Skip to content
skillsafebeta
← Report library
Purpose / Documents

Documentation And Adrs Skill Security Audit

What the author says it does (original text)

Records decisions and documentation. Use when making architectural decisions, changing public APIs, shipping features, or when you need to record context that future engineers and agents will need to understand the codebase.

Independent security check

Security risks found

Files checked
1
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Medium risk

A documentation task may expand into deleting commented-out code

Source references: 4
What we found

The stated purpose is recording documentation and decisions, but the final verification checklist requires that no commented-out code remain. That is a source-code cleanup instruction, not merely documentation, and it is not limited to files explicitly selected by the user.

Why this matters

If an agent applies the checklist across the repository, it could remove temporarily retained implementations, debugging fragments, or migration references, creating lasting file changes beyond what a documentation task implies. Version control may permit recovery, but uncommitted material could be lost.

The Skill is primarily for documentation and ADRs, but its active verification checklist requires that no commented-out code remain, and an earlier instruction says “Delete it.” If applied repository-wide, an agent could remove source-file content when the user only requested documentation; that content might include retained examples, temporary diagnostics, or uncommitted user work. Users can ask that this check only report findings and that deletion require explicit authorization for named files.

SKILL.md:2In the instructionsOpen original file
---name: documentation-and-adrsdescription: Records decisions and documentation. Use when making architectural decisions, changing public APIs, shipping features, or when you need to record context that future engineers and agents will need to understand the codebase.---
Show 3 other places
SKILL.md:281In the instructionsOpen original file
After documenting:- [ ] ADRs exist for all significant architectural decisions- [ ] README covers quick start, commands, and architecture overview- [ ] API functions have parameter and return type documentation- [ ] Known gotchas are documented inline where they matter- [ ] No commented-out code remains- [ ] Rules files (CLAUDE.md etc.) are current and accurate
SKILL.md:133In the instructionsOpen original file
// Don't leave commented-out code// const oldImplementation = () => { ... }  ← Delete it, git has history```
SKILL.md:279In the instructionsOpen original file
## VerificationAfter documenting:- [ ] ADRs exist for all significant architectural decisions- [ ] README covers quick start, commands, and architecture overview- [ ] API functions have parameter and return type documentation- [ ] Known gotchas are documented inline where they matter- [ ] No commented-out code remains- [ ] Rules files (CLAUDE.md etc.) are current and accurate
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

The Skill’s main purpose is to document the context and trade-offs behind architectural decisions, public APIs, and feature changes.

View source
SKILL.md:2In the instructionsOpen original file
---name: documentation-and-adrsdescription: Records decisions and documentation. Use when making architectural decisions, changing public APIs, shipping features, or when you need to record context that future engineers and agents will need to understand the codebase.---

Before creating an ADR, it requires checking the repository’s existing location, format, numbering, and heading conventions; conflicting evidence should be surfaced instead of silently introducing another scheme.

View source
SKILL.md:38In the instructionsOpen original file
Before creating an ADR, inspect the available repository context for an established convention — existing ADRs, project instructions, and ADR-related configuration or tooling (e.g. an `.adr-dir` file). An established convention overrides the defaults below. Match:- **Location and format** — e.g. `docs/adr/*.md`, `Documentation/Decisions/*.rst`, a MADR layout, or an `adr-tools` setup. Match the existing directory, file extension, and markup (Markdown vs reStructuredText).- **Numbering and naming** — continue the existing sequence and filename pattern (`ADR-004-Title.rst`, `0004-title.md`, …); don't restart at 001 or introduce a second scheme.- **Section headings** — reuse the project's heading set rather than imposing this template's.If the available evidence conflicts, surface the conflict rather than silently introducing another scheme. Only when no convention can be established do you apply the default below.

It instructs the agent to preserve old ADRs and add a new ADR that references and supersedes an old record when a decision changes, retaining historical context.

View source
SKILL.md:99In the instructionsOpen original file
- **Don't delete old ADRs.** They capture historical context.- When a decision changes, write a new ADR that references and supersedes the old one.
Start here · InstructionsSKILL.md
documentation-and-adrs
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 3 more sections are available in the original file.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Install extra software packages
SKILL.md:211In the instructionsOpen original file
1. Clone the repo2. Install dependencies: `npm install`3. Set up environment: `cp .env.example .env`
Read keys or account settings
SKILL.md:212In the instructionsOpen original file
2. Install dependencies: `npm install`3. Set up environment: `cp .env.example .env`4. Run the dev server: `npm run dev`
Lines read
289
File checksum (to compare versions)
199c58aaaa6d001fcef3517630189c14def7f7e9e2e6668c25785db191d9d7cf