doctor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited doctor (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Read-only audit. Never mutates the filesystem. Wraps bin/doctor.sh, which internally runs bin/retrofit.sh --report-only.
doctor.sh requires --profile <name>. The skill's job is to pick the right one without pestering the user:
.nyann/profile or equivalent profile hint in the repo.(default, nextjs-prototype, python-cli, or any user/team profile they've installed). Don't silently pick default — the audit is only meaningful against an intended baseline.
bin/doctor.sh --target <cwd> --profile <name> [--json] [--scope <csv>]--profile takes a bare profile name (e.g. python-cli, nextjs-prototype), not a filesystem path. The script resolves the name to the profile JSON internally.
Pass --json when the user says "machine-readable", "as JSON", "pipe this", or similar — otherwise emit the human-readable report.
Pass --scope <csv> when the user wants to inspect only a subset of the audit — e.g. "just check my docs", "are my hooks healthy". Accepts any of docs, hooks, branching, gitignore, editorconfig, github, history, all, comma-separated. When narrower than all, the rendered output gains a Scope: <csv> line and --persist is auto-disabled (a partial-scope health score would corrupt the trend series in memory/health.json).
| Code | Meaning | What to tell the user |
|---|---|---|
| 0 | clean | "No drift. Hygiene and docs look healthy." |
| 4 | warnings only | "Not failing, but some things have drifted. Here's the list." Offer to remediate via retrofit. |
| 5 | critical | "Missing required files or broken internal links. Run retrofit to fix." |
The output has several blocks. When the user asks "what does each section mean?", explain in terms of the repo, not nyann internals:
.husky/pre-commit when the profile declares husky hooks).
.husky/pre-commit exists but doesn't actually run the expected linter).
Conventional Commits. Informational — nyann never rewrites history.
MCP link reachability (when MCP connectors are available), orphan files under docs/ / memory/, and misplaced docs (files at non-canonical paths that could be reorganized via retrofit).
rulesets (when .github.tag_protection_pattern is declared in the profile), CODEOWNERS-required gate (when a CODEOWNERS file exists or .github.require_code_owner_reviews=true), and repo-security settings (Dependabot, secret scanning, push protection, code scanning). Soft-skips when gh is missing or unauthenticated. Driven by bin/gh-integration.sh --check under the hood. Critical drift here bumps the exit code to 5; warn drift bumps it to 4.
docs/ whose correlated sourcepaths have changed substantially since the doc itself was last touched. Heuristic-based (bin/docs-staleness.sh); thresholds configurable via the profile (documentation.staleness_threshold_*). Informational — never affects exit code.
for version-ref drift (semver older than latest tag), broken markdown link targets, missing npm run / make script references, and count-claim drift (opt-in per profile). Driven by bin/docs-drift-scan.sh. Critical/high findings escalate the exit code (mirrors GitHub protection); medium/low are advisory.
*.tf, Chart.yaml, Pulumi*.yaml,*.tfvars, Ansible vars) scanned for committed secrets (critical), unpinned module refs / providers / deps (high), missing lockfiles and Helm appVersion lag (medium). Filesystem + git only — no terraform plan, no cloud calls. Driven by bin/iac-drift-scan.sh, gated per profile via iac.drift_check.{enabled, unpinned_refs, missing_lockfile, secrets_in_vars, version_lag}. Critical/high findings escalate the exit code (mirrors public-doc drift); medium/low are advisory. Silent on non-infra repos. Like public-doc drift, this is score-isolated — it shapes the exit code but not the numeric health score.
The protection block respects nyann's gh-best-effort invariant — it never prompts for credentials and never blocks the audit. When gh isn't reachable, the section reports skipped and contributes no drift to the exit code.
After showing the audit report, check whether memory/health.json exists in the target repo. If it does:
bin/health-trend.sh --target <cwd> --last 10.last 10 checks (↑ improving)."
category_deltas show worsening (delta < 0 in the breakdown),call them out: "⚠ missing got worse (−3 over the window)."
down, suggest: "Score is declining — run/nyann:retrofit to address the drift."
If memory/health.json doesn't exist, skip silently — don't suggest creating it. The persist step happens automatically via doctor.sh.
retrofit ("fix this repo'sdrift"). Do not attempt to fix anything from inside the doctor skill.
expectation for that item; don't guess.
no silencing mechanism inside doctor itself. If it's a recurring false positive, the profile or the repo's .nyann-ignore-equivalent is the right lever (future work, not today).
retrofit.inspect-profile (ifavailable) or read the profile JSON directly.
retrofit with the newprofile name.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.