Skills doc-sync-tool
📦

doc-sync-tool

Content revision r1 High Risk ⚙️ External commands📁 Filesystem access

Synchronize AI Agent Documentation

Teams often maintain separate instruction files for different AI coding tools. This skill synchronizes those files from the newest copy to reduce manual drift.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "doc-sync-tool" from https://skillstore.io/skills/zhanlincui-doc-sync-tool.md and its manifest at https://skillstore.io/api/skills/zhanlincui-doc-sync-tool/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/zhanlincui-doc-sync-tool.md Signed manifest GET /api/skills/zhanlincui-doc-sync-tool/manifest Signed lockfile GET /api/skills/zhanlincui-doc-sync-tool/lockfile

Test it

Using "doc-sync-tool". Synchronize a project where CLAUDE.md is the newest agent instruction file.

Expected outcome:

The tool selects CLAUDE.md as the source and updates AGENTS.md and GEMINI.md in the same folder.

Using "doc-sync-tool". Start watch mode while editing an agent instruction file.

Expected outcome:

The watcher reports the changed file, scans that directory, and synchronizes the matching companion files.

Using "doc-sync-tool". Validate whether a sync is safe for a repository.

Expected outcome:

A reviewer checks the intended source file, confirms expected target files, and verifies the changes with version control.

Security Audit

High Risk
v5 • 7/8/2026 Open versioned report

Most static alerts are false positives from Markdown examples, JavaScript template literals, ANSI color codes, and hardcoded helper commands. Confirmed risks involve local file writes, watch-triggered synchronization, predictable test temporary paths, and unreviewed propagation of AI agent instruction files. No prompt injection attempt, network access, or credential exfiltration was found in the reviewed files.

13
Files scanned
1,747
Lines analyzed
8
Review items
0
False positives ignored

Confirmed security concerns (2)

High
sync.js:71-101watch.js:74-88
Unreviewed Agent Instruction Overwrite
The sync logic selects the newest AGENTS.md, CLAUDE.md, or GEMINI.md file and writes its content to companion files without a diff, backup, or confirmation. This can propagate malicious or mistaken agent instructions across tools.
The code explicitly sorts by modification time and writes source content into other agent files. Watch mode automatically triggers the same sync path after file changes.
Medium
sync.js:9-10sync.js:28-41run-sync.sh:7-13
Broad Recursive Project Modification Scope
The tool scans from the current working directory or a wrapper-selected target directory, then recursively processes matching files. Running it from a broad parent directory can modify many projects unexpectedly.
CONFIG.scanPath is process.cwd(), scanDirectory recurses through child directories, and run-sync.sh changes into a caller-provided target before running sync.js.
Capability review items (8)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
rename-quick.js:24
Node.js fs operations
fs.renameSync(file, newPath);
fs.renameSync renames every discovered Agents.md file under the current tree and can overwrite AGENTS.md without a prompt. This is an intended helper, but it creates real data-integrity risk.
Medium
rename-quick.js:43
Node.js fs operations
fs.renameSync(file, newPath);
fs.renameSync renames every discovered Gemini.md file under the current tree and can overwrite GEMINI.md without a prompt. This is an intended helper, but it creates real data-integrity risk.
Medium
sync.js:93
Node.js fs operations
fs.writeFileSync(targetFilePath, content, 'utf8');
writeFileSync overwrites an existing target agent file when content differs from the selected newest source. There is no diff, backup, or confirmation gate.
Medium
sync.js:101
Node.js fs operations
fs.writeFileSync(targetFilePath, content, 'utf8');
writeFileSync creates missing agent instruction files from the selected source content. This modifies the repository automatically and can propagate unwanted instructions.
Medium
sync.js:93
Synchronous file operations
fs.writeFileSync(targetFilePath, content, 'utf8');
The synchronous write overwrites an existing target agent file without review. The risk is the write behavior, not the synchronous API choice.
Medium
sync.js:101
Synchronous file operations
fs.writeFileSync(targetFilePath, content, 'utf8');
The synchronous write creates target agent files automatically without approval. This can spread incorrect or malicious instruction content.
Medium
test.sh:9
Temp directory access
TEST_DIR="/tmp/doc-sync-test-$(date +%s)"
The test script uses a predictable /tmp path based on the current timestamp and later removes it recursively. This is test-only, but predictable temp paths are unsafe on shared systems.
Medium
watch.js:63
File system watching
const watcher = fs.watch(dir, { recursive: true }, (eventType, filename) => {
fs.watch monitors the project tree and triggers synchronization on matching file changes. Persistent automatic sync increases the chance of unreviewed overwrites.

Risk Factors

⚙️ External commands (69)
EXAMPLES.md:23-24 EXAMPLES.md:24-27 EXAMPLES.md:27-28 EXAMPLES.md:28-34 EXAMPLES.md:392-394 EXAMPLES.md:254 README.md:230 rename-quick.js:5 rename-quick.js:14 rename-quick.js:33 rename-quick.js:25 rename-quick.js:44 rename-quick.js:51 rename-to-uppercase.sh:14 rename-to-uppercase.sh:22 rename-to-uppercase.sh:1 run-sync.sh:6 run-sync.sh:7 run-sync.sh:1 run-watch.sh:6 run-watch.sh:7 run-watch.sh:1 SKILL.md:10 SKILL.md:29-32 SKILL.md:32-36 SKILL.md:36-42 SKILL.md:42-46 SKILL.md:46-52 SKILL.md:52-56 SKILL.md:56-65 SKILL.md:65-69 SKILL.md:69 SKILL.md:78-80 SKILL.md:80-86 SKILL.md:86-90 SKILL.md:90 SKILL.md:98-100 SKILL.md:100-106 SKILL.md:106-109 sync.js:25 sync.js:60 sync.js:69 sync.js:75 sync.js:94 sync.js:97 sync.js:102 sync.js:108 sync.js:110 sync.js:115 sync.js:123 sync.js:124 sync.js:136 sync.js:147 sync.js:148 sync.js:149 sync.js:150 test.sh:8 test.sh:9 test.sh:76 test.sh:78 test.sh:1 watch.js:21 watch.js:50 watch.js:78 watch.js:90 watch.js:101 watch.js:111 watch.js:112 watch.js:113
📁 Filesystem access (31)
EXAMPLES.md:121 EXAMPLES.md:122 EXAMPLES.md:154 QUICKSTART.md:82 QUICKSTART.md:83 QUICKSTART.md:84 QUICKSTART.md:85 rename-quick.js:24 rename-quick.js:43 rename-quick.js:7 rename-quick.js:14 rename-quick.js:33 rename-to-uppercase.sh:18 rename-to-uppercase.sh:26 sync.js:31 sync.js:79 sync.js:90 sync.js:93 sync.js:101 sync.js:53 sync.js:79 sync.js:90 sync.js:93 sync.js:101 test.sh:26 test.sh:36 test.sh:48 test.sh:64 test.sh:77 test.sh:9 watch.js:63
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/zhanlincui-doc-sync-tool/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/zhanlincui-doc-sync-tool/security.svg)](https://skillstore.io/skills/zhanlincui-doc-sync-tool?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/zhanlincui-doc-sync-tool?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/zhanlincui-doc-sync-tool/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/zhanlincui-doc-sync-tool.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

ZhanlinCui. (2026). doc-sync-tool security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/zhanlincui-doc-sync-tool/audits/5

BibTeX citation

@techreport{zhanlincui-zhanlincui-doc-sync-tool-2026, author = {ZhanlinCui}, title = {doc-sync-tool security audit report (audit version 5)}, institution = {Skillstore}, year = {2026}, number = {5}, url = {https://skillstore.io/skills/zhanlincui-doc-sync-tool/audits/5}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "doc-sync-tool security audit report (audit version 5)" version: "unspecified" type: report authors: - name: "ZhanlinCui" date-released: "2026-07-08" url: "https://skillstore.io/skills/zhanlincui-doc-sync-tool/audits/5" identifiers: - type: other value: "skillstore:zhanlincui-doc-sync-tool:audit:5" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
71
Community
83
Spec Compliance

What You Can Build

Align Agent Instructions

Keep AGENTS.md, CLAUDE.md, and GEMINI.md consistent after editing one instruction file.

Standardize Multi-Project Docs

Run a one-time sync across several project folders that share the same agent guidance pattern.

Monitor Active Documentation Changes

Use watch mode during local development so companion agent files update after saves.

Try These Prompts

Run a Safe First Sync 
Review this repository for AGENTS.md, CLAUDE.md, and GEMINI.md files. Explain which files would change before running the sync tool.
Check Sync Results 
Compare the agent instruction files after synchronization. Summarize changed files and highlight any unexpected overwritten content.
Prepare Watch Mode 
Help me start watch mode for this project. First identify the project root and explain the directories that will be monitored.
Harden the Sync Workflow 
Audit this doc sync workflow. Recommend changes for dry-run support, backups, confirmation prompts, and safer project-root validation.

Best Practices

  • Run the tool only inside a version-controlled project with a clean working tree.
  • Review the newest source file before syncing because it will overwrite companion files.
  • Use a narrow project root instead of running from a home directory or shared parent folder.

Avoid

  • Do not run watch mode in a broad directory that contains unrelated projects.
  • Do not sync after editing untrusted agent instructions without reviewing the content.
  • Do not rely on the tool as a backup or merge system for divergent documentation.

Frequently Asked Questions

Which files does the sync script target?
The current code targets AGENTS.md, CLAUDE.md, and GEMINI.md with uppercase names.
How does the tool choose the source file?
It sorts matching files by modification time and uses the newest file as the source.
Can the tool overwrite existing content?
Yes. It writes the newest source content into existing target files when content differs.
Does it send files to a network service?
No network behavior was found in the reviewed files. The tool operates on local files.
Should I use watch mode in production?
Use caution. Watch mode continuously monitors a project root and can overwrite files after changes.
What should I check before publishing this skill?
Add dry-run output, backups, confirmation prompts, and consistent filename casing in docs and tests.

Developer Details

Author

ZhanlinCui

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/ZhanlinCui/Ultimate-Agent-Skills-Collection/tree/main/doc-sync-tool

Ref

64ca8af0f54a325752f08bd54e52151061ea659a

Maintenance freshness

7/20/2026

Usage

11 downloads · 244 views

File structure

📄 EXAMPLES.md

📄 INDEX.md

📄 package.json

📄 QUICKSTART.md

📄 README.md

📄 rename-quick.js

📄 rename-to-uppercase.sh

📄 run-sync.sh

📄 run-watch.sh

📄 SKILL.md

📄 sync.js

📄 test.sh

📄 watch.js

More from ZhanlinCui

View all

Related Skills

View all