What problem does it solve? Managing agent skills across projects is error-prone: skills fetched from remote repos lose provenance, silently drift from upstream, and may contain unsafe shell patterns. This Skill provides full-lifecycle management with provenance tracking, security auditing, and drift detection. ## Core Features & Use Cases - Safety-gated installation: Installs skills via npx skills or a POSIX fallback, stamps a .source.yml provenance manifest, runs a security audit, and rolls back automatically on critical findings. - Security auditing: Scans skill directories for exfiltration, credential access, reverse shells, curl-pipe-shell, obfuscation, and prompt injection patterns. - Drift detection and updates: Compares SHA-256 integrity digests against recorded provenance to detect local modifications or upstream changes, and re-installs from recorded coordinates to update. - Use Case: You want to install a community code-review skill into your project. The Skill interviews you for scope and version, installs it, audits it for malicious patterns, stamps provenance, and later tells you when the upstream repo has changed. ## Quick Start Install the code-review skill from a GitHub repo into my project's .agents/skills directory and audit it for security issues.
