Files
holocron/plugins/kyberforge/.apm/skills/factory-audit/SKILL.md
Defame1297 9285b29e3c fix(factory-audit): flag unbraced plugin-root tokens and close hook check gaps
Why: PR #144 review round 4 reproduced hooks referencing $PLUGIN_ROOT or
${PLUGIN_ROOT} without a path separator passing the audit, although apm
only rewrites ${TOKEN}/ and the deployed hook points nowhere.

- FAIL unbraced or unseparated plugin-root tokens
- check the exec bit for scripts run via an interpreter -c string
- skip env NAME=value prefixes when locating bare relative paths
- correct input: and empty-frontmatter messages, depth-walk applyTo braces
- INFO on unrecognised targets; failing-case tests for untested checks
- document tiers, blind spots and crash exit 2; drop rtk from portable flow
- restore the after-a-hand-edit trigger; pin upstream apm source URL

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KkT7RSDwDbmrM9T34b6sTi
2026-09-29 08:00:17 +00:00

4.5 KiB

name, description, allowed-tools, metadata
name description allowed-tools metadata
factory-audit Use when a skill, agent, apm hook, instruction or prompt needs auditing ("ready to ship?"), even after a hand edit. Not fixing a skill -> skill-author. Not fixing an agent -> agent-author. Not fixing a hook, instruction or prompt -> primitive-author. Bash Read
version category source_keys
1.1.1 factory
agentskills-home
agentskills-spec
agentskills-best-practices
agentskills-optimizing-descriptions
agentskills-using-scripts
context7-websites-code-claude
claude-code-plugins-docs
claude-code-subagents-docs
context7-github-en-copilot
github-custom-agents-configuration
apm-cli-installed-source
apm-docs-llms-full

Gotchas

  • Do not narrate PASS/FAIL per check while auditing. Gather findings internally and surface them only in the Step 4 report. Narrating each check as you go is the default failure mode here.
  • A file carrying disable-model-invocation: true is hand-invoked — its description is never routed against, so the trigger, capability and boundary rules do not apply. Audit it as one plain human-facing sentence instead.
  • Vale reporting 0 files scanned means NOT RUN, not clean. Fall back to full Step 3 judgment for every dimension it would have covered.

Step 0 — Dispatch

Resolve the flow from the target path before running anything. The flows run different validators over different dimension vocabularies, so dispatching after Step 1 means the wrong validator has already produced the wrong findings. The rows mirror the shapes scripts/validate.sh accepts; take the first that matches.

Target Flow Read
A directory containing SKILL.md skill references/skill-flow.md
A file named SKILL.md — audit its parent directory skill references/skill-flow.md
A file named *.agent.md agent references/agent-flow.md
A file named *.instructions.md instruction references/instruction-flow.md
A file named *.prompt.md prompt references/prompt-flow.md
A .md file whose immediate parent directory is agents/ (.apm/agents, .claude/agents, .github/agents, .copilot/agents) agent references/agent-flow.md
A .json file whose immediate parent directory is hooks/ (.apm/hooks, or a package-root hooks/; the hook flow FAILs any other hooks/) hook references/hook-flow.md
Anything else — a missing path, a directory without SKILL.md, any other file none —

Read only the file its row matched. Each carries Steps 1 to 3 — the deterministic checks, the read, and the qualitative audit — and is self-contained. Return here for Step 4.

On the last row, stop: run no validator and tell the user the shapes the other rows accept. Guessing a flow audits the path against the wrong spec.

The scripts re-detect the flow from the path. If validate.sh reports on a different artifact type than your row, discard what you have and restart here — the flow file, not the script, picked your rubrics, coverage line and remediation line.

Step 4 — Report

Open with the coverage line for the flow you took, naming every dimension checked.

Skill flow:

Checked: structure · description · body-discipline · patterns · file-structure · formatting · scripts · internal-consistency · provenance

Agent flow:

Checked: structure · provider-safety · description · body · delegation · comment-discipline · pair-consistency · provenance

On the agent flow at plugin/APM scope, drop pair-consistency — there is no pair to check.

Hook, instruction and prompt flows: the line their flow file ends with.

Then output only the dimensions that have findings, grouped under H3 headings, FAILs before SUGGESTIONs within each. Omit clean dimensions.

Each finding:

FAIL/SUGGESTION  <finding> — file:line
                 Why: <why this is a problem>
                 Fix: <exact change — quote before/after where applicable>

Close with a ## Result block holding one line: PASS, PASS (N suggestions), or FAIL (N fails · M suggestions), each optionally followed by · P info. INFO findings are observational and never change PASS/FAIL; omit · P info when there are none. Add a second line whenever there is at least one finding — Run skill-author to address findings. on the skill flow, Run agent-author to address findings. on the agent flow, Run primitive-author to address findings. on the other three. Do not apply fixes — report and propose only.