Files
holocron/plugins/kyberforge
Defame1297 175ea89c0a fix(skill-audit): make check 9 reachable, wrap-safe and never silently skipped
Check 9 shipped in #130 to close #118, but three defects meant it could not do the job it was
added for.

Why:
- It is INFO-only, so it always exits 0 — and SKILL.md graded exit 0 "a genuine pass" and said the
  script "prints nothing on success". Every check-9 INFO was discarded before it reached a report,
  behind three further doors that only opened on a non-zero exit.
- `parse_field_raw()` matched `(.+)`, which does not span newlines, so only the first physical line
  of a wrapped value was compared. Rewriting only the continuation line of a wrapped Description
  from a hedge to a confident claim produced no finding at all — verbatim the regression #118 was
  filed about. The bullet branch had the same shape: a wrapped bullet broke the loop and dropped
  every later entry.
- A `git show` failure at the base ref was treated as "creation, nothing to flag" and skipped the
  whole skill with no output, collapsing "absent at that ref" with "not tracked under that name".
  A gitignored `.claude/skills/` copy reported clean while the authoring path reported four changed
  claims. The script's own usage text promises this is "never a silent skip".

Implementation notes:
- Exit-code guidance re-keyed on output as well as code: 0-and-silent passes, 0-with-output is
  INFO-only findings, 1 is FAILs, 2 never ran.
- `parse_field_raw()` is line-based and joins continuation lines; `normalize_field_text()`'s
  docstring is now true rather than aspirational. A reorder deliberately fires: the two fields share
  one parser, and order-insensitivity would mean splitting a prose Description on commas.
- The discarded `show_err` is now surfaced as one whole-check INFO naming both readings.
- `--base-ref=` given empty now beats the env var, as the usage text always claimed.

`validate.sh` gains an ADR-0022 `metadata.version` check at FAIL tier, because any lower tier lets
skill-author Step 4 report done on a file the commit gate then refuses. Its `read` heuristic now
skips here-doc bodies — reflowing the one offending line would have cleared the finding and left
the cause, since every usage() heredoc is one wrap from putting the English verb in column 0.

Impact: provenance tests 73 -> 82, validate tests 64 -> 72. Test 72 previously deleted origin/main
before asserting the override, so it proved the flag works with no default rather than that it beats
one; it now moves origin/main forward first.

Refs: #118
ADR: 0022
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EeH8SCbcrCAQrtymkNuhKP
2026-09-09 05:15:05 +00:00
..

kyberforge

Skills and agents for creating, maintaining, and managing a Claude Code / Copilot CLI plugin marketplace.

Install

Claude Code:

claude plugin marketplace add <owner>/<repo>
claude plugin install kyberforge@<marketplace-name>

GitHub Copilot CLI:

copilot plugin marketplace add <owner>/<repo>
copilot plugin install kyberforge

Local (development):

# Claude Code
claude --plugin-dir ./plugins/kyberforge

# GitHub Copilot CLI
copilot plugin install ./plugins/kyberforge

Contents

Authoring source lives in .apm/. The skills/, agents/, and hooks/hooks.json paths below are the generated mirror that plugin hosts actually scan — produced by scripts/sync-plugin-content.sh, never hand-edited (ADR-0017).

Component Path Description
Skills .apm/skills/ → skills/ Slash commands available after install
Agents .apm/agents/*.agent.md → agents/ Role-based agents; one vendor-neutral .agent.md per agent, copied verbatim to both targets (ADR-0016)
Hooks .apm/hooks/ → hooks/hooks.json Event-triggered automation — read by Claude Code only, see below
MCP servers .mcp.json Model Context Protocol server definitions (hand-authored at the plugin root)

Hooks are Claude Code-only in practice. Claude Code convention-scans hooks/hooks.json at the plugin root, so that file is live. Copilot CLI has no default hooks path — agents and skills default to agents/ and skills/, but hooks defaults to nothing (docs/research/docs/github-copilot-plugins/configuration.md:47), so Copilot reads hooks only via an explicit "hooks": "hooks.json" pointer in plugin.json (docs/research/docs/github-copilot-plugins/examples.md:49). apm's manifest compiler strips pointer fields from every manifest it generates, so neither .claude-plugin/plugin.json nor .github/plugin/plugin.json carries one, and re-injecting it is the option ADR-0017 explicitly rejected. Copilot therefore loads no hooks from this plugin — and did not load them from the old root-level hooks.json either. The Copilot half of this row is aspirational, not current behaviour.

Skills

Skill Description
forge Grill an unclassified "I want to add something" request, decide whether it's a skill, agent, plugin, or marketplace entry, then route to the matching author skill
skill-author Create or improve a skill from scratch, audit findings, or inline feedback
skill-audit Audit a skill directory against the agentskills.io spec and produce a findings report
agent-author Author an agent definition file
agent-audit Audit an agent definition across structure, provider safety, description and body quality, and provenance; produces a findings report
apm-install Install or upgrade the apm CLI and set up the agent runtimes it drives (Copilot CLI, Codex, Gemini, generic llm)
apm-workflow Author apm.yml, scaffold an apm package/marketplace, install dependencies, and compile/pack/publish/audit apm content

Pre-commit tooling (pc-author, pc-run) lives in the git plugin, not here.

Author

Defame1297