holocron/plugins/kyberforge/skills/agent-audit/references/field-inventory.md at f037d49b5ce37f1824b90b607104b05405bf8a8a

Files

Defame1297 f037d49b5c fix(kyberforge): fix apm-scope validation gaps in agent/skill authoring scripts

Post-implementation review of PR #93 (issue #89's apm.yml-native retargeting
of skill-author/skill-audit/agent-author/agent-audit) found four confirmed
defects across the four scripts' apm.yml `type:` walk-up logic:

- field-inventory.md's apm-agent-allowlist was missing `source_keys`,
  contradicting agent-author/SKILL.md's own instruction (Step 5 checklist)
  to allow it at plugin/APM scope — a correctly-authored file with
  source_keys failed validate.sh.
- validate.sh's APM_TYPE_RE and validate-provenance.sh's TYPE_RE disagreed:
  the former tolerated a quoted `type: "skill"` value, the latter didn't,
  despite agent-audit/SKILL.md explicitly documenting that
  validate-provenance.sh walks up "the same way validate.sh does". Both
  also used `\b` word-boundary matching, which false-matches a malformed
  value like `type: prompts-only` on the `prompts` prefix. Unified both
  regexes to be quote-tolerant and require an exact value.
- All four scripts' `.git` project-boundary check used isdir()/[[ -d ]],
  which misses git worktrees where `.git` is a regular file (`gitdir: ...`)
  rather than a directory. Switched to exists()/[[ -e ]].
- new-agent.sh and new-skill.sh had the same quote-intolerance as above via
  inline `grep -qE` calls (new-skill.sh's also had the `\b` false-match
  bug); replaced both with a shared-shape `is_apm_package_manifest` bash
  helper matching the Python regex's semantics.

Four other findings from the same review turned out not to be bugs: a
bare `plugin.json` no longer signaling plugin scope is documented,
intentional behavior (agent-audit/SKILL.md:30, agent-author/SKILL.md:87),
deferred to issue #90's real plugin.json-to-apm.yml conversion — not
something this fix should reverse.

Verified via direct reproduction of each defect plus the full test suite:
147/147 bats tests, 39/39 shell-script tests, 12/12 summary categories.

Refs: #89

2026-08-11 19:13:26 +00:00

775 B

Raw Blame History

source_keys

context7-websites-code-claude

claude-code-plugins-docs

claude-code-subagents-docs

context7-github-en-copilot

github-custom-agents-configuration

claude-code-fields

name description tools disallowedTools model effort maxTurns permissionMode skills mcpServers hooks memory background isolation color initialPrompt

claude-code-only-fields

maxTurns isolation memory permissionMode effort hooks mcpServers disallowedTools skills initialPrompt color background

copilot-fields

name description tools target model disable-model-invocation user-invocable mcp-servers metadata

copilot-only-fields

target disable-model-invocation user-invocable mcp-servers metadata

apm-agent-allowlist

name description model source_keys

775 B Raw Blame History