Defame1297
38f1ba4e03
Claude Code's (and Copilot's) native plugin installer has zero awareness of .apm/ nesting -- it convention-scans only flat skills/, agents/, commands/, hooks.json at each plugin's root. Confirmed via strings on the installed claude binary and live installs of git@holocron/gitea@holocron/kyberforge@ holocron, all reporting Skills(0) Agents(0) Hooks(0) post ADR-0015's apm conversion. Root cause (apm_cli/core/plugin_manifest.py): apm's plugin.json compiler deliberately strips skills/agents/commands keys, assuming the host already auto-discovers those convention directories -- it has no model of .apm/ being host-visible at all. Separately, apm's own bundle exporter (apm_cli/bundle/plugin_exporter.py, behind `apm pack --format plugin`) implements the correct .apm/ -> flat mapping, but only ever targeted build/<name>-<version>/, a path nothing in marketplace.json's source: points at. scripts/sync-plugin-content.sh wraps that bundle exporter and copies its agents/, skills/, commands/, instructions/, extensions/, and merged hooks.json back into each plugin's own root as a second tracked compiled-output category -- same governance status as .claude-plugin/plugin.json: generated from .apm/, never hand-edited. tests/ subdirectories are excluded from the mirror (dev fixtures, not host-visible runtime content; several hardcode a relative repo-root walk-up sized for the .apm/-nested depth, which breaks when duplicated one level shallower). Applied for real across all 6 plugins and verified two ways: `claude plugin validate --strict` passes on every real plugin directory, and a live `claude --plugin-dir <path> -p "list skills/agents"` behavioral test confirms content is now actually discovered. Also, from the same issue #90 review round: - scripts/check-manifests.sh pointed at each plugin's root-level plugin.json (checking skills/hooks/mcpServers/agents pointer fields) -- that file was a stale near-duplicate of .claude-plugin/plugin.json nothing else read or wrote, now deleted across all 6 plugins. check-manifests.sh is rewritten to validate .claude-plugin/plugin.json instead, and drops the pointer-field checks entirely (nothing to check -- those fields are correctly absent by design). Content-presence drift is now check-plugin-content-sync's job, a new pre-push hook wired in .pre-commit-config.yaml. docs/adr/0017 records the root cause and decision in full, including two rejected alternatives (patching plugin.json's path fields directly -- apm's compiler strips them on every run; pointing marketplace.json at apm pack's build/ output -- a version-suffixed non-source directory nothing can install from without an extra build step). ADR-0015 and CONTEXT.md are updated to point at it. Refs: #90
3.5 KiB
3.5 KiB
name, description, allowed-tools, metadata
| name | description | allowed-tools | metadata | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| agentsmd-audit | Use when the user wants to review a repo's AGENTS.md file, says "audit this AGENTS.md", "check my AGENTS.md", "is this AGENTS.md any good", or wants to know if AGENTS.md is safe to commit — even if they don't use the word "audit". Also invoke proactively after agentsmd-author creates or updates AGENTS.md, or after a hand-edit made outside agentsmd-author. Audits a target repo's AGENTS.md file(s) — root and any nested monorepo files — for embedded secrets/credentials, structural completeness against the agents.md common-sections checklist, and drift (referenced commands or paths that no longer resolve against the repo). Produces a compact findings report (findings only, no PASS noise) with Why and Fix per finding. Do not use to audit CLAUDE.md, .cursor/rules, or other provider-specific adapter files — that's provider-adapter-author's self-contained concern. Do not use to fix or write AGENTS.md content — use agentsmd-author instead. | Bash Read |
|
Gotchas
- Always run all three checks — this skill does a single combined pass, not staged/gated passes. Don't skip structure or drift checks just because a secrets FAIL was found.
- Never inspect or mention provider-specific adapter files (
CLAUDE.md,.cursor/rules/*.mdc,copilot-instructions.md, etc.) — that's out of scope. If one exists and duplicates AGENTS.md content, that'sprovider-adapter-author's concern, not this skill's. - A missing common section (e.g. no "Security" heading) is informational, not a failure — not every repo needs every section from the checklist. Only flag a FAIL when the file is empty, entirely unfilled placeholder text, or contains a real embedded secret/stale reference.
- Gather findings internally; don't narrate PASS/FAIL per check as you go — surface them only in the final report.
Step 1 — Run the validators
bash scripts/validate-secrets.sh <repo-root>
bash scripts/validate-structure.sh <repo-root>
bash scripts/validate-drift.sh <repo-root>
Each script walks the repo for every AGENTS.md file (root and nested, excluding .git, node_modules, vendor, and similar) and prints FAIL/INFO/SUGGESTION lines with Why/Fix (or Note) per finding. A nonzero exit means at least one FAIL was found in that dimension. If a script cannot execute (python3 unavailable, Bash denied), fall back to manual review: scan for real-looking credentials, check common sections are present, and spot-check a few referenced commands/paths by hand.
Step 2 — Report
Open with a coverage line:
Checked: secrets · structure · drift
Then output only findings that were found, in this order within a repo: ### Secrets, ### Structure, ### Drift. Omit a dimension heading entirely if it produced nothing — its absence confirms it passed. Report each finding verbatim as emitted by the scripts (they already carry file:line, Why/Fix or Note).
Close with a result block:
## Result
PASS
PASS · P info
PASS (N suggestions) · P info
FAIL (N fails)
FAIL (N fails) · P info
INFO and SUGGESTION findings are observational — they never flip PASS to FAIL. Do not fix anything — this skill reports and proposes only. Point the user to agentsmd-author to apply fixes.