Files

Defame1297 e58234eaf9 fix(kyberforge): address agent-audit audit findings in validate-provenance.sh

## Why

Two issues were found in `validate-provenance.sh` by `/skill-audit`:

1. `find_plugin_root` only walked up looking for bare `plugin.json`, missing
   the `.claude-plugin/plugin.json` layout used by kyberforge plugins — matching
   the logic already present in `validate.sh`.

2. Check numbers in `--help` and inline comments had a gap (0,1,2,4,5,6) from
   a previously removed check, making the numbering confusing to readers.

## Implementation Notes

Check numbers renumbered sequentially 0–5 in both the `--help` output block
and the inline `# --- Check N:` comments. The `find_plugin_root` condition now
mirrors the `detect_scope` function in `validate.sh`.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0147vXtL5sP6vorDdqXGJJU9

2026-07-04 11:33:03 +00:00

README.md

feat(kyberforge): add agent-audit skill (closes #11 )

2026-07-04 10:06:37 +00:00

validate-provenance.sh

fix(kyberforge): address agent-audit audit findings in validate-provenance.sh

2026-07-04 11:33:03 +00:00

validate.sh

feat(kyberforge): improve agent-audit skill with platform-accurate checks and description quality reference

2026-07-04 11:10:32 +00:00

README.md

scripts/

Executable code bundled with this skill. Agents run scripts in this directory to perform repeatable operations rather than reinventing the logic each run.

When to add a script

Add a script when agents independently reinvent the same logic across runs — building the same parser, chart, or validation routine from scratch each time. Bundle it here once, tested and reliable.

Script requirements (agentskills.io)

Scripts must be designed for non-interactive, agentic execution:

No interactive prompts — agents run in non-interactive shells. Accept all input via flags, env vars, or stdin. A script that blocks on TTY input hangs indefinitely.
Expose --help — this is how agents learn your script's interface. Keep the output concise; it enters the agent's context window.
Structured output — write data (JSON, CSV, TSV) to stdout. Write progress, warnings, and diagnostics to stderr.
Idempotent — prefer "create if not exists" over "create and fail on duplicate". Agents may retry on failure.
Meaningful exit codes — 0 for success, non-zero for failure. Use distinct codes for different failure types; document them in --help.
Dry-run support — add --dry-run for destructive operations.

Self-contained scripts

Bundle dependencies inline so the agent can run the script with a single command.

Python (PEP 723 + uv):

# /// script
# dependencies = ["requests>=2.31,<3"]
# requires-python = ">=3.11"
# ///
import requests

uv run scripts/my-script.py

If no scripts are needed

Delete this README and the scripts/ directory entirely.