opengeno — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited opengeno (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Project-wide living documentation for AI-assisted codebases. One source of truth per feature — not per change.
<p align="center"> <img src="docs/assets/poster.png" alt="OpenGeno overview" width="600"> </p>
Spec-driven workflows like openspec and GitHub spec-kit organize work around changes: each requirement gets its own spec / change proposal that gets reviewed, implemented, and archived. That works well at the moment of change, but accumulates four problems over time:
same feature each describe it from a different angle. Reading them later is a triangulation problem.
any prior spec mentioned X, and where.
feature, who consolidates them, and into what?
edits, "vibe coding"), the change-specs go stale silently.
OpenGeno picks a different axis. Instead of one doc per change, it maintains one doc per user-visible feature, organized as a hierarchical tree at the project root. The tree is the current state of the project, not its change history. Changes mutate the tree; they don't accumulate beside it.
The project grows a feat-tree/ directory:
feat-tree/
├── index.md # L1 — list of modules (~500 tokens)
├── auth/
│ ├── index.md # L2 — sub-features of auth
│ ├── sign-in.md # L3 — full spec for one feature
│ └── sign-up.md
├── tasks/
│ └── ...
└── lists/
└── ...Three tiers, lazy-loaded:
A typical task reads 1–2 L3 docs, costing well under 5k tokens.
Each L3 doc carries:
code: frontmatter list of associated source pathslast_synced_commit SHA — the contract that the doc and code agreedat that commit
When code referenced by a doc changes after that SHA, the drift checker flags the doc for re-verification.
OpenGeno only adds two slash commands. Everything else — read-before-change, update-after-change, add-new-feature — happens automatically because /geno-init injects the workflow rules into your CLAUDE.md (and AGENTS.md if present), and the hooks installed by the skill enforce them.
| Command | When |
|---|---|
/geno-init | One-time project setup. Asks for documentation language (English / 中文), drift mode, and generation mode (stub-only by default, or one-shot full docs); scans the codebase, proposes modules, generates L1 + L2 + L3, writes .feat-tree.json, injects workflow rules into CLAUDE.md. |
/geno-sync | On-demand drift check & reconciliation. Walks the tree, reports drift since last sync, walks you through fixing it. |
After /geno-init runs, your CLAUDE.md carries the workflow contract. On every subsequent session, the AI:
walking L1 → L2 → L3.
last_synced_commit in the same session.
templates (in the chosen language), updates the L2 module index, cross-links from any feature that reaches it.
Two Claude Code hooks back this up:
that's referenced by an L3 doc.
warn mode itprints a summary; in block mode it refuses to end the session while drift exists.
Mode is per-project, set in .feat-tree.json (drift_mode: "warn" or "block"). Default warn.
/geno-init asks once: English or 中文. Whatever you pick, the entire tree is generated in that language — headings, prose, placeholders, the workflow rules injected into CLAUDE.md, and any future docs created or edited under the workflow.
The injection in CLAUDE.md instructs the AI to keep writing in the chosen language on subsequent sessions. So the language choice perpetuates without you having to repeat yourself.
These are infrastructure, not features. They belong in CLAUDE.md / ADRs / code comments, not in the tree.
| Type of change | Update doc? |
|---|---|
| Add / remove user-visible behavior | Required |
| Change interaction flow, layout, animation | Required |
| Change business logic branches | Required |
| Add / remove cross-module dependency | Required (both sides) |
| Bug fix where new code matches existing doc | No |
| Bug fix where behavior changed (even toward "right" answer) | Required |
| Refactor / rename — same behavior | No |
| Performance optimization — same behavior | No |
| i18n / copy / theme tweaks | No |
Rule of thumb: would a user notice? If yes → update.
OpenGeno is a Claude Code plugin (.claude-plugin/plugin.json at repo root, skills under skills/).
skills CLI (recommended)npx skills add web-abin/OpenGenogit clone https://github.com/web-abin/OpenGeno ~/.claude/plugins/marketplaces/opengenoClaude Code auto-loads any plugin under ~/.claude/plugins/marketplaces/.
Copy the two skill folders into your global skills dir:
mkdir -p ~/.claude/skills
cp -r /path/to/OpenGeno/skills/geno-init ~/.claude/skills/
cp -r /path/to/OpenGeno/skills/geno-sync ~/.claude/skills/Copy into a single project only:
cd /path/to/your-project
mkdir -p .claude/skills
cp -r /path/to/OpenGeno/skills/geno-init .claude/skills/
cp -r /path/to/OpenGeno/skills/geno-sync .claude/skills/After any of the above, run /geno-init in Claude Code on your project.
OpenGeno is built for Claude Code and uses its hooks system for drift gating. The methodology and document format work in any AI agent (Cursor, Copilot, etc.) that can read markdown — but only Claude Code gets the automatic drift detection. Other agents can run /geno-sync manually as a check-up.
If you want to understand why OpenGeno is shaped this way (rather than just how to use it), see docs/ — design rationale, architecture, and ADRs for each non-obvious choice.
Active development. Format version schema: 1. v1.0 stable API targeted — breaking schema changes will ship with a migration via /geno-sync.
MIT — see LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.