gen-claudemd — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited gen-claudemd (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Standalone CLAUDE.md regeneration. Wraps bin/gen-claudemd.sh with the same inputs bootstrap uses, but skips the full bootstrap pipeline so the user can refresh CLAUDE.md after changing their profile, adding docs, or restructuring workspaces.
The generator needs three inputs. Resolve them in this order:
markers; load with bin/load-profile.sh <name>. If the user names a specific profile, use that instead.
the repo's existing doc routing (local / Obsidian / Notion / split), re-derive the plan using the same routing the user originally chose. Check profile.documentation.storage_strategy; if it names a non-local backend, also run bin/detect-mcp-docs.sh and pass --mcp-targets to route-docs. For local-only repos (the common case): bin/route-docs.sh --profile <profile-path> suffices. Write the resulting DocumentationPlan JSON to a temp file.
bin/detect-stack.sh --path .for a StackDescriptor JSON. Write it to a temp file. Skip if detection fails (gen-claudemd falls back to profile-only data).
For monorepos, also resolve workspace configs:
bin/resolve-workspace-configs.sh --stack <stack-path> --profile <profile-path>Pass the result via --workspace-configs <path>.
Before running the generator, capture the existing managed block so you can show a before/after diff. If CLAUDE.md exists with markers, read the content between <!-- nyann:start --> and <!-- nyann:end -->. If no markers exist, note that a new block will be appended.
Ask: "Regenerate the nyann-managed block in CLAUDE.md?"
Show what will feed into the generation (profile name, stack, storage strategy) so the user can verify the inputs are correct. Skip the confirmation only when the user said "just do it".
On confirmation:
bin/gen-claudemd.sh \
--profile <profile-path> \
--doc-plan <doc-plan-path> \
[--stack <stack-path>] \
[--workspace-configs <ws-path>] \
[--project-name <name>] \
--target <cwd>The script writes CLAUDE.md in-place — content outside markers is preserved verbatim.
If the script warns about the 3 KB soft cap, relay the warning and suggest /nyann:optimize-claudemd as a follow-up.
If the script refuses at the 8 KB hard cap, explain and offer --force to override.
optimize-claudemd skill.explain-state skill.doctor skill.migrate-profile skill(which calls gen-claudemd internally after the switch).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.