Defame1297
874bf06b18
Output of apm pack, sync-plugin-content.sh --all and sync-marketplace-mirror.sh against this round's source changes. No file here is hand-edited. Carries the version bumps and marketplace owner.email into the compiled manifests, the disallowedTools frontmatter and doc corrections into the flat mirrors, and changes plugins/bin/.github/plugin/plugin.json's mcpServers from the inlined server object to the ".mcp.json" pointer. That last file also returns to 0644: the previous re-injection wrote it through mktemp and carried 0600 across, which no gate could see because the mode check did not cover .github/plugin/ and git tracks only the exec bit. .agents/plugins/marketplace.json is unchanged and that is correct -- apm's codex profile carries neither version nor owner keys, so nothing in this round reaches it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X7GvKuJfy2WrdBmUttV4DT
2.1 KiB
agentsmd-audit
Audit a target repo's AGENTS.md file(s) for embedded secrets, structural completeness, and drift.
What it does
Runs a single combined pass across every AGENTS.md file in a repo (root and any nested monorepo files): flags embedded secrets/credentials, checks structure against the agents.md common-sections checklist, and resolves referenced commands/paths against the actual repo to catch stale documentation. Outputs a compact findings report — findings only, grouped by dimension, each with Why and Fix. Never inspects provider-specific adapter files (CLAUDE.md, etc.) and never writes or fixes anything.
Usage
/agentsmd-audit
Provide the path to the repo root to audit when invoking.
Files
| File | Purpose |
|---|---|
SKILL.md |
Skill instructions for agents |
scripts/validate-secrets.sh |
Scans AGENTS.md files for embedded secrets, API keys, tokens, connection strings |
scripts/validate-structure.sh |
Checks for empty/placeholder content, common-sections checklist, nested-vs-root duplication |
scripts/validate-drift.sh |
Resolves referenced npm/make commands and file paths against the repo |
references/sources.md |
Provenance record — sources that informed this skill and which files each contributed to |
scripts/README.md |
Directory documentation for scripts/ |
tests/README.md |
(source-only) Bats test dependency and run instructions |
tests/validate-secrets.bats |
(source-only) Bats test suite for scripts/validate-secrets.sh |
tests/validate-structure.bats |
(source-only) Bats test suite for scripts/validate-structure.sh |
tests/validate-drift.bats |
(source-only) Bats test suite for scripts/validate-drift.sh |
Rows marked (source-only) exist in the authoring source (.apm/skills/agentsmd-audit/) but are
not present in an installed plugin: scripts/sync-plugin-content.sh strips <category>/<name>/tests
when it generates the flat mirror, because these are dev-time fixtures no plugin host needs to
discover (ADR-0017). Run them from a repo checkout, not from an install.