block-journey — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited block-journey (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Run /block-journey <name> to document how a block or component works from two perspectives: the editor creating content, and the visitor consuming it. Use when onboarding to an unfamiliar block, before modifying one, or after building one to capture its contracts.
Parse $ARGUMENTS to extract the block name and an optional path scope:
If $ARGUMENTS contains a /, treat everything before the last / as a path substring filter and everything after as the block name. Match the filter against the full directory path, not just the immediate parent. This matters when the same plugin name exists under different parent directories (e.g., plugins/rtm-blocks vs mu-plugins/rtm-blocks). If no /, treat the entire argument as the block name and search broadly.
When the path filter matches multiple locations, list them and ask the user which one to document.
If $ARGUMENTS is empty, ask the user which block or component to document.
Do NOT modify any source files. This is documentation, not implementation.
Search the working directory for all files related to the block name from $ARGUMENTS. Do not assume a specific file structure — discover what exists.
Look for:
Use Grep and Glob to find files by name pattern and by references (imports, function calls, class names). Follow the dependency chain — if a file imports another, include it.
Present what was found:
## Discovered Files
| File | Role |
|---|---|
| path/to/block.json | Registration / attribute schema |
| path/to/edit.js | Editor component |
| path/to/frontend.js | Front-end toggle behaviour |
| ... | ... |If no files are found, tell the user and stop.
Read each discovered file. Build a mental model of:
Write to the current project's docs/journeys/ directory (relative to the working directory). Create the directory if it doesn't exist.
Write to docs/journeys/<block-name>.md using the template below. Adapt sections to what actually exists — skip sections that don't apply (e.g., no "Front-End Journey" if the block has no interactive JS).
# <Block Name> — User Journeys
**Generated:** <YYYY-MM-DD>
**Source:** <plugin or directory where the block lives>
## Files
| File | Role |
|---|---|
| ... | ... |
## Data Model
List of attributes the block stores, their types, defaults, and purpose.
| Attribute | Type | Default | Purpose |
|---|---|---|---|
| ... | ... | ... | ... |
## Editorial Journey
Step-by-step description of what an editor does when using this block in the block editor. Cover:
1. How the block is inserted
2. What content is editable inline on the canvas (RichText, MediaUpload, etc.)
3. What controls live in the sidebar (InspectorControls)
4. How inner blocks work (if any) — what's allowed, how to add/remove
5. What the editor sees vs what the visitor sees (e.g., all items expanded in editor, collapsed on front-end)
Number each step. Be specific about which component or attribute is involved.
## Render Pipeline
How saved data becomes HTML. Describe the path:
- **Static save:** JS save component outputs markup directly
- **Dynamic render:** PHP callback receives attributes → sanitises → passes to template → template outputs HTML
Include the key markup structure (simplified) showing the wrapper, key child elements, and their classes/attributes.
## Front-End Journey
Step-by-step description of what a visitor experiences. Cover:
1. Initial page load state (what's visible, what's hidden)
2. Each interaction and what it triggers (click, hover, scroll, etc.)
3. State transitions (what changes in the DOM — classes, attributes, styles)
4. Whether multiple items can be active simultaneously
5. Animations or transitions
## DOM Contract
The classes, IDs, data attributes, and ARIA attributes that connect rendered HTML to front-end JS. This is the section that matters most for maintenance — if any of these change, something breaks.
| Selector / Attribute | Used By | Purpose |
|---|---|---|
| `.block-class-name` | frontend.js | Entry point query |
| `[aria-expanded]` | frontend.js | Toggle state |
| `[aria-controls]` → `[id]` | frontend.js | Button-to-content link |
| `data-open` | frontend.css | Animation trigger |
| ... | ... | ... |
## Accessibility
ARIA pattern used, keyboard interactions, screen reader announcements. Note whether the implementation follows a recognised WAI-ARIA pattern.After writing the file, summarise what was documented and note any gaps:
docs/journeys/ in the current project..js, .jsx, .tsx, .php, .vue, or anything else.$ARGUMENTS if provided (e.g., rtm-blocks/faq), but fall back to broad search if nothing is found there.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.