route-docs — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited route-docs (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Standalone doc-routing and scaffold regeneration. Composes bin/route-docs.sh (produces a DocumentationPlan) and bin/scaffold-docs.sh (materializes the local-target portion) so the user can change doc storage after initial bootstrap without re-running the full pipeline.
bin/load-profile.sh <name>.bin/detect-stack.sh --path . for a StackDescriptor (optional;used by scaffold-docs for stack-aware architecture templates).
docs/, memory/,docs/decisions/, etc.) so the user sees what will change.
The user's intent maps to a --routing value:
| User says | Routing spec |
|---|---|
| "everything local" | all:local (default) |
| "docs in Obsidian" | all:obsidian |
| "docs in Notion" | all:notion |
| "PRDs in Notion, ADRs in Obsidian, rest local" | prd:notion,adrs:obsidian,research:local,architecture:local |
If the user's intent is ambiguous, you MUST call the `AskUserQuestion` tool (not plain text):
{
"questions": [
{
"question": "Where should documentation be stored?",
"header": "Routing",
"multiSelect": false,
"options": [
{ "label": "Local (Recommended)", "description": "docs/ directory in the repo" },
{ "label": "Obsidian", "description": "Route to an Obsidian vault via MCP" },
{ "label": "Notion", "description": "Route to a Notion workspace via MCP" },
{ "label": "Custom split", "description": "Different backend per doc type" }
]
}
]
}memory is always local regardless of routing.
For any non-local routing, first run bin/detect-mcp-docs.sh to discover available MCP connectors. The result is an MCP doc-targets JSON; pass it to route-docs via --mcp-targets <path>. Without this, route-docs will reject non-local backends because it validates each chosen backend against --mcp-targets.available[].
For MCP-routed targets, also collect the required parameters:
--obsidian-vault <name> and optionally--obsidian-folder <path>.
--notion-parent <id-or-url>.Run route-docs in preview mode:
bin/route-docs.sh \
--profile <profile-path> \
[--routing <spec>] \
[--mcp-targets <mcp-doc-targets.json>] \
[--obsidian-vault <name>] [--obsidian-folder <path>] \
[--notion-parent <id>] \
[--project-name <name>]Output is a DocumentationPlan JSON (schemas/documentation-plan.schema.json). Show the user:
any v1.6.0+ archetype-aware types — api_reference, runbook, deployment, glossary — when use_archetype_scaffolds is enabled on the profile) and its target (local path, obsidian, notion).
storage_strategy (local / obsidian / notion / split).Notion databases).
Before scaffolding, check for existing docs at non-canonical paths:
bin/detect-doc-conformance.sh --target <cwd> --archetype <archetype>If the output is non-empty, offer to reorganize before scaffolding (same flow as bootstrap step 4c — "reorganize all" / "let me pick" / "leave as-is"). Reorganization ensures content is preserved at the canonical paths rather than creating blank templates alongside existing docs at wrong paths.
On confirmation:
bin/scaffold-docs.sh \
--plan <plan-path> \
[--stack <stack-path>] \
[--project-name <name>] \
--target <cwd>The scaffolder is idempotent — existing files are never overwritten. Only gaps get filled.
For MCP-routed targets (type != local), scaffold-docs skips them with a note. The skill layer handles MCP page creation via the configured MCP server (Obsidian / Notion) as documented in skills/bootstrap-project/references/mcp-routing.md.
After the scaffold, the CLAUDE.md doc-map table may be stale. Suggest running /nyann:gen-claudemd to refresh the managed block with the new routing.
gen-claudemd skill.doctor skill.bootstrap-project skill.in skills/bootstrap-project/references/mcp-routing.md; follow those instructions for the non-local targets.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.