What is docguard-review?

A read-only review of a project's documentation and its relationship to the codebase. It examines canonical documents, supporting files, and, when present, specification, plan, and task files.

Use it to produce a severity-ranked report about documentation health. It also suggests fixes, but does not make changes.

It finds documentation that has drifted from the code, inconsistent cross-references, missing coverage, and unclear overall explanations.

How raccioly/docguard configures Claude Code

Reuse

Borrowing it

Nothing to install: this file belongs to raccioly/docguard. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/raccioly/docguard/main/.agent/skills/docguard-review/SKILL.md

Clone the repo

git clone --depth 1 https://github.com/raccioly/docguard

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/raccioly/docguard/docguard-review/github.svg)](https://agentmods.dev/skills/raccioly/docguard/docguard-review)

Your own site

<a href="https://agentmods.dev/skills/raccioly/docguard/docguard-review"><img src="https://agentmods.dev/badge/skills/raccioly/docguard/docguard-review/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/raccioly/docguard/docguard-review"><img src="https://agentmods.dev/badge/skills/raccioly/docguard/docguard-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 50 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,760 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 4 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

medium MCP Rug Pull · line 6
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 52
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 53
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 54
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00050	$0.02760
Opus 5.5	$0.00020	$0.01104
Sonnet 5.5	$0.00010	$0.00552
Haiku 4.5	$0.00005	$0.00276

Measured 6d ago against content hash c1142a229127, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

docguard-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agent/skills/docguard-review/SKILL.md · 233 lines

How it starts

The opening of the file, as written. The whole thing — 233 lines — stays where its author put it; the contents beside it link to each section on GitHub.

DocGuard Review Skill

Running DocGuard

Run docguard from PATH when it is installed. Otherwise run npx --yes [email protected], the release these instructions ship with, in its place. Every docguard … command below means one of the two.

User Input

$ARGUMENTS

You MUST consider the user input before proceeding (if not empty).

Goal

Perform a comprehensive, read-only analysis of the project's documentation health. Unlike the docguard-guard skill (which runs CLI validators), this skill performs semantic analysis — checking whether documentation actually matches the codebase, whether cross-references are consistent, and whether the documentation tells a coherent story.

Operating Constraints

STRICTLY READ-ONLY: Do not modify any files. Output a structured analysis report only. Offer remediation suggestions that the user must explicitly approve before any changes are made.

Execution Flow

Step 1: Gather Documentation Inventory

List all canonical docs: Read every file in docs-canonical/
List support files: Check for CHANGELOG.md, DRIFT-LOG.md, AGENTS.md, README.md, ROADMAP.md
Check for spec-kit artifacts: If .specify/ exists, include specs/*/spec.md, specs/*/plan.md, specs/*/tasks.md
Build a document map:

Document	Exists	Last Modified	Size	Metadata Version
ARCHITECTURE.md	✅	2026-03-14	5.2KB	0.5.0
SECURITY.md	✅	2026-03-14	3.1KB	0.5.0
...	...	...	...	...

Step 2: Run Quantitative Analysis

Execute DocGuard's diagnostic and scoring tools:

docguard diagnose 2>&1
docguard score 2>&1
docguard guard --format json
docguard verify --evidence --format json
docguard verify --semantic --format json

Record:

Guard pass/fail counts per validator
CDD maturity score (0-100)
ALCOA+ compliance attributes
Category breakdown
Exact declared evidence states and the remaining heuristic claim tasks

Read the full file on GitHub · 233 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

6d ago Changed c1142a229127
9d ago Changed bfd24759fd04
11d ago Changed 480117814d2f
12d ago Changed ab2ba540f6bf
21d ago Changed · +6 lines 791a0232963d
22d ago Changed · +8 lines c74cf3b7b5c8
1mo ago Changed · +27 lines 295f02492577
1mo ago Changed 357f6d844cf2
1mo ago Changed 94871499e28a
1mo ago First seen · 192 lines · 50 tokens per session scan A 8051afb552ee

Subscribe to this mod's changes

docguard-review is a skill published in the GitHub repository raccioly/docguard (32 stars, last pushed 3d ago), licensed MIT. It adds 50 tokens to every session and 2,760 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Code review Writing and docs ai-agents cdd cli documentation drift-detection eu-ai-act

review

Adversarial review of an increment before it ships, by a fresh context or another model family; every finding cites path:line and is re-verified. Use for "review", "qa", "critique this".

anton-abyzov/specweave · 45 tokens

sw-review

Adversarial review of an increment before it ships, by a fresh context or another model family; every finding cites path:line and is re-verified. Use for "review", "qa", "critique this".

anton-abyzov/specweave · 45 tokens

find-simplifications

Use for a periodic repo-wide sweep of qwen-code for accumulated excess surface — dead components and files, orphaned locale keys, exports nothing consumes, added-then-removed scaffolding — filing candidates on a tracking issue and landing only what a maintainer has said yes to. Repo-wide and evidence-first; every…

QwenLM/qwen-code · 103 tokens

swarm-pr-review

Run a graph-guided, tool-augmented PR review using context packing, parallel exploration, mandatory repository-agnostic risk-family coverage with dispatch scaled to diff size and risk, independent reviewer validation, critic challenge, and metrics writeback. Use for deep pull request review with low false-positive…

ZaxbyHub/opencode-swarm · 91 tokens

sw-do

Work a SpecWeave increment task by task - claim, implement inside its Files, test, commit, done with evidence - alone, unattended or in lanes, then close. Use for "implement", "continue", "auto".

anton-abyzov/specweave · 46 tokens

agent-debug-ci

Investigate failed scheduled or nightly GitHub Actions runs on the default branch, determine whether the failure is reproducible and repository-owned, implement the smallest evidence-backed fix, validate it, and open a pull request. Use when a failed nightly CI event starts an agent, or when the standard CI or…

NVIDIA/elements · 80 tokens

docguard: Skill for Claude Code