you, the generator agent:
.github/instructions/ files or Agent Skills. If you find yourself writing code, stop.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.