Defame1297
430f46b8e8
AGENTS.md told an offline agent to push with SKIP=apm-marketplace-check and asserted that hook was "the only one whose failure mode is 'no network'". Running all 12 pre-push hooks under a network namespace shows two fail, for one shared cause: apm-pack-check-clean resolves the same remote entry. An exact pin does not remove the ls-remote, so both hooks are named now. AGENTS.md also said everything in a plugin root except .apm/ is generated. Plugin roots carry hand-authored README.md, docs/, bin/, sources.md and .mcp.json, so an agent would hunt for an .apm/ source that does not exist or refuse the edit. The rule is positional: immunity belongs to the plugin root, and anything inside a mirrored directory is still rm -rf'd. ADR-0017 said apm strips a hooks field. The real loop is (agents, skills, commands, instructions) -- hooks absent, instructions never mentioned -- and it can never fire, because synthesize_plugin_json_from_apm_yml only emits the eight identity fields. The decision stands; the mechanism was overstated. Its mcpServers amendment is rewritten for the pointer payload and now records the real reason: inlining bypassed apm's credential sanitizer. ADR-0015's owner.email and version-pin passages are corrected against the apm source, and ADR-0016 gains the disallowedTools amendment. agent-audit's allowlist is data, so it gains disallowedTools too -- the ADR and the validator that enforces it had come apart. architecture.md described a root CLAUDE.md that imports two files (it imports one, plus an RTK block) and pointed at an ADR index that does not exist. Seven skill READMEs listed tests/ files the mirror strips, promising installed users files their install lacks; those rows are marked source-only, with the depth-4 template tests explicitly called out as surviving. And plugins/kyberforge/hooks/README.md, deleted during the conversion and preserved nowhere, is restored to a path the mirror does not own -- verified by running a sync against a scratch copy. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X7GvKuJfy2WrdBmUttV4DT
kyberforge
Skills and agents for creating, maintaining, and managing a Claude Code / Copilot CLI plugin marketplace.
Install
Claude Code:
claude plugin marketplace add <owner>/<repo>
claude plugin install kyberforge@<marketplace-name>
GitHub Copilot CLI:
copilot plugin marketplace add <owner>/<repo>
copilot plugin install kyberforge
Local (development):
# Claude Code
claude --plugin-dir ./plugins/kyberforge
# GitHub Copilot CLI
copilot plugin install ./plugins/kyberforge
Contents
Authoring source lives in .apm/. The skills/, agents/, and hooks/hooks.json paths below are the generated mirror that plugin hosts actually scan — produced by scripts/sync-plugin-content.sh, never hand-edited (ADR-0017).
| Component | Path | Description |
|---|---|---|
| Skills | .apm/skills/ → skills/ |
Slash commands available after install |
| Agents | .apm/agents/*.agent.md → agents/ |
Role-based agents; one vendor-neutral .agent.md per agent, copied verbatim to both targets (ADR-0016) |
| Hooks | .apm/hooks/ → hooks/hooks.json |
Event-triggered automation — read by Claude Code only, see below |
| MCP servers | .mcp.json |
Model Context Protocol server definitions (hand-authored at the plugin root) |
Hooks are Claude Code-only in practice. Claude Code convention-scans hooks/hooks.json at the plugin root, so that file is live. Copilot CLI has no default hooks path — agents and skills default to agents/ and skills/, but hooks defaults to nothing (docs/research/docs/github-copilot-plugins/configuration.md:47), so Copilot reads hooks only via an explicit "hooks": "hooks.json" pointer in plugin.json (docs/research/docs/github-copilot-plugins/examples.md:49). apm's manifest compiler strips pointer fields from every manifest it generates, so neither .claude-plugin/plugin.json nor .github/plugin/plugin.json carries one, and re-injecting it is the option ADR-0017 explicitly rejected. Copilot therefore loads no hooks from this plugin — and did not load them from the old root-level hooks.json either. The Copilot half of this row is aspirational, not current behaviour.
Skills
| Skill | Description |
|---|---|
forge |
Grill an unclassified "I want to add something" request, decide whether it's a skill, agent, plugin, or marketplace entry, then route to the matching author skill |
skill-author |
Create or improve a skill from scratch, audit findings, or inline feedback |
skill-audit |
Audit a skill directory against the agentskills.io spec and produce a findings report |
agent-author |
Author an agent definition file |
agent-audit |
Audit an agent definition across structure, provider safety, description and body quality, and provenance; produces a findings report |
apm-install |
Install or upgrade the apm CLI and set up the agent runtimes it drives (Copilot CLI, Codex, Gemini, generic llm) |
apm-workflow |
Author apm.yml, scaffold an apm package/marketplace, install dependencies, and compile/pack/publish/audit apm content |
Pre-commit tooling (pc-author, pc-run) lives in the git plugin, not here.
Author
Defame1297