txt-refresh-against-sosumi — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited txt-refresh-against-sosumi (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Authored against iOS 26.x / Swift 6.x / Xcode 26.x.
This is a maintenance skill. It produces a diff report against Apple's current documentation; a human maintainer reviews and commits the result. Do not push silent updates without review — Apple sometimes deprecates without changing signatures, and the diff alone won't catch semantic shifts.
The natural cadence is after Apple releases that touch the text stack:
Don't run this on every commit. The point is to capture deltas at meaningful platform boundaries; running too often produces noise and rebases against an in-flight beta cycle.
These five skills are time-sensitive enough to warrant a references/latest-apis.md companion. Any of them that lacks the file gets one created on the next run:
txt-swiftui-texteditor — iOS 26+ rich-text TextEditor; AttributedTextSelection, AttributedTextFormattingDefinition, AttributedTextValueConstraint, transformAttributes(in:body:), replaceSelection(_:withCharacters:), replaceSelection(_:with:), Font.Context, Font.resolve(in:)txt-writing-tools — UIWritingToolsCoordinator, WritingToolsBehavior, WritingToolsAllowedInputOptions, writingToolsIgnoredRangesIn, isWritingToolsActive, the willBegin/didEnd lifecycletxt-textkit2 — NSTextLayoutManager, NSTextContentManager, NSTextLayoutFragment, NSTextLineFragment, NSTextViewportLayoutController, fragment enumeration optionstxt-attribute-keys — NSAttributedString.Key catalog, value types, view-compatibility footnotestxt-attributed-string — AttributedString API surface, AttributeScope, AttributeContainer, MarkdownDecodableAttributedStringKey, CodableAttributedStringKey, scope composition rulesOther skills (txt-textkit1, txt-nstextstorage, txt-uitextinput, etc.) describe stable older APIs and don't carry latest-apis.md. They get reviewed during major releases as part of the broader audit, not via this skill.
The work is mechanical — fetch, diff, report — but each step has a gotcha. Apply in order.
For each in-scope skill, read its current references/latest-apis.md (or the SKILL.md if no sidecar exists yet). Capture every Apple API name, signature, and version annotation that appears as a normalized list. This is the baseline.
If a skill doesn't have references/latest-apis.md, create one with this template:
# Latest API surface — <skill-name>
Authored against iOS 26.x / Swift 6.x / Xcode 26.x. Last refreshed YYYY-MM-DD against Sosumi.
## <Subject group 1>
- `Type.method(arg1:arg2:)` — short description, since: iOS 26.0
- ...
## <Subject group 2>
...
## Signatures verified against Sosumi
| URL | Status | Last fetched |
|---|---|---|
| https://sosumi.ai/documentation/... | 200 | YYYY-MM-DD |Static SKILL.md content stays as the mental model. latest-apis.md is the API-signature source of truth.
For each API in the baseline, fetch the corresponding Sosumi page. Two routes:
Sosumi:fetch_documentation with the API path. Returns clean Markdown.curl -fsSL https://sosumi.ai/documentation/<framework>/<api> and parse Markdown.Verify the URL resolves with HTTP 200 before treating its content as authoritative. A 404 means Apple removed or renamed the symbol — flag for review, don't silently delete from latest-apis.md.
If Sosumi itself is down (rare but possible), defer to xcrun mcpbridge's DocumentationSearch tool against on-machine Xcode-bundled docs. Note the source in the diff report so the reviewer knows which surface was canonical.
For each skill, write a per-skill report at /tmp/sosumi-refresh-<skill>-<date>.md containing:
# Refresh report: <skill-name> (YYYY-MM-DD)
## New APIs (added since last refresh)
- `Type.newMethod(...)` since iOS 26.x
- Sosumi: <url>
- Suggested home in latest-apis.md: <subject group>
## Deprecated / removed APIs
- `Type.oldMethod(...)` deprecated in iOS 26.x, removed in iOS 27.x
- Migration: see "Old patterns" section per AGENTS.md freshness contract
## Signature changes
- `Type.changedMethod(...)`
- Was: `(arg1: A, arg2: B) -> R`
- Now: `(arg1: A, arg2: B?, completion: ...) -> R`
- Source: <sosumi url>
## URL liveness
- <url>: 200
- <url>: 404 (was 200 last refresh — investigate)
## Suggested edits
[per-section guidance for the human reviewer]Don't auto-apply. The report is for human review.
Once the maintainer reviews, apply edits:
latest-apis.md under the right subject group with since: iOS X.x.## Old patterns section per AGENTS.md freshness contract — never inline date conditionals like "if before iOS 26".latest-apis.md, then check whether SKILL.md references the old shape; update if so.latest-apis.md.Commit each skill's update as a separate commit so the history reads cleanly.
If a major release happened (iOS 27.x), update the Authored against iOS 26.x / Swift 6.x / Xcode 26.x. line in each refreshed skill's SKILL.md to the new versions. Don't update minor revs (26.3 → 26.4) — those would churn the line on every Xcode point release. Use major boundaries.
Spot the patterns that aren't pure additions:
latest-apis.md and add a note explaining when to use which form.AttributedString gaining Sendable). These don't show up as new API names but unlock new patterns. Flag in the report's "Suggested edits" section.xcrun mcpbridge or the live developer.apple.com page (in a browser, not via fetch) before assuming removal./tmp/ (or a refresh-reports/ directory git-ignored at the repo root) so the repo doesn't accumulate stale audit trails.txt-apple-docs — the documentation-pipe skill: how to invoke Sosumi MCP and xcrun mcpbridge from agentsAGENTS.md — repo-level authoring rules including the freshness contract that this skill operationalizesxcrun mcpbridge setup and tool reference~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.