geno-sync — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited geno-sync (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Detect and (optionally) reconcile drift between L3 feature docs and the code they describe. This is the second of OpenGeno's two skills; run it on demand when you suspect the tree is out of sync with code.
test -d feat-tree || { echo "no tree — run /geno-init first"; exit 1; }If no tree exists, abort with the message above.
Before printing anything to the user, determine which language the tree is written in. Check, in order:
.feat-tree.json for a language field (added by future versions)CLAUDE.md for the OpenGeno injection block — look for "文档语言:中文"or "Doc language: English" inside the <!-- BEGIN OpenGeno --> / <!-- END OpenGeno --> markers
feat-tree/index.md — if its prose is inChinese, use Chinese; otherwise English
Use that language for all output of this skill — drift summary, clarifying questions, reconciliation prompts, any new doc prose written during reconciliation.
The script lives next to this skill (or in the global install location):
${CLAUDE_PLUGIN_ROOT}/scripts/drift-check.sh~/.claude/skills/geno-init/scripts/drift-check.sh.agents/skills/geno-init/scripts/drift-check.sh(Note: scripts live under geno-init/scripts/ because that skill is where they were installed; geno-sync reads them as siblings.)
Run it:
bash <path-to>/drift-check.shIt prints lines like:
DRIFT feat-tree/auth/login.md lib/features/auth/login_page.dart 4
STUB feat-tree/onboarding/welcome.md
BROKEN feat-tree/legacy/old.md lib/legacy/old_screen.dart
STALE_SHA feat-tree/profile/edit.md abc123...Bucket the results into:
DRIFT lines with > 1 commit, especially with non-trivial diff)DRIFT with 1 commit, or commits that look likerefactor/format/comment-only)
STUB — never synced; awaiting first fill)BROKEN — referenced code file no longer exists)STALE_SHA — recorded SHA is no longer in git history,e.g. after a force-push)
For each DRIFT, briefly inspect the commits to make the red/yellow call:
git log --oneline <last_synced_commit>..HEAD -- <code-path>Heuristic:
Print the report in the tree's language. Structure:
OpenGeno drift report — <project> @ <current-sha>
In sync (n)
Yellow / suspicious (n)
- <doc-path> — <reason>
Red / likely drift (n)
- <doc-path>
<code-path>: <commit-count> commits — <commit subjects, top 3>
Never-synced stubs (n)
- <doc-path>
Broken code links (n)
- <doc-path> -> <missing-code-path>
Stale SHA (n)
- <doc-path> — last_synced_commit not in repo history
Orphan code candidates (suggested, may be intentional)
- <code-path>The orphan-code section is optional — surface only if the user explicitly asks or the count is small (< 10). Otherwise it's noise.
Use AskUserQuestion (in the tree's language) with options:
Default to option 1.
For each doc the user wants to reconcile:
code: path: git diff <last_synced_commit>..HEAD -- <code-path>updating based on the diff. Edit only those sections. Stay in the tree's language.
cross-feature link, update the linked-to doc's "Cross-feature links" (or 「跨功能链路」for Chinese trees) section.
last_synced_commit: → current git rev-parse HEADlast_reviewed: → todayCritical: do not bump last_synced_commit if you only spot-checked one section. Either reconcile fully or leave the SHA stale and let the next run flag it again. Bumping SHAs without verification is the one failure mode that destroys this whole system.
gray): empty-SHA docs from /geno-init. Don't conflatewith drift. Their meaning depends on gen_mode in .feat-tree.json:
gen_mode: "stub" (or missing) — section bodies are placeholders(TODO / 待补充). The reconciliation action is fill: write the prose from a code read, then bump SHA only after the user confirms the result is right.
gen_mode: "full" — section bodies already contain best-effortprose generated at init from a code read, but unverified. The reconciliation action is review: read the doc against the current code, correct anything wrong, then bump SHA. Don't bump just because prose exists; the SHA is the verification signal, not the content.
Surface both in the report; only act on them when the user asks ("fill stubs" or "review full-mode docs" can be its own pass).
broken): for each, ask: was the file moved, renamed, ordeleted?
code: to the new path.the doc (move to feat-tree/_archived/<original-path>.md and remove its row from the L2 index). If no, the user has a problem to solve in the tree's structure.
stale): the recorded SHA isn't in history (likelyforce-push or branch rebase). Treat the doc as never-synced (gray) and reconcile from current HEAD.
Print, in the tree's language:
documented workflow (vibe coding, manual edits, merge from another branch)
The Stop hook (installed by /geno-init) runs drift-check.sh non-interactively at session-end and either warns or blocks. It doesn't fix anything.
/geno-sync is the interactive counterpart: it runs the same checker but walks the user through reconciliation.
| Don't | Why |
|---|---|
| Bulk-bump all SHAs to current HEAD without per-doc review | Defeats the whole purpose; produces a "fresh" tree that doesn't actually match code |
| Treat all yellows as noise | Refactors sometimes change behavior subtly; spend 30 seconds on each |
| Auto-edit doc content based on git diff alone | Risk of describing "what changed" rather than "current behavior" — needs judgment, not diff translation |
| Conflate stubs with drift | Stubs are unfinished bootstrapping, not drift. Different action |
Bump a gen_mode: "full" doc's SHA without re-reading the code | Full-mode prose is unverified by definition; bumping the SHA without verification destroys the entire drift system |
| Switch language mid-reconcile | The tree's language is fixed at init time; respect it |
| Run sync at session-end of every change | That's what the Stop hook is for. /geno-sync is for catching what other people / sessions did |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.