repo-docs — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited repo-docs (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
repo-docs explains a repository to a human reader.
Do not make a tree tour. Build a reader model: what problem the repo solves, one real behavior it performs, the concepts behind that behavior, where source truth lives, and how to verify the understanding.
Keep the routing narrow. SKILL.md defines the contract; topic files carry the detailed rules. If a detail appears in two places, keep it in the topic file and leave a pointer here.
| File | Role |
|---|---|
SKILL.md | Entry: mission, principles, output contract, build/sync summary, verification |
REFERENCE.md | Router to topic files—open only when detail is needed |
WRITING.md | Explanation design, voice, evidence discovery |
PAGE_RULES.md | Reader paths, page types, output shape, navigation |
SCOPE_MODES.md | Seed, large/monorepo scope, specialized repos |
SYNC_RULES.md | Question loop, change sync, widened content alignment |
QUALITY_RULES.md | Evidence labels, source truth, quality bar |
EXAMPLES.md | Finished-page tone and output-shape examples |
scripts/validate_repo_docs.py | Structure, links, sync anchors, freshness checks |
validate_repo_docs.py | Compatibility wrapper for older invocations |
repo-docs-zh/SKILL.md | Chinese language overlay |
references/source-map.md only when repeated grouped locators would clutter pages.modules/, exact lookup material in references/, term disambiguation in glossary.md, guide history in change-log.md.Use the smallest package that teaches the repo honestly.
README.md, walkthroughs/one-real-run.md, modules/, references/, glossary.md, change-log.md.README.md, walkthroughs/one-real-run.md, change-log.md; use for small repos with little durable terminology.README.md, change-log.md, glossary.md, references/decisions.md; label facts as Confirmed, Planned, or Unknown.| Page | Job | ||
|---|---|---|---|
README.md | Orient the reader and point to the first useful path. | ||
walkthroughs/one-real-run.md | Follow one real behavior end to end with numbered ## Step N: behavior headings. | ||
modules/<concept>.md | Explain one durable concept named by the walkthrough. | ||
references/*.md | Hold exact lookup tables: commands, schemas, artifacts, metrics, tools, grouped source maps. | ||
glossary.md | Three columns only: `Term | Plain meaning | Further reading`. |
change-log.md | Meaningful guide changes and sync anchors. |
README.md and walkthroughs/one-real-run.md first.glossary.md and change-log.md.AGENTS.md, AGENTS.override.md, CLAUDE.md, GEMINI.md, or .cursor/rules/*.md; patch the ones that clearly govern coding agents for this repo. If none exists, create AGENTS.md. The rule must say that future repo questions and behavior-changing edits should check repo-docs/, patch stale guide pages in the same turn when needed, and record meaningful guide work in repo-docs/change-log.md.For large repos or monorepos, scope the guide to one subsystem or workflow and say what is not covered.
Build is not finished until the next coding agent can maintain the guide without rediscovering the policy. The project agent instruction Markdown is the handoff point: it should point to repo-docs/README.md, name the main walkthrough, and tell future agents to run an Understanding Sync check when repo questions or behavior-changing edits appear.
When Build creates or updates repo-docs/, search the project for agent instruction Markdown before creating anything new. Look for common project files such as AGENTS.md, AGENTS.override.md, CLAUDE.md, GEMINI.md, and .cursor/rules/*.md, plus any nearby Markdown file whose filename or heading clearly says it is for coding agents.
Patch existing agent instruction files that already govern the repo or the package being documented. Do not create extra tool-specific files just to mirror the rule. If no such file exists, create AGENTS.md at the project root.
For nested packages, patch the nearest project agent instruction Markdown that governs the generated repo-docs/ package. If the guide is created at the repository root, use the root file.
The rule should say:
repo-docs/; start with repo-docs/README.md.repo-docs/walkthroughs/one-real-run.md when that file exists.repo-docs/change-log.md with verification and Synced through <sha> when git is available.Default block to write:
## Repo docs
The living project guide is in `repo-docs/`. Start with `repo-docs/README.md`; when `repo-docs/walkthroughs/one-real-run.md` exists, use it as the main behavior trace.
Before answering repo architecture, onboarding, or "how does this work" questions, read the relevant guide pages and inspect the current source behind the answer. If the guide is missing, stale, or wrong, update the smallest owning page in the same turn before answering.
When code, config, data, scripts, tests, or behavior changes, run an Understanding Sync check before finishing. Patch only the guide pages that would otherwise mislead the next reader. Record meaningful guide updates in `repo-docs/change-log.md` with verification and `Synced through <sha>` when git is available.Keep this root rule short. Do not copy the guide into AGENTS.md or CLAUDE.md; those files route future agents back to repo-docs/.
repo-docs/ is maintained during the user ↔ coding agent conversation, not in a separate offline pass. Except Build, Seed, and Cleanup, run [Understanding Sync](#understanding-sync) each turn when repo-docs/ exists. Modes name common situations—not detached jobs. Detail: SCOPE_MODES.md, SYNC_RULES.md.
| Mode | Use when | What to do |
|---|---|---|
| Seed | No real source/runtime/test/data contract yet | Status-labeled project memory; do not describe plans as implemented |
| Build | First repo docs or onboarding material | One real workflow; wire root agent file; run validator; deliver |
| Sync | Interaction or repo state shows the guide may be stale | Run Understanding sync; patch only stale pages |
| Cleanup / removal | User asks to delete generated repo docs | Remove the package and stale root pointers |
| Question refinement | A repo question shows the guide built the wrong model | Smallest stable patch, anchor in change-log.md, answer with a link |
When repo-docs/ exists, ask: what would a new reader misunderstand if they read the guide today?
Patch the smallest owning page when this turn changed behavior-bearing source, data, config, scripts, or tests; a user correction revealed a stable understanding gap; or validator warnings show stale links, missing sync anchors, or likely drift.
Do not patch for one-off debug state, local environment quirks, or personal preference unless the user asks to preserve it.
Every material sync updates repo-docs/change-log.md with the trigger, changed pages, verification, and Synced through <sha> when git is available.
Use this loop during coding-agent interaction:
AGENTS.md / CLAUDE.mdUse WRITING.md for voice and explanation rules. The short version:
Evidence status: Confirmed unless noted.Before delivery, confirm:
repo-docs/README.md and reach the main walkthrough.walkthroughs/one-real-run.md follows one real behavior with numbered steps.Plain model, Code model, and Read next when they exist.references/, not in the main narrative.Repo docs sync rule, or AGENTS.md was created.change-log.md records meaningful guide work and includes Synced through <sha> when git is available.Before finishing, check structure, local links, source links, narrative flow, module ownership, and reference-page lookup behavior.
Run:
python scripts/validate_repo_docs.py <path-to-repo-docs> --repo-root <repo-root>First build: tell the user what the reader can now do, where to start, the key pages, scope, validator result, and root agent-file status. Keep durable history in change-log.md, not in chat.
Cleanup: if the user asks to remove repo docs, delete the generated docs package and stale root-agent pointers. Do not recreate docs in the same turn unless explicitly asked.
Widened sync closeout: when the user explicitly asks to sync, tidy, hand off, or repair stale docs, follow SYNC_RULES.md and summarize by changed layer—not a substitute for per-turn Understanding sync.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.