Files

Defame1297 874bf06b18 chore(apm): regenerate compiled manifests and content mirrors

Output of apm pack, sync-plugin-content.sh --all and
sync-marketplace-mirror.sh against this round's source changes. No file here
is hand-edited.

Carries the version bumps and marketplace owner.email into the compiled
manifests, the disallowedTools frontmatter and doc corrections into the flat
mirrors, and changes plugins/bin/.github/plugin/plugin.json's mcpServers from
the inlined server object to the ".mcp.json" pointer. That last file also
returns to 0644: the previous re-injection wrote it through mktemp and carried
0600 across, which no gate could see because the mode check did not cover
.github/plugin/ and git tracks only the exec bit.

.agents/plugins/marketplace.json is unchanged and that is correct -- apm's
codex profile carries neither version nor owner keys, so nothing in this round
reaches it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X7GvKuJfy2WrdBmUttV4DT

2026-08-14 11:05:20 +00:00

references

fix(kyberforge): bridge apm content to Claude Code's flat plugin discovery

2026-08-13 16:59:03 +00:00

scripts

fix(agentsmd-audit): scope secrets-scanner placeholder allowlist to matched token

2026-08-13 21:56:28 +00:00

README.md

chore(apm): regenerate compiled manifests and content mirrors

2026-08-14 11:05:20 +00:00

SKILL.md

fix(kyberforge): bridge apm content to Claude Code's flat plugin discovery

2026-08-13 16:59:03 +00:00

README.md

agentsmd-audit

Audit a target repo's AGENTS.md file(s) for embedded secrets, structural completeness, and drift.

What it does

Runs a single combined pass across every AGENTS.md file in a repo (root and any nested monorepo files): flags embedded secrets/credentials, checks structure against the agents.md common-sections checklist, and resolves referenced commands/paths against the actual repo to catch stale documentation. Outputs a compact findings report — findings only, grouped by dimension, each with Why and Fix. Never inspects provider-specific adapter files (CLAUDE.md, etc.) and never writes or fixes anything.

Usage

/agentsmd-audit

Provide the path to the repo root to audit when invoking.

Files

File	Purpose
`SKILL.md`	Skill instructions for agents
`scripts/validate-secrets.sh`	Scans AGENTS.md files for embedded secrets, API keys, tokens, connection strings
`scripts/validate-structure.sh`	Checks for empty/placeholder content, common-sections checklist, nested-vs-root duplication
`scripts/validate-drift.sh`	Resolves referenced npm/make commands and file paths against the repo
`references/sources.md`	Provenance record — sources that informed this skill and which files each contributed to
`scripts/README.md`	Directory documentation for `scripts/`
`tests/README.md`	(source-only) Bats test dependency and run instructions
`tests/validate-secrets.bats`	(source-only) Bats test suite for `scripts/validate-secrets.sh`
`tests/validate-structure.bats`	(source-only) Bats test suite for `scripts/validate-structure.sh`
`tests/validate-drift.bats`	(source-only) Bats test suite for `scripts/validate-drift.sh`

Rows marked (source-only) exist in the authoring source (.apm/skills/agentsmd-audit/) but are not present in an installed plugin: scripts/sync-plugin-content.sh strips <category>/<name>/tests when it generates the flat mirror, because these are dev-time fixtures no plugin host needs to discover (ADR-0017). Run them from a repo checkout, not from an install.