skills/local/cali-agents-md-generator/SKILL.md
[Cali] Generate and maintain project AGENTS.md files using semantic analysis. Triggers when: a project has no AGENTS.md, user asks to 'create AGENTS.md', 'generate agents md', 'setup agents md', or when starting work on a project that lacks one. Also triggers when user asks to 'check if AGENTS.md is stale', 'update agents md', or when evolving an existing AGENTS.md. Covers: initial generation from codebase analysis, sem-based staleness detection, pre-commit hooks, and CI guards. Always offer hook installation when invoked for any reason.
npx skillsauth add renatocaliari/agent-sync-public-skills cali-agents-md-generatorInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Creates and maintains lean, high-signal AGENTS.md files for AI coding agents.
Uses sem (semantic version control) for staleness detection on ongoing commits.
semsem is required for staleness detection. Check if installed:
sem --version
If not installed:
brew install sem-cli
Verify it works in the project:
cd /path/to/project
sem diff --format json # Should return JSON with entity changes
Every write to AGENTS.md requires user approval before the write happens. This is not optional. The user must see what will change and explicitly confirm (yes / no / modify).
For each phase that produces a file change, the skill MUST:
Forbidden patterns:
Why this matters: AGENTS.md is read by every future agent session. A bad edit corrupts the context for hundreds of future calls. Confirmation cost is seconds; the cost of an unconfirmed bad edit is permanent.
Does the project root have AGENTS.md?
ls AGENTS.md 2>/dev/null
Skip if AGENTS.md does not exist (handled by Phase 1).
When AGENTS.md exists, do NOT assume it conforms to the canonical shape. Read it fully and classify before deciding what to do next:
# Count current size
wc -l AGENTS.md
# Read in full
cat AGENTS.md
Then classify into one of three buckets:
| Bucket | Signal | Next step |
|---|---|---|
| A. Conforms to template | Section headers match references/agmd-template.md; total ≤ 30 lines | Phase 3 (update-only: investigate each section, present a per-section diff old→new, do NOT rewrite the whole file) |
| B. Diverges but contains valid content | Custom section names, but content is current; or over 30 lines with real value | Phase 3.5 (refactor to canonical shape) |
| C. Contains legacy / deprecated sections | Some sections reference uninstalled tools, deprecated CLIs, removed packages, "## lat.md Documentation"-style sections, broken URLs, or describe tech no longer in the project. Other sections may still be valid — only the legacy ones are removed. | Phase 3.5 (refactor + flag for removal) |
How to detect "legacy / deprecated":
# Example: check if a referenced tool/CLI is still installed
which <tool-name> 2>/dev/null
test -d <referenced-dir> 2>/dev/null
grep -l "<referenced-package>" go.mod package.json requirements.txt 2>/dev/null
Always show the classification to the user before proceeding. They may re-classify if the skill's judgment is wrong.
Example output to user:
I read the existing AGENTS.md (62 lines) and compared it to the canonical template.
Classification: Bucket C (has legacy sections)
| Existing section | Lines | Status | Action | |---|---|---|---| |
## lat.md Documentation| 32 | Legacy (extension uninstalled) | Remove | |## Datastar Go SDK v2 Watch| 9 | Current | Keep, move under canonical | |## Funcionalidades do Produto| 8 | Custom but valid | Map to canonical section | |## Landing Page| 7 | Custom but valid | Map to canonical section |Propose: refactor to canonical shape, removing 32 lines of legacy content. OK to proceed?
Generate a minimal AGENTS.md using the template from references/agmd-template.md.
Before writing, follow the User Confirmation Contract:
Analyze the full codebase to fill in placeholders:
find . -type f -name '*.go' | head -30 (or relevant extensions)main.go, cmd/, index.ts, etc.Makefile, go.mod, package.json, Dockerfilego.mod, package.json, requirements.txtFill every [To be determined] and [Add your ... here] placeholder.
Remove any section that stays empty after investigation.
Target: 20-30 lines max. If over 30 lines, move detailed content to separate docs.
Before writing, follow the User Confirmation Contract:
When the existing AGENTS.md has good content but wrong shape (Bucket B or C
from Phase 1.5), restructure it. Do NOT just patch in place — the result must
match the canonical template from references/agmd-template.md.
Steps:
docs/<topic>.md file and
reference it from the canonical section ("See docs/landing-page.md").references/agmd-template.md
as the skeleton. Fill canonical sections from the mapped content.docs/*.md files (preserve history,
don't lose knowledge)..gitignore or add a comment explaining the new file structure
if non-obvious.Forbidden in this phase:
docs/*.md)This phase is the formal gate — file is on disk but not yet "approved".
Show the user:
Ask explicitly: "Final review. Approve? (yes / no / modify)"
Do not consider the task complete until the user has explicitly approved.
After the user approves in Phase 4, run the validator skill to catch quality issues the human review may have missed. The validator is read-only and warn-only — it never blocks, it surfaces.
Discover the validator skill (same portable pattern the pre-commit hook uses — project-local first, then home, then XDG):
VALIDATOR_DIR=""
for d in \
"./.agents/skills/cali-agents-md-validator" \
"./.pi/skills/cali-agents-md-validator" \
"${HOME}/.agents/skills/cali-agents-md-validator" \
"${HOME}/.pi/skills/cali-agents-md-validator" \
"${XDG_DATA_HOME:-${HOME}/.local/share}/agents/skills/cali-agents-md-validator"; do
[ -f "${d}/SKILL.md" ] && VALIDATOR_DIR="${d}" && break
done
If the validator is installed:
if [ -n "${VALIDATOR_DIR}" ] && [ -f "${VALIDATOR_DIR}/references/validate-agents-md.sh" ]; then
bash "${VALIDATOR_DIR}/references/validate-agents-md.sh" ./AGENTS.md || true
fi
Show the validator report to the user. If there are failures (not just warnings):
If the validator is NOT installed: skip silently. Do not block the
skill. Mention once: "Validator skill not found. Skipping automated quality
check. Install at any time: see cali-agents-md-validator skill."
Why this phase exists: Human review is good for content ("is this section meaningful?") but bad for mechanical checks (line count, secrets, missing required sections). The validator is the single source of truth for mechanical quality. Running it here closes the build → review → test loop on every AGENTS.md the skill produces.
Every time this skill is invoked — whether creating new, reviewing, or evolving — check if the sem pre-commit hook is installed and offer to install it.
Check if hook exists:
test -f .git/hooks/pre-commit && grep -q "sem diff" .git/hooks/pre-commit 2>/dev/null && echo "installed" || echo "not installed"
If not installed, ask the user:
The
sempre-commit hook detects when code entities (functions, classes, methods) change and warns if AGENTS.md may be stale. This keeps your project docs accurate without manual checking.Shall I install the sem staleness hook in
.git/hooks/pre-commit?
If user confirms, install:
# If no existing pre-commit hook:
cp references/pre-commit-hook.sh .git/hooks/pre-commit
chmod +x .git/hooks/pre-commit
# If existing hook needs merging: append sem check to end of existing hook
cat references/pre-commit-hook.sh >> .git/hooks/pre-commit
If user declines, skip silently. Don't ask again in this session.
If already installed, confirm silently:
✅ sem staleness hook already installed in .git/hooks/pre-commit
<!-- Do not restructure or delete sections -->The pre-commit hook uses sem diff --format json to detect entity-level changes
(functions, classes, methods, headings) and warns when AGENTS.md may need updating.
What sem provides:
What the hook checks:
For GitHub Actions, add the workflow from references/github-action-guard.yml
to .github/workflows/agents-md-guard.yml. It runs sem diff in CI and
comments on PRs when code entities change without corresponding AGENTS.md updates.
Input: "This project has no AGENTS.md, create one"
Steps:
ls AGENTS.md 2>/dev/null → not foundOutput: "Created AGENTS.md with 24 lines covering: entry point, build, test, conventions. Hook installed."
Input: "Check if our AGENTS.md is still accurate"
Steps:
ls AGENTS.md 2>/dev/null → foundsem diff --format json → shows 5 entity changes since last AGENTS.md updateOutput: "Found 5 entity changes since last update. Updated 2 sections. Hook already installed."
Input: "Install the staleness hook"
Steps:
test -f .git/hooks/pre-commit && grep -q "sem diff" .git/hooks/pre-commit → not foundcp references/pre-commit-hook.sh .git/hooks/pre-commitchmod +x .git/hooks/pre-commitOutput: "✅ Sem staleness hook installed. It will warn when code entities change without AGENTS.md updates."
Input: "Our AGENTS.md is outdated and bloated, clean it up"
Steps:
ls AGENTS.md 2>/dev/null → found (62 lines, expected 20-30)docs/, canonical sections refilleddocs/landing-page.md and docs/funcionalidades.mdOutput: "Refactored 62-line AGENTS.md to 24-line canonical shape. Removed 1 legacy section (32 lines). Moved 2 custom sections to docs/. Hook already installed."
sem --version → not foundbrew install sem-clireferences/agmd-template.md — Minimal AGENTS.md template (70-100 lines)references/pre-commit-hook.sh — sem-based staleness detection hookreferences/github-action-guard.yml — Optional CI guard workflowIf a generated AGENTS.md turns out to be bad days or weeks later:
git revert <commit> # restore previous AGENTS.md
# then re-run this skill with the old file as the starting point
The skill is idempotent: re-running on an existing file goes through Phase 1.5 classification (Bucket A/B/C) and applies the right path. Recovery does not require a special "undo" path.
tools
Auto-initialize structured documentation for any project using lat.md (knowledge graph of markdown files with [[wiki links]], // @lat: code refs, and semantic search). Detects cali-product-workflow artifacts (spec-product.md, spec-tech.md, critiques) and uses them as seed material. Falls back to extracting business rules, architecture, and design decisions directly from the codebase. Use when a project lacks structured documentation or when lat.md/ is missing. After seeding, lat.md extension hooks keep documentation alive automatically.
testing
[Cali] Server security audit and hardening for private servers behind Tailscale. Use when: auditing server security, hardening SSH/firewall/Docker, checking for vulnerabilities, setting up fail2ban, reviewing port exposure, or responding to security alerts. Covers 6 layers: CloudFlare, UFW, Tailscale, SSH, Docker, Application. Triggers: "server security", "security audit", "harden server", "SSH hardening", "firewall rules", "UFW config", "fail2ban", "port security", "Docker security", "vulnerability check", "security review".
tools
Run supply chain security scans before installing packages or before releases. Triggers when: user installs a package (npm, pip, go get, brew), user asks to 'scan dependencies', 'check vulnerabilities', 'supply chain', 'security audit', 'run trivy', 'run socket', or before any release/deployment. Also triggers on mentions of: socket.dev, trivy, OSV-scanner, dotenvx, CVE, dependency audit. Covers all four tools with concrete commands.
tools
Create GitHub releases following project conventions. Triggers when: user says 'release', 'create release', 'push release', 'deploy to main', 'merge to main', user merges a PR to main, or when git push to main is detected. Also triggers on mentions of: gh release, semver, version bump, changelog, release-please. Covers: config-driven (read .release.yml and execute) and fallback (gh CLI) release flows, versioning rules, tag management, and the mandatory release-on-merge convention.