write-docs — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited write-docs (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Write accurate, user-focused documentation with real examples by executing operations through the user.
Ask the user what documentation to write. Options:
ALWAYS start with a clean test cluster to ensure reproducible documentation.
Follow the actual docs (`docs/setup/mcp-setup.md`) - this validates they work.
Claude executes all infrastructure steps directly using Bash tool:
kind delete cluster --name dot-ai-test 2>/dev/null || true
rm -f ./kubeconfig.yaml kind create cluster --name dot-ai-test --kubeconfig ./kubeconfig.yaml
export KUBECONFIG=./kubeconfig.yaml kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
# Wait for ingress to be ready
kubectl wait --namespace ingress-nginx --for=condition=ready pod --selector=app.kubernetes.io/component=controller --timeout=300sIf documenting a feature not yet in published charts:
# Build MCP server image
npm run build
docker build -t dot-ai:test .
kind load docker-image dot-ai:test --name dot-ai-test
# Build agentic-tools plugin image
docker build -t dot-ai-agentic-tools:test ./packages/agentic-tools
kind load docker-image dot-ai-agentic-tools:test --name dot-ai-testAdd these flags to helm install:
--set image.repository=dot-ai \
--set image.tag=test \
--set image.pullPolicy=Never \
--set plugins.agentic-tools.image.repository=dot-ai-agentic-tools \
--set plugins.agentic-tools.image.tag=test \
--set plugins.agentic-tools.image.pullPolicy=NeverIMPORTANT: Always use KUBECONFIG=./kubeconfig.yaml for all kubectl/helm commands.
If any step fails or doesn't match existing docs: STOP and discuss whether to update those docs before proceeding.
Why fresh cluster? Ensures documentation examples work from a known clean state and validates setup docs.
Present an outline of sections to write. Example:
1. Overview (what it does, when to use it)
2. Prerequisites
3. Basic Usage (with real examples)
4. Advanced Features
5. API Reference
6. Troubleshooting
7. Next StepsGet user confirmation on the outline before proceeding.
🚨 CRITICAL: One section at a time. NEVER write multiple sections or the whole doc at once.
For each section:
Key distinction: Infrastructure/setup = Claude runs it. User-facing MCP examples = User runs it and shares output.
NEVER do these:
After all sections are written:
mcp-tools-overview.md if adding a new tool guideTell the user: "Documentation complete. Please review the full file and let me know if any adjustments are needed."
For MCP tool operations:
Please send this intent to your MCP client:
"Ingest this document into the knowledge base: [content] with URI: [url]"
Share the response you receive.For status checks:
Please ask: "Show dot-ai status"
Share what you see for the Vector DB collections.For bash commands:
Please run:
kubectl get pods -n dot-ai
Share the output.--filename not -f, --namespace not -n, --output not -o). Full flags are more self-documenting for users unfamiliar with the tools.docs/guides/mcp-*-guide.mddocs/setup/*.mddocs/guides/mcp-tools-overview.mddocs/img/~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.