Files
holocron/plugins/kyberforge/skills/agent-audit/scripts
Defame1297 9fe734573d fix(gates): close the /name fail-open and stop the path guard inventing targets
Two defects in the routing-target resolver, both latent in the corpus but hot for
anything written next.

The free-standing `/name` sweep sat inside `if boundary:`, so route notation in a
sentence carrying no boundary marker was never extracted at all — not an ERROR, not
a SUGGESTION, not an INFO. That contradicted ADR-0020's amendment and gates.md,
which both promise `/name` blocks unconditionally. The sweep now runs over every
sentence. `-> name` and backticked forms stay gated deliberately: an arrow also
writes a process chain and a code span cites tools, files and skills alike, so
ungating either fires on ordinary prose.

The path guard used `\b`, which still holds after a hyphen, so the engine
backtracked to a shorter hyphen-terminated prefix whenever the lookahead rejected
the full segment. `/api-docs/v2.md` in a boundary clause raised blocking ERRORs for
'api' and 'api-docs' — names no author wrote, with no corroboration escape.
`(?![\w-])` forbids the shortened prefix outright; MARKED_TARGET, which had no
trailing guard at all, gained one.

Zero arguments now exits 2 rather than 0, so a mis-scoped `files:` pattern is no
longer indistinguishable from a clean corpus. Both hook manifests pass filenames
and pre-commit skips a filename-passing hook when nothing matches, so the hook
never sees an empty argv — that contract is now asserted by a test rather than
left in prose.

Deleting the sweep entirely used to leave every suite green. It now kills eight
assertions. The suite also gains its first slash-path and URL fixtures, in both
directions.

Refs: #107, #110, #124
ADR: 0020
2026-09-01 12:37:12 +00:00
..

scripts/

Executable code bundled with this skill. Agents run scripts in this directory to perform repeatable operations rather than reinventing the logic each run.

When to add a script

Add a script when agents independently reinvent the same logic across runs — building the same parser, chart, or validation routine from scratch each time. Bundle it here once, tested and reliable.

Script requirements (agentskills.io)

Scripts must be designed for non-interactive, agentic execution:

  • No interactive prompts — agents run in non-interactive shells. Accept all input via flags, env vars, or stdin. A script that blocks on TTY input hangs indefinitely.
  • Expose --help — this is how agents learn your script's interface. Keep the output concise; it enters the agent's context window.
  • Structured output — write data (JSON, CSV, TSV) to stdout. Write progress, warnings, and diagnostics to stderr.
  • Idempotent — prefer "create if not exists" over "create and fail on duplicate". Agents may retry on failure.
  • Meaningful exit codes — 0 for success, non-zero for failure. Use distinct codes for different failure types; document them in --help.
  • Dry-run support — add --dry-run for destructive operations.

Self-contained scripts

Bundle dependencies inline so the agent can run the script with a single command.

Python (PEP 723 + uv):

# /// script
# dependencies = ["requests>=2.31,<3"]
# requires-python = ">=3.11"
# ///
import requests
uv run scripts/my-script.py

If no scripts are needed

Delete this README and the scripts/ directory entirely.