Borrowing it
Nothing to install: this file belongs to raccioly/docguard. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/raccioly/docguard/main/.agent/skills/docguard-sync/SKILL.mdgit clone --depth 1 https://github.com/raccioly/docguardWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/raccioly/docguard/docguard-sync)<a href="https://agentmods.dev/skills/raccioly/docguard/docguard-sync"><img src="https://agentmods.dev/badge/skills/raccioly/docguard/docguard-sync/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/raccioly/docguard/docguard-sync"><img src="https://agentmods.dev/badge/skills/raccioly/docguard/docguard-sync.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 4 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 44 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 54 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 78 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.01616 |
| Opus 5.5 | $0.00018 | $0.00646 |
| Sonnet 5.5 | $0.00009 | $0.00323 |
| Haiku 4.5 | $0.00005 | $0.00162 |
Grade A, and why
docguard-sync scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 145 lines — stays where its author put it; the contents beside it link to each section on GitHub.
DocGuard Sync Skill
Running DocGuard
Run docguard from PATH when it is installed. Otherwise run
npx --yes [email protected], the release these instructions ship with, in its
place. Every docguard … command below means one of the two.
User Input
$ARGUMENTS
You MUST consider the user input. If --since <ref> is provided, include the
git diff context in your reasoning when reviewing prose sections.
Goal
When code changes, re-derive the code-truth surface (endpoints, entities,
screens, tech stack, env vars), refresh the matching <!-- docguard:section source=code --> blocks in canonical docs in place, and review/refresh the
human-written prose in the same docs so it still describes reality.
Operating Constraints
- Mechanical refreshes do not need you. DocGuard does them itself. Your job is the prose sections flagged as "review" — where the human writing may no longer match the new code reality.
- Never edit anything outside the marked
source=humansections in generated docs. The markers protect human writing; respect them. - Use the dry run first to see what will change before applying.
Execution Flow
Step 1 — Preview what's stale
docguard sync 2>&1
Reads:
↻/•lines: code-truth sections that drifted (you don't need to write these).🤖 Prose to reviewlines: human-written sections whose surrounding code changed — these are yours.
Step 2 — Apply the mechanical refresh
docguard sync --write 2>&1
Re-derives every code-truth section from the current code and rewrites only those markers. Idempotent — running again is a no-op when up to date.
Step 3 — Review the flagged prose
For each 🤖 Prose to review entry:
- Open the doc (e.g.
docs-canonical/API-REFERENCE.md). - Locate the
<!-- docguard:section id=<id> source=human -->block. - Read the surrounding
source=codesection first — that's the new truth (e.g. the refreshed endpoint list, the refreshed screens table). - Update the human prose so it still accurately describes that truth.
Examples of what to update:
- The API overview's endpoint count, or its description of the surface area.
- The Architecture overview when new components/services appeared.
- The Screens flows when new screens were added/removed/renamed.
- Stay inside the
source=humanmarkers — don't touch the code sections.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed 03d3e0a89988
- 9d ago Changed 47697e09128c
- 11d ago Changed aebbf9ee2030
- 12d ago Changed f29f73016d2d
- 21d ago Changed · +6 lines 651b263c6824
- 22d ago Changed · +8 lines 041548d2f673
- 1mo ago Changed · +15 lines d09ee7de1bb6
- 1mo ago Changed 59f358c018d3
- 1mo ago Changed fc28bea25f13
- 1mo ago First seen · 116 lines · 45 tokens per session scan A 46247726a57b
docguard-sync is a skill published in the GitHub repository raccioly/docguard (32 stars, last pushed 3d ago), licensed MIT. It adds 45 tokens to every session and 1,616 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
do
Work a SpecWeave increment task by task - claim, implement inside its Files, test, commit, done with evidence - alone, unattended or in lanes, then close. Use for "implement", "continue", "auto".
handoff
Hand work to another tool, account or machine and pick it up there, in two words. Use when the user says "hand off", "hand off all", "out of tokens", "switching accounts", "pick up" or "continue".
sw-do
Work a SpecWeave increment task by task - claim, implement inside its Files, test, commit, done with evidence - alone, unattended or in lanes, then close. Use for "implement", "continue", "auto".
sw-handoff
Hand work to another tool, account or machine and pick it up there, in two words. Use when the user says "hand off", "hand off all", "out of tokens", "switching accounts", "pick up" or "continue".
increment
Plan work as a SpecWeave increment - one spec.md with Problem, Scope, numbered ACs, Approach and Tasks - before writing code. Use for "plan a feature", "new increment", "let's build X".
sw-increment
Plan work as a SpecWeave increment - one spec.md with Problem, Scope, numbered ACs, Approach and Tasks - before writing code. Use for "plan a feature", "new increment", "let's build X".