external-resource-context-858b8e — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited external-resource-context-858b8e (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
AI agents understand the codebase but not the external resources surrounding it. This skill captures, in a deterministic location, the access methods to resources outside the repository so downstream work (design, planning, implementation, review) can reach them without re-asking the user.
Resources covered: design origin (where the canonical visual specification lives), design system (component library and tokens), guidelines (usage docs, accessibility rules), visual verification environment (how to confirm rendering), database schema source, migration history, secret store location, API schema source (OpenAPI / proto / GraphQL SDL), mock environment, IaC source, environment configuration.
In scope: hearing protocol, storage location, single-source-of-truth ownership rule, reference protocol for downstream consumers.
Out of scope: enforcing that captured resources are correct or current — verification belongs to the agent that consumes the resource. Generating the resources themselves (e.g., creating a DESIGN.md from scratch).
| Tier | Location | Holds | Update Frequency |
|---|---|---|---|
| Project | docs/project-context/external-resources.md | Environment-stable facts: which resources exist for this project and how to access them (URL, MCP name, file path, command) | Rare — only when the project's environment changes |
| Feature | ## External Resources Used section inside the relevant UI Spec or Design Doc | The subset of project-tier resources actually used by this feature, plus feature-specific identifiers (e.g., a specific node id within the design tool, a specific endpoint path) | Per feature |
The project tier owns environment facts. Feature-tier sections list only feature-specific identifiers (node id within the design source, specific endpoint path within the API, specific IaC module name) and reference project-tier entries by label; URLs, MCP names, and access commands remain in the project-tier file. When the environment changes, only the project-tier file is updated.
Example feature-tier entry uses the table format defined in references/template.md: a row with the project-tier label in the first column and the feature-specific identifier in the second column.
| Condition | Action |
|---|---|
docs/project-context/external-resources.md does not exist | Run full hearing for the relevant domain(s) |
| File exists | Ask the user via AskUserQuestion: "Update external-resources.md? (no / yes-full / yes-diff-only)". On yes-full run full hearing. On yes-diff-only ask the user which axes changed, hear only those. On no skip hearing |
Load the domain reference matching the current task:
| Task type | References to load |
|---|---|
| Frontend (UI work) | references/frontend.md |
| Backend (server / data work) | references/backend.md |
| API contract work | references/api.md |
| Infrastructure / deployment | references/infra.md |
| Fullstack | All of the above; per-axis "Not applicable" answers are expected |
Each domain reference defines the axes and the question template.
The two phases are sequential. Self-declaration runs even if the user answered "Not applicable" to every structured axis.
After hearing completes:
docs/project-context/external-resources.md. Create the directory if absent.## External Resources Used section with the feature-tier subset (label references + feature-specific identifiers only).Agents that load this skill consult resources in this order:
docs/project-context/external-resources.md first (if present) to learn what is available and how to access it.## External Resources Used section for feature-specific identifiers.Agents that only need to consult the saved file as input data (not actively hear) can read it directly without loading this skill — frontmatter declaration is reserved for agents that may need to trigger hearing or interpret the protocol semantics.
The project-tier file follows the structure in references/template.md. The project-tier file's heading levels and section names are fixed so downstream agents can locate sections deterministically.
For feature-tier sections inside UI Spec or Design Doc, the heading text "External Resources Used" is fixed; the heading level matches the parent document's natural structure (h2 in UI Spec where it is a sibling of other top-level sections, h3 in Design Doc where it sits under Background and Context).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.