add-format — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited add-format (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Invoke this skill any time a new input or output format is being added to AILANG Parse — no matter how the request is phrased. The cost of forgetting a surface (Pages deploys failing silently, registry out of sync with docs, SDK READMEs stale) is far higher than the cost of running through the checklist. Also use it when the user asks "what's left?" mid-rollout, to audit which surfaces are still missing.
Adding a format hits ~20 distinct files across parser code, WASM bundle, docs, SDKs, release manifests, and deployment messaging. Skipping any one of them breaks something silently — the LaTeX/v0.15.0 rollout missed the vendor script and two Pages deploys failed before anyone noticed. Work through this list in order; do not batch steps 6-8 before 1-5 are green.
Confirm with the user:
.tex, .latex, .ltx.tar.gz/.zip bundles. If yes, flag which archive tooling is missing (see std/tar/std/gzip blocker tracked as ailang-core#156).\input resolution) = server-side only, WASM gets a single-file subset.Set a working variable — $FMT in examples below is the lowercase short name (tex, epub, etc.).
docparse/services/${FMT}_parser.ailexport pure func parse${Fmt}(content: string) -> [Block]docparse/types/document.ail; don't add new variants unless absolutely necessary.markdown_parser.ail — see feedback_ailang_string_perf.md — never concat(xs, [x]) in foldl.docparse/services/${FMT}_input_resolver.ail (or _extract.ail)! {FS} only where unavoidable.parse${Fmt} must still work without FS for the WASM path.docparse/services/format_router.aildocparse/main.ailoutput_formatter. ailang check docparse/
./bin/docparse data/test_files/<sample>.$FMTailang.toml — including the input_resolver helper if you made one. Missing this means consumers of the installed package silently lack the format.ailang.toml (e.g. 0.9.3 → 0.10.0). Follow the release checklist at feedback_release_checklist.md for all version files to sync.ailang = ">=X.Y.Z" — to match whatever stdlib features your parser uses. ailang lockdocparse/services/docparse_browser.ailimport docparse/services/${FMT}_parser (parse${Fmt}) export pure func parse${Fmt}Content(content: string) -> string {
encode(ja(blocksToJson(parse${Fmt}(content))))
} cp docparse/services/${FMT}_parser.ail docs/ailang/docparse/services/
cp docparse/services/docparse_browser.ail docs/ailang/docparse/services/docs/scripts/vendor-wasm-packages.sh"services/${FMT}_parser.ail" to the MODULES=(…) array.docs/scripts/check-wasm-bindings.py before deploying Pages — if MODULES_TO_LOAD and this script disagree, deploy fails and the live homepage silently stays on the previous commit.docs/js/wasm-demo.jsMODULES_TO_LOAD array:{ name: 'docparse/services/${FMT}_parser', path: 'docparse/services/${FMT}_parser.ail' }
textFormats arrays (two copies, lines ~391 and ~2040).parseTextFile: } else if (ext === '${FMT}' || ext === 'otheralias') {
r = engine.call('parse${Fmt}Content', content);
} python3 docs/scripts/check-wasm-bindings.pyMust say "✓ All WASM binding checks passed" before you push.
docs/assets/sample_${FMT}.${FMT} (or whatever extension)./bin/docparse docs/assets/sample_${FMT}.${FMT} and check the block output is rich.docs/index.html<input type="file" accept="…">.<span>${FMT_UPPER}</span> to the format ticker.<button class="dp-demo-btn" data-file="assets/sample_${FMT}.${FMT}" title="…">${Label}</button> to the samples row.docs/${FMT}-parsing.html.docs/workbench.htmlaccept=".…".DEMO_SET array.docs/js/site-data.jsformats.input array.formats.input_count.docs/${FMT}-parsing.html — use the /landing-page skill.docs/docs.html — add a card under Document Formats grid linking to the landing page.docs/benchmarks.html — add a section if there's a relevant benchmark suite.docs/api.html — supported-formats list in quickstart / referencedocs/claude-code.html — "N Input Formats" sectiondocs/integrations.html — deterministic formats listdocs/migrate-from-unstructured.html — format list (usually 2 occurrences — use replace_all)docs/privacy.html — deterministic-format parsing paragraphREADME.md — "Parsing (N formats)" lineCLAUDE.md — project-purpose paragraphsdks/python/README.md — "Parse N formats" line + any format listssdks/go/README.mdsdks/js/README.mdsdks/r/README.md ailang check docparse/ # type-check
./bin/docparse --test # inline tests
python3 docs/scripts/check-wasm-bindings.py # WASM bindings
uv run benchmarks/run_benchmarks.py --suite office # no regressions git tag v$NEW_VERSION && git push origin v$NEW_VERSIONFires publish-ailang.yml. Watch with gh run list --workflow=publish-ailang.yml --limit 1 — prior runs take ~6-7 min.
gh run list --workflow=pages.yml --limit 2If it shows failure within ~20s, it's the bindings check — you missed step 13 or something equivalent.
ailang install sunholo/ailang_parse@$NEW_VERSION --dry-run ailang messages send docparse "sunholo/ailang_parse v$NEW_VERSION available — adds .${FMT} parsing. Pull and rebuild when ready. No API/route changes. …" \
--from ailang-parse \
--title "ailang_parse v$NEW_VERSION incoming — .${FMT} support"Include: new modules, Block ADT impact (almost always "no changes"), known caveats (archive support, FS requirements), benchmark numbers if relevant.
0.10.0 ≠ bug fix — if you're adding a format, it's a feature release. Pick the version accordingly.Parser code:
docparse/services/${FMT}_parser.aildocparse/services/${FMT}_input_resolver.ail (if multi-file/archive)docparse/services/format_router.aildocparse/main.ailPackage:
ailang.toml (exports + version + ailang constraint)ailang.lockpyproject.tomlWASM:
docparse/services/docparse_browser.ail (+ mirror to docs/ailang/)docs/ailang/docparse/services/${FMT}_parser.aildocs/scripts/vendor-wasm-packages.shdocs/js/wasm-demo.js (MODULES_TO_LOAD + both textFormats + parseTextFile route)UI:
docs/assets/sample_${FMT}.${FMT}docs/index.html (accept, ticker, button, grid card)docs/workbench.html (accept, DEMO_SET)docs/js/site-data.jsDocs:
docs/${FMT}-parsing.htmldocs/docs.htmldocs/benchmarks.html (if applicable)docs/api.htmldocs/claude-code.htmldocs/integrations.htmldocs/migrate-from-unstructured.htmldocs/privacy.htmlREADME.mdCLAUDE.mdSDK READMEs:
sdks/python/README.mdsdks/go/README.mdsdks/js/README.mdsdks/r/README.mdRelease:
git tag pushedgh run view — publish-ailang succeededgh run view — pages deploy succeededailang install … --dry-run — registry has new versionailang messages send docparse … — deployment repo notified~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.