Borrowing it
Nothing to install: this file belongs to raccioly/docguard. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/raccioly/docguard/main/.agent/skills/docguard-fix/SKILL.mdgit clone --depth 1 https://github.com/raccioly/docguardWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/raccioly/docguard/docguard-fix)<a href="https://agentmods.dev/skills/raccioly/docguard/docguard-fix"><img src="https://agentmods.dev/badge/skills/raccioly/docguard/docguard-fix/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/raccioly/docguard/docguard-fix"><img src="https://agentmods.dev/badge/skills/raccioly/docguard/docguard-fix.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 5 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Prompt Injection · line 12 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- medium MCP Rug Pull · line 6 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 42 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 54 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 173 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.02776 |
| Opus 5.5 | $0.00018 | $0.01110 |
| Sonnet 5.5 | $0.00009 | $0.00555 |
| Haiku 4.5 | $0.00005 | $0.00278 |
Grade A, and why
docguard-fix scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 264 lines — stays where its author put it; the contents beside it link to each section on GitHub.
DocGuard Fix Skill
Running DocGuard
Run docguard from PATH when it is installed. Otherwise run
npx --yes [email protected], the release these instructions ship with, in its
place. Every docguard … command below means one of the two.
User Input
$ARGUMENTS
You MUST consider the user input before proceeding (if not empty).
If user specifies --doc <name>, focus on that single document.
If no arguments, fix ALL issues found by docguard diagnose.
Goal
Research the actual codebase to generate or repair canonical documentation that passes DocGuard's configurable guard suite. This skill replaces generic templates with real, project-specific content and iterates until quality checks pass.
Operating Constraints
- NEVER use placeholder content — every section must reference real files, real modules, real dependencies
- ALWAYS back up before overwriting — use
safeWrite()pattern or create.bakfiles - Maximum 3 validation iterations — if still failing after 3 rounds, report remaining issues and stop
- Research before writing — understand the codebase first, then generate documentation
Scope: act findings only
Read disposition from docguard guard --format json before repairing anything.
act— DocGuard asserts a defect and names the correction. In scope.escalate— DocGuard observed a signal and the judgement belongs to a human (freshness history, diff-overlap suspicion, documented-endpoint absence). Out of scope for this skill. Report them for review; never edit a document to silence one. A history heuristic saying a review is DUE is not evidence that the document is wrong, and stamping a new review date to clear it destroys the signal without doing the review.
Also read parserTier: a finding produced by regex-fallback or fallback-language came from a pattern match rather than a syntax tree, so verify the underlying source before rewriting a document around it.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed 650a5d7e53ff
- 9d ago Changed f501256b4136
- 11d ago Changed d8b4431d5ea2
- 12d ago Changed 4775c76abf3d
- 21d ago Changed · +6 lines 5a0f0d0bb90d
- 22d ago Changed · +8 lines b86b614b640f
- 1mo ago Changed · +9 lines ddfbcf8a6b75
- 1mo ago Changed c9fe6d3bde27
- 1mo ago Changed 3ff97cf8a9e6
- 1mo ago First seen · 241 lines · 45 tokens per session scan A d637a785a526
docguard-fix is a skill published in the GitHub repository raccioly/docguard (32 stars, last pushed 3d ago), licensed MIT. It adds 45 tokens to every session and 2,776 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
do
Work a SpecWeave increment task by task - claim, implement inside its Files, test, commit, done with evidence - alone, unattended or in lanes, then close. Use for "implement", "continue", "auto".
handoff
Hand work to another tool, account or machine and pick it up there, in two words. Use when the user says "hand off", "hand off all", "out of tokens", "switching accounts", "pick up" or "continue".
sw-do
Work a SpecWeave increment task by task - claim, implement inside its Files, test, commit, done with evidence - alone, unattended or in lanes, then close. Use for "implement", "continue", "auto".
sw-handoff
Hand work to another tool, account or machine and pick it up there, in two words. Use when the user says "hand off", "hand off all", "out of tokens", "switching accounts", "pick up" or "continue".
increment
Plan work as a SpecWeave increment - one spec.md with Problem, Scope, numbered ACs, Approach and Tasks - before writing code. Use for "plan a feature", "new increment", "let's build X".
sw-increment
Plan work as a SpecWeave increment - one spec.md with Problem, Scope, numbered ACs, Approach and Tasks - before writing code. Use for "plan a feature", "new increment", "let's build X".