agent-skills-standard 2.6.0 → 2.6.3

package/dist/index.js

@@ -16,7 +16,7 @@ var __copyProps = (to, from, except, desc) => {
 	}
 	return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
 	value: mod,
 	enumerable: true
 }) : target, mod));
@@ -26,6 +26,7 @@ let dotenv = require("dotenv");
 dotenv = __toESM(dotenv);
 let picocolors = require("picocolors");
 picocolors = __toESM(picocolors);
+let node_crypto = require("node:crypto");
 let fs_extra = require("fs-extra");
 fs_extra = __toESM(fs_extra);
 let path = require("path");
@@ -43,7 +44,7 @@ let child_process = require("child_process");
 let fs = require("fs");
 var package_default = {
 	name: "agent-skills-standard",
-	version: "2.6.0",
+	version: "2.6.3",
 	description: "A CLI to manage and sync AI agent skills standard for Cursor, Claude, Copilot, Windsurf, and more.",
 	main: "dist/index.js",
 	bin: {
@@ -77,39 +78,121 @@ var package_default = {
 	],
 	author: "Hoang Nguyen",
 	license: "MIT",
+	repository: {
+		"type": "git",
+		"url": "https://github.com/HoangNguyen0403/agent-skills-standard",
+		"directory": "cli"
+	},
+	bugs: { "url": "https://github.com/HoangNguyen0403/agent-skills-standard/issues" },
+	homepage: "https://github.com/HoangNguyen0403/agent-skills-standard#readme",
 	dependencies: {
-		"commander": "^11.1.0",
+		"commander": "^15.0.0",
 		"cross-fetch": "^4.1.0",
-		"dotenv": "^17.2.3",
-		"fs-extra": "^11.2.0",
-		"inquirer": "^8.2.5",
-		"js-yaml": "^4.2.0",
+		"dotenv": "^17.4.2",
+		"fs-extra": "^11.4.0",
+		"inquirer": "^14.2.2",
+		"js-yaml": "^5.4.2",
 		"picocolors": "^1.0.0",
-		"zod": "^3.22.4"
+		"zod": "^4.6.5"
 	},
 	devDependencies: {
-		"@vitest/coverage-v8": "^4.0.17",
-		"vite": "^7.0.0",
-		"vitest": "^4.0.17"
+		"@vitest/coverage-v8": "^5.0.1",
+		"vite": "^8.3.0",
+		"vitest": "^5.0.1"
 	}
 };
 //#endregion
-//#region src/services/EvalsVerifier.ts
-function checkAssertion(assertion, transcript) {
+//#region src/services/assertion-semantics.ts
+var SEMANTIC_STOP_WORDS = /* @__PURE__ */ new Set([
+	"a",
+	"an",
+	"and",
+	"as",
+	"at",
+	"by",
+	"for",
+	"from",
+	"in",
+	"into",
+	"is",
+	"it",
+	"of",
+	"on",
+	"or",
+	"the",
+	"to",
+	"use",
+	"via",
+	"with"
+]);
+function normalizedText(value) {
+	return value.toLowerCase().replace(/[`*_~]/g, "").replace(/[’]/g, "'").replace(/\s+/g, " ").trim();
+}
+function compactText(value) {
+	return normalizedText(value).replace(/\s+/g, "");
+}
+function semanticTokens(value) {
+	return (normalizedText(value).replace(/[-_/]/g, " ").match(/@[a-z][a-z0-9]*|[a-z][a-z0-9]*|\d+/g) ?? []).filter((token) => !SEMANTIC_STOP_WORDS.has(token) && token.length > 2);
+}
+function tokenVariants(value) {
+	const variants = /* @__PURE__ */ new Set([value]);
+	const stemmed = value.replace(/(ing|ed|es|s)$/, "");
+	variants.add(stemmed);
+	if (value.endsWith("ing")) variants.add(`${stemmed}e`);
+	if (stemmed.endsWith("e")) variants.add(stemmed.slice(0, -1));
+	return variants;
+}
+function containsV2(value, transcript) {
+	const needle = normalizedText(value);
+	if (normalizedText(transcript).includes(needle)) return true;
+	if (/[{}[\]@/:?<>$%()]/.test(value)) {
+		if (compactText(transcript).includes(compactText(value))) return true;
+	}
+	if (/\d/.test(value)) return false;
+	if (/[{}[\]@/:?<>$%()]/.test(value)) {
+		const genericFunction = value.match(/^([a-z_$][a-z0-9_$]*)\s*<[^>]+>\s*\(\s*\)$/i);
+		if (genericFunction) return new RegExp(`${genericFunction[1]}\\s*(?:<[^>]+>)?\\s*\\(`, "i").test(transcript);
+		const constructorShape = value.match(/\b([A-Z][A-Za-z0-9_]*)\s*\(\s*val\s+([A-Za-z_][A-Za-z0-9_]*)/);
+		if (constructorShape) return new RegExp(`${constructorShape[1]}\\s*\\([\\s\\S]*?${constructorShape[2]}`, "i").test(transcript);
+		if (/^@for\s*\(/i.test(value)) return /@for\s*\(/i.test(transcript) && /\btrack\b/i.test(transcript) && /(?:\.\s*id|\bid\b)/i.test(transcript);
+		if (/^@if\s*\(/i.test(value)) return /@if\s*\(/i.test(transcript);
+		if (/^@empty\b/i.test(value)) return /@empty\b/i.test(transcript);
+		const functionName = value.match(/^([a-z_$][a-z0-9_$]*)\(\s*\)$/i)?.[1];
+		if (functionName) return new RegExp(`${functionName}\\s*\\(`, "i").test(transcript);
+	}
+	const required = semanticTokens(value);
+	const available = new Set(semanticTokens(transcript).flatMap((token) => [...tokenVariants(token)]));
+	if (required.length === 1) return [...tokenVariants(required[0])].some((variant) => available.has(variant));
+	if (required.length === 0) return false;
+	return required.every((token) => {
+		return [...tokenVariants(token)].some((variant) => available.has(variant) || [...available].some((candidate) => candidate.startsWith(variant) || variant.startsWith(candidate)));
+	});
+}
+/** Basename without importing `path`, so the module stays runtime-agnostic. */
+function basename(value) {
+	const parts = value.split(/[\\/]/);
+	return parts[parts.length - 1] ?? value;
+}
+function checkAssertion(assertion, transcript, semanticsVersion = 1) {
 	const haystack = transcript.toLowerCase();
-	if (assertion.type === "contains_any") return (Array.isArray(assertion.value) ? assertion.value : [assertion.value]).some((value) => haystack.includes(value.toLowerCase()));
-	if (assertion.type === "not_contains") return !haystack.includes(String(assertion.value).toLowerCase());
-	if (assertion.type === "regex") try {
-		return new RegExp(String(assertion.value), "i").test(transcript);
-	} catch {
-		return false;
-	}
-	if (assertion.type === "file_reference") {
-		const value = String(assertion.value).toLowerCase();
-		return haystack.includes(value) || haystack.includes(path.basename(value));
+	switch (assertion.type) {
+		case "contains": return semanticsVersion === 2 ? containsV2(String(assertion.value), transcript) : haystack.includes(String(assertion.value).toLowerCase());
+		case "contains_any": return (Array.isArray(assertion.value) ? assertion.value : [assertion.value]).some((value) => semanticsVersion === 2 ? containsV2(String(value), transcript) : haystack.includes(String(value).toLowerCase()));
+		case "not_contains": return !haystack.includes(String(assertion.value).toLowerCase());
+		case "regex": try {
+			return new RegExp(String(assertion.value), "i").test(transcript);
+		} catch {
+			return false;
+		}
+		case "file_reference": {
+			const value = String(assertion.value).toLowerCase();
+			return haystack.includes(value) || haystack.includes(basename(value));
+		}
+		default: return false;
 	}
-	return haystack.includes(String(assertion.value).toLowerCase());
 }
+//#endregion
+//#region src/services/EvalsVerifier.ts
 function answerPath(runDir, manifest, skill, caseId, arm) {
 	const categoryParts = manifest.category === "all" ? [skill.category] : [];
 	const filename = arm ? `${caseId}.${arm}.md` : `${caseId}.md`;
@@ -123,6 +206,75 @@ function readInputs(runDir) {
 	const inputsPath = path.join(runDir, "inputs.json");
 	return fs_extra.default.existsSync(inputsPath) ? fs_extra.default.readJSONSync(inputsPath) : null;
 }
+function isStringRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) && Object.values(value).every((entry) => typeof entry === "string");
+}
+function isBase64(value) {
+	return /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value);
+}
+function resourceFingerprintDiffs(manifest, inputs) {
+	if (manifest.schemaVersion !== 2 || manifest.resourceFingerprints === void 0) return [];
+	if (typeof manifest.resourceFingerprints !== "object" || manifest.resourceFingerprints === null || Array.isArray(manifest.resourceFingerprints)) return ["Invalid immutable resource fingerprint manifest"];
+	const diffs = [];
+	for (const key of manifest.skills.map((skill) => `${skill.category}/${skill.skillName}`).sort()) if (!Object.hasOwn(manifest.resourceFingerprints, key)) diffs.push(`Missing immutable resource provenance for ${key}`);
+	for (const key of Object.keys(manifest.resourceFingerprints).sort()) {
+		const fingerprint = manifest.resourceFingerprints[key];
+		if (!fingerprint || fingerprint.version !== 1 || !isStringRecord(fingerprint.resources)) {
+			diffs.push(`Invalid immutable resource fingerprint for ${key}`);
+			continue;
+		}
+		const resources = inputs?.sources[key]?.resources;
+		if (!isStringRecord(resources)) {
+			diffs.push(`Missing immutable resource provenance for ${key}`);
+			continue;
+		}
+		const expectedPaths = Object.keys(fingerprint.resources).sort();
+		const actualPaths = Object.keys(resources).sort();
+		for (const resourcePath of expectedPaths) {
+			const content = resources[resourcePath];
+			if (content === void 0) {
+				diffs.push(`Missing immutable resource provenance for ${key}/${resourcePath}`);
+				continue;
+			}
+			if (!isBase64(content) || (0, node_crypto.createHash)("sha256").update(Buffer.from(content, "base64")).digest("hex") !== fingerprint.resources[resourcePath]) diffs.push(`Immutable resource mismatch for ${key}/${resourcePath}`);
+		}
+		for (const resourcePath of actualPaths) if (!(resourcePath in fingerprint.resources)) diffs.push(`Immutable resource mismatch for ${key}/${resourcePath}`);
+	}
+	return diffs;
+}
+function rawSourceDiffs(manifest, inputs) {
+	if (manifest.schemaVersion !== 2 || manifest.inputProvenanceVersion !== 1) return [];
+	const diffs = [];
+	for (const skill of manifest.skills) {
+		const key = `${skill.category}/${skill.skillName}`;
+		const expected = manifest.sourceHashes?.[key];
+		const source = inputs?.sources[key];
+		if (!expected || !source) {
+			diffs.push(`Missing immutable raw source provenance for ${key}`);
+			continue;
+		}
+		const skillBase64 = source.skillMarkdownBase64;
+		if (skillBase64 === void 0 || !isBase64(skillBase64)) diffs.push(`Missing immutable raw skill provenance for ${key}`);
+		else {
+			const skillBytes = Buffer.from(skillBase64, "base64");
+			if ((0, node_crypto.createHash)("sha256").update(skillBytes).digest("hex") !== expected.skill) diffs.push(`Raw skill snapshot hash mismatch for ${key}`);
+			if (source.skillMarkdown !== skillBytes.toString("utf8")) diffs.push(`Raw skill snapshot mismatch for ${key}`);
+		}
+		const evalsBase64 = source.evalsBase64;
+		if (evalsBase64 === void 0 || !isBase64(evalsBase64)) {
+			diffs.push(`Missing immutable raw eval provenance for ${key}`);
+			continue;
+		}
+		const evalsBytes = Buffer.from(evalsBase64, "base64");
+		if ((0, node_crypto.createHash)("sha256").update(evalsBytes).digest("hex") !== expected.evals) diffs.push(`Raw eval snapshot hash mismatch for ${key}`);
+		try {
+			if (JSON.stringify(JSON.parse(evalsBytes.toString("utf8"))) !== JSON.stringify(source.evals)) diffs.push(`Raw eval snapshot mismatch for ${key}`);
+		} catch {
+			diffs.push(`Invalid immutable raw eval JSON for ${key}`);
+		}
+	}
+	return diffs;
+}
 function evalDataFor(projectRoot, runDir, skill) {
 	const inputs = readInputs(runDir);
 	if (inputs) {
@@ -147,6 +299,7 @@ function summarizeSkill(projectRoot, runDir, manifest, skill) {
 	const evalsData = evalDataFor(projectRoot, runDir, skill);
 	const evalById = new Map((evalsData.evals ?? []).map((evaluation) => [String(evaluation.id), evaluation]));
 	const pressureByIndex = evalsData.pressure_scenarios ?? [];
+	const semanticsVersion = manifest.schemaVersion === 2 ? manifest.provenance?.[`${skill.category}/${skill.skillName}`]?.assertionSemanticsVersion ?? manifest.assertionSemanticsVersion ?? 1 : 1;
 	const baseline = [];
 	const withSkill = [];
 	const baselineAssertions = [];
@@ -170,7 +323,7 @@ function summarizeSkill(projectRoot, runDir, manifest, skill) {
 			if (!(arm in currentCase.arms)) continue;
 			const transcript = readAnswer(runDir, manifest, skill, currentCase, arm);
 			if (transcript === null) throw new Error(`missing answer: ${skill.skillName}/${currentCase.id}.${arm}`);
-			const checks = assertions.map((assertion) => checkAssertion(assertion, transcript));
+			const checks = assertions.map((assertion) => checkAssertion(assertion, transcript, semanticsVersion));
 			const passed = checks.every(Boolean);
 			(arm === "baseline" ? baseline : withSkill).push(passed);
 			(arm === "baseline" ? baselineAssertions : withSkillAssertions).push({
@@ -220,11 +373,19 @@ function verifyEvalRun(projectRoot, runId) {
 		reason: "run is missing manifest.json or results.json"
 	};
 	const manifest = fs_extra.default.readJSONSync(manifestPath);
-	if (manifest.schemaVersion === 2 && readInputs(runDir) === null) return {
+	const inputs = readInputs(runDir);
+	if (manifest.schemaVersion === 2 && inputs === null) return {
 		runId,
 		ok: false,
 		reason: "v2 run is missing immutable inputs.json"
 	};
+	const provenanceDiffs = [...resourceFingerprintDiffs(manifest, inputs), ...rawSourceDiffs(manifest, inputs)];
+	if (provenanceDiffs.length > 0) return {
+		runId,
+		ok: false,
+		reason: "immutable source provenance differs from manifest",
+		diffs: provenanceDiffs
+	};
 	const committed = fs_extra.default.readJSONSync(resultsPath);
 	const diffs = [];
 	for (const skill of manifest.skills) {
@@ -450,7 +611,7 @@ var FeedbackCommand = class {
 					when: !loadedSkills
 				},
 				{
-					type: "list",
+					type: "rawlist",
 					name: "rootCause",
 					message: "Root cause of the violation (optional)",
 					when: !rootCause,
@@ -934,8 +1095,7 @@ var COMMON_SKILL_EXCLUDES = {
 	mobile: [
 		"common-accessibility",
 		"common-api-design",
-		"common-observability",
-		"common-system-design"
+		"common-observability"
 	]
 };
 /**
@@ -954,6 +1114,8 @@ var DEFAULT_WORKFLOWS = [
 	"brainstorm-feature",
 	"code-review",
 	"codebase-review",
+	"system-design-session",
+	"review-system-design",
 	"design-solution",
 	"deploy-release",
 	"plan-feature",
@@ -969,9 +1131,11 @@ var DEFAULT_WORKFLOWS = [
 	"implement-feature",
 	"verify-work",
 	"verify-bug",
+	"test-loop",
 	"security-test",
 	"uat-signoff",
-	"incident-hotfix"
+	"incident-hotfix",
+	"monitor-respond"
 ];
 /**
 * Workflows that must never be synced to a consumer project, regardless of
@@ -1288,7 +1452,8 @@ var SkillConfigSchema = zod.z.object({
 	})),
 	custom_overrides: zod.z.array(zod.z.string()).optional(),
 	workflows: zod.z.union([zod.z.boolean(), zod.z.array(zod.z.string())]).optional(),
-	mcp: McpConfigSchema.optional()
+	mcp: McpConfigSchema.optional(),
+	telemetry: zod.z.boolean().optional()
 });
 var DEFAULT_SDLC_SUPPORT_CATEGORIES = ["quality-engineering"];
 var PRIMARY_CONFIG_FILE = ".skillsrc";
@@ -1312,7 +1477,7 @@ var ConfigService = class {
 		return null;
 	}
 	dumpConfig(config) {
-		return js_yaml.default.dump(config, {
+		return js_yaml.dump(config, {
 			noRefs: true,
 			lineWidth: -1
 		});
@@ -1357,7 +1522,7 @@ var ConfigService = class {
 			agents.push(match[1].trim());
 		}
 		config.agents = agents;
-		const sectionNames = new Set([
+		const sectionNames = /* @__PURE__ */ new Set([
 			"custom_overrides",
 			"workflows",
 			"mcp"
@@ -1487,7 +1652,7 @@ var ConfigService = class {
 			let rawConfig;
 			let migratedFromText = false;
 			try {
-				rawConfig = js_yaml.default.load(content);
+				rawConfig = js_yaml.load(content);
 			} catch (parseError) {
 				rawConfig = this.migrateLegacyTextConfig(content);
 				migratedFromText = rawConfig !== null;
@@ -1500,7 +1665,7 @@ var ConfigService = class {
 			if (shouldRenameLegacyYamlFile) await fs_extra.default.remove(configPath);
 			return parsed.data;
 		} catch (error) {
-			throw new Error(`Failed to load config: ${error}`);
+			throw new Error(`Failed to load config: ${error}`, { cause: error });
 		}
 	}
 	/**
@@ -1647,16 +1812,35 @@ var ConfigService = class {
 //#endregion
 //#region src/services/HookService.ts
 /**
+* Version marker embedded as the hook script's first line after the shebang.
+* On install, an existing script carrying an *older* marker is understood to
+* be our own previous auto-generated version (not a user customization) and
+* is refreshed; a script with no marker at all predates this feature and is
+* left untouched, matching this hook's original "create once, preserve if
+* customized" contract. A script that keeps the marker line but edits the
+* body around it will still be treated as ours and overwritten on the next
+* version bump — that residual case can't be told apart from a stale file
+* without a full diff/backup mechanism, which is out of scope here.
+*/
+var HOOK_SCRIPT_VERSION = package_default.version;
+var HOOK_VERSION_MARKER_RE = /^\/\/ ags-hook-version: (\S+)$/m;
+/**
 * Universal PreToolUse hook script (Node.js / JavaScript).
 * Reminds AI agents to call load_skills_for_files() before any code edit.
 * Guaranteed to execute on any machine running agent-skills-standard.
 * Always exits 0 to never block work.
 */
 var UNIVERSAL_SKILL_LOADER_JS = `#!/usr/bin/env node
+// ags-hook-version: ${HOOK_SCRIPT_VERSION}
 /**
  * PreToolUse hook: remind AI agent to call load_skills_for_files() before any code edit.
  * Installed by agent-skills-standard (ags sync). Remove via: ags hooks uninstall
- * Guaranteed to execute on any system with Node.js. Always exits 0 to never block work.
+ * Guaranteed to execute on any system with Node.js. Always exits 0 to never block work,
+ * UNLESS AGS_HOOK_ENFORCE=1 is set in the environment (opt-in via
+ * \`ags hooks install --enforce\`) AND the target file matches the small,
+ * fixed, skill-agnostic deny-list below — see installStandardHookConfig's
+ * doc comment in HookService.ts for why this can't be a per-skill
+ * permissions.filesystem.deny check.
  */
 const fs = require('fs');
 const path = require('path');
@@ -1693,6 +1877,19 @@ function shouldSkip(filePath) {
   }
 }
 
+const ENFORCE = process.env.AGS_HOOK_ENFORCE === '1';
+const DENY_BASENAMES = new Set(['SOUL.md', 'MEMORY.md']);
+const DENY_PATTERNS = [
+  /(^|[\\\\/])\\.env(\\.[^\\\\/]*)?$/i,
+  /(^|[\\\\/])\\.ssh([\\\\/]|$)/i,
+  /credentials[^\\\\/]*\\.(json|ya?ml)$/i,
+];
+
+function isDenied(filePath) {
+  if (DENY_BASENAMES.has(path.basename(filePath))) return true;
+  return DENY_PATTERNS.some(re => re.test(filePath));
+}
+
 let input = '';
 process.stdin.setEncoding('utf8');
 process.stdin.on('data', chunk => { input += chunk; });
@@ -1704,6 +1901,15 @@ process.stdin.on('end', () => {
     const filePath = data.tool_input?.file_path || '';
     if (!filePath || shouldSkip(filePath)) process.exit(0);
 
+    if (ENFORCE && isDenied(filePath)) {
+      console.error(
+        '[AGS BLOCKED] Refusing to edit ' + path.basename(filePath) + ': ' +
+        'matches the default identity/secret deny-list (SOUL.md, MEMORY.md, .env*, .ssh/, credentials*.json|yaml).\\n' +
+        'If this edit is intentional, re-run \`ags hooks install\` (without --enforce) to return to advisory-only mode.'
+      );
+      process.exit(2);
+    }
+
     const fileName = path.basename(filePath);
     console.log(
       '[SKILL TRIGGER] Editing: ' + fileName + '\\n' +
@@ -1771,15 +1977,18 @@ var HookService = class {
 				continue;
 			}
 			const def = getAgentDefinition(agent);
-			if (def.hookScriptPath && def.hookConfigPath) await this.installStandardHookConfig({
-				rootDir: opts.rootDir,
-				agent,
-				scriptRelPath: def.hookScriptPath,
-				configRelPath: def.hookConfigPath,
-				hookCmd: agent === Agent.Claude ? "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/preedit-skill-loader.js\"" : `node "${def.hookScriptPath}"`,
-				report
-			});
-			else report.unsupported.push(agent);
+			if (def.hookScriptPath && def.hookConfigPath) {
+				const enforcePrefix = opts.enforce && agent === Agent.Claude ? "AGS_HOOK_ENFORCE=1 " : "";
+				await this.installStandardHookConfig({
+					rootDir: opts.rootDir,
+					agent,
+					scriptRelPath: def.hookScriptPath,
+					configRelPath: def.hookConfigPath,
+					hookCmd: agent === Agent.Claude ? `${enforcePrefix}node "$CLAUDE_PROJECT_DIR/.claude/hooks/preedit-skill-loader.js"` : `node "${def.hookScriptPath}"`,
+					report,
+					promptPermission: opts.promptPermission
+				});
+			} else report.unsupported.push(agent);
 		}
 		return report;
 	}
@@ -1838,24 +2047,37 @@ var HookService = class {
 				file: opts.scriptRelPath,
 				action: "added"
 			});
-		} else opts.report.writes.push({
-			agent: opts.agent,
-			file: opts.scriptRelPath,
-			action: "skipped-existing"
-		});
+		} else {
+			const installedVersion = (await fs_extra.default.readFile(scriptAbs, "utf8")).match(HOOK_VERSION_MARKER_RE)?.[1];
+			if (installedVersion && installedVersion !== HOOK_SCRIPT_VERSION) {
+				await fs_extra.default.writeFile(scriptAbs, UNIVERSAL_SKILL_LOADER_JS);
+				opts.report.writes.push({
+					agent: opts.agent,
+					file: opts.scriptRelPath,
+					action: "updated"
+				});
+			} else opts.report.writes.push({
+				agent: opts.agent,
+				file: opts.scriptRelPath,
+				action: "skipped-existing"
+			});
+		}
 		const configAbs = path.default.join(opts.rootDir, opts.configRelPath);
 		const configExists = await fs_extra.default.pathExists(configAbs);
 		const existing = await this.readJson(configAbs);
 		let changed = false;
 		const permissions = this.ensureObject(existing, "permissions");
 		const allow = this.ensureArray(permissions, "allow");
-		if (!allow.includes(CLAUDE_MCP_PERMISSION)) {
-			permissions["allow"] = [CLAUDE_MCP_PERMISSION, ...allow];
-			changed = true;
+		if (!allow.includes("mcp__agent-skills-standard__*")) {
+			if (opts.promptPermission ? await opts.promptPermission(opts.agent) : true) {
+				permissions["allow"] = [CLAUDE_MCP_PERMISSION, ...allow];
+				changed = true;
+			}
 		}
 		const hooks = this.ensureObject(existing, "hooks");
 		const preToolUse = this.ensureArray(hooks, "PreToolUse");
-		if (!this.claudeHookEntryExists(preToolUse)) {
+		const existingEntry = preToolUse.find((entry) => this.claudeHookEntryMatches(entry));
+		if (!existingEntry) {
 			preToolUse.unshift({
 				matcher: "Edit|Write|MultiEdit|NotebookEdit",
 				hooks: [{
@@ -1865,6 +2087,12 @@ var HookService = class {
 				}]
 			});
 			changed = true;
+		} else {
+			const matchingHook = (existingEntry["hooks"] ?? []).find((h) => h["command"]?.includes("preedit-skill-loader"));
+			if (matchingHook && matchingHook["command"] !== opts.hookCmd) {
+				matchingHook["command"] = opts.hookCmd;
+				changed = true;
+			}
 		}
 		if (changed) {
 			await this.writeAtomic(configAbs, existing);
@@ -1887,7 +2115,7 @@ var HookService = class {
 		let changed = false;
 		const permissions = this.ensureObject(data, "permissions");
 		const allow = this.ensureArray(permissions, "allow");
-		if (allow.includes(CLAUDE_MCP_PERMISSION)) {
+		if (allow.includes("mcp__agent-skills-standard__*")) {
 			permissions["allow"] = allow.filter((p) => p !== CLAUDE_MCP_PERMISSION);
 			changed = true;
 		}
@@ -1992,7 +2220,7 @@ var HooksCommand = class {
 		this.configService = configService ?? new ConfigService();
 		this.hookService = hookService ?? new HookService();
 	}
-	async run(action) {
+	async run(action, options = {}) {
 		const config = await this.configService.loadConfig();
 		if (!config) {
 			console.log(picocolors.default.red("❌ .skillsrc not found. Run `agent-skills-standard init` first."));
@@ -2002,7 +2230,7 @@ var HooksCommand = class {
 		const agents = config.agents ?? [];
 		switch (action) {
 			case "status": return this.actionStatus(cwd, agents);
-			case "install": return this.actionInstall(cwd, agents);
+			case "install": return this.actionInstall(cwd, agents, options.enforce ?? false);
 			case "uninstall": return this.actionUninstall(cwd, agents);
 			default: console.log(picocolors.default.red(`Unknown action: ${action}`), "\nValid actions: status, install, uninstall");
 		}
@@ -2023,11 +2251,13 @@ var HooksCommand = class {
 			for (const f of row.files) console.log(`               ${picocolors.default.gray(f)}`);
 		}
 	}
-	async actionInstall(cwd, agents) {
+	async actionInstall(cwd, agents, enforce) {
 		console.log(picocolors.default.cyan("\n🪝 Installing skill-loader hooks..."));
+		if (enforce) console.log(picocolors.default.yellow("   --enforce: Claude will BLOCK edits to SOUL.md, MEMORY.md, .env*, .ssh/, and credentials*.json|yaml."));
 		const report = await this.hookService.install({
 			rootDir: cwd,
-			agents
+			agents,
+			enforce
 		});
 		this.printReport(report);
 	}
@@ -2325,16 +2555,29 @@ var InitService = class {
 #
 `;
 		const configPath = path.default.join(cwd, ".skillsrc");
-		await fs_extra.default.outputFile(configPath, commentHeader + js_yaml.default.dump(config));
+		await fs_extra.default.outputFile(configPath, commentHeader + js_yaml.dump(config));
 	}
 };
 //#endregion
 //#region src/services/GithubService.ts
+/** A downloaded file failed its integrity or size check. */
+var IntegrityError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "IntegrityError";
+	}
+};
+/** Computes the same blob SHA-1 git itself would (`git hash-object`), for comparison against a tree API `sha`. */
+function gitBlobSha1(content) {
+	const header = Buffer.from(`blob ${content.byteLength}\0`, "utf8");
+	return (0, node_crypto.createHash)("sha1").update(Buffer.concat([header, content])).digest("hex");
+}
 /**
 * Service for interacting with the GitHub API and fetching raw file content.
 * Handles repository tree discovery, file downloads, and URL parsing.
 */
 var GithubService = class {
+	token;
 	baseUrl = "https://api.github.com";
 	rawBaseUrl = "https://raw.githubusercontent.com";
 	constructor(token) {
@@ -2367,25 +2610,35 @@ var GithubService = class {
 		}
 	}
 	/**
-	* Fetches the raw content of a file from GitHub using raw.githubusercontent.com.
-	* @param owner Repository owner
-	* @param repo Repository name
-	* @param ref Git reference
-	* @param path Path to the file
-	* @returns File content as string or null if not found
+	* Fetches raw file bytes from GitHub and validates their Git blob identity.
+	* Text callers should use getRawFile; package callers use this byte-preserving path.
 	*/
-	async getRawFile(owner, repo, ref, path) {
+	async getRawFileBytes(owner, repo, ref, path, options) {
 		const url = `${this.rawBaseUrl}/${owner}/${repo}/${ref}/${path}`;
 		try {
 			const res = await (0, cross_fetch.default)(url);
 			if (!res.ok) return null;
-			return await res.text();
+			const content = Buffer.from(await res.arrayBuffer());
+			const maxBytes = options?.maxBytes ?? 1048576;
+			if (content.byteLength > maxBytes) throw new IntegrityError(`${path}: ${content.byteLength} bytes exceeds the ${maxBytes}-byte limit`);
+			if (options?.expectedSha) {
+				const actualSha = gitBlobSha1(content);
+				if (actualSha !== options.expectedSha) throw new IntegrityError(`${path}: blob sha mismatch (expected ${options.expectedSha}, got ${actualSha}) — download may be corrupted or tampered with`);
+			}
+			return content;
 		} catch (error) {
+			if (error instanceof IntegrityError) throw error;
 			console.error(picocolors.default.red(`Failed to fetch file ${path}: ${error}`));
 			return null;
 		}
 	}
 	/**
+	* Fetches raw file content as UTF-8 for established text-only callers.
+	*/
+	async getRawFile(owner, repo, ref, path, options) {
+		return (await this.getRawFileBytes(owner, repo, ref, path, options))?.toString("utf8") ?? null;
+	}
+	/**
 	* Retrieves the latest release tag name for a repository.
 	* @param owner Repository owner
 	* @param repo Repository name
@@ -2417,34 +2670,76 @@ var GithubService = class {
 		}
 	}
 	/**
-	* Downloads multiple files concurrently with a limit.
+	* Downloads multiple text files concurrently with a limit. Existing text
+	* consumers retain UTF-8 strings; package sync uses the byte variant below.
 	*/
 	async downloadFilesConcurrent(tasks, concurrency = 10) {
-		const results = [];
-		const pool = [...tasks];
-		const executing = [];
+		return this.downloadFilesConcurrentWith(tasks, concurrency, (task) => this.getRawFile(task.owner, task.repo, task.ref, task.path, { expectedSha: task.sha }));
+	}
+	/**
+	* Downloads multiple files without decoding their response bytes.
+	*/
+	async downloadFilesConcurrentBytes(tasks, concurrency = 10) {
+		return this.downloadFilesConcurrentWith(tasks, concurrency, (task) => this.getRawFileBytes(task.owner, task.repo, task.ref, task.path, { expectedSha: task.sha }));
+	}
+	async downloadFilesConcurrentWith(tasks, concurrency, download) {
+		const outcomes = Array(tasks.length);
+		let nextIndex = 0;
 		const worker = async () => {
-			while (pool.length > 0) {
-				const task = pool.shift();
-				if (!task) break;
-				const content = await this.getRawFile(task.owner, task.repo, task.ref, task.path);
-				if (content !== null) results.push({
-					path: task.path,
-					content
-				});
+			while (nextIndex < tasks.length) {
+				const index = nextIndex++;
+				const task = tasks[index];
+				if (!task) continue;
+				try {
+					const content = await download(task);
+					outcomes[index] = content === null ? {
+						kind: "failed",
+						path: task.path,
+						reason: "not found"
+					} : {
+						kind: "ok",
+						path: task.path,
+						content
+					};
+				} catch (error) {
+					outcomes[index] = {
+						kind: "failed",
+						path: task.path,
+						reason: error instanceof Error ? error.message : String(error)
+					};
+				}
 			}
 		};
-		for (let i = 0; i < Math.min(concurrency, tasks.length); i++) executing.push(worker());
-		await Promise.all(executing);
-		return results;
+		await Promise.all(Array.from({ length: Math.min(concurrency, tasks.length) }, worker));
+		const ok = [];
+		const failed = [];
+		for (const outcome of outcomes) {
+			if (!outcome) continue;
+			if (outcome.kind === "ok") ok.push({
+				path: outcome.path,
+				content: outcome.content
+			});
+			else failed.push({
+				path: outcome.path,
+				reason: outcome.reason
+			});
+		}
+		return {
+			ok,
+			failed
+		};
 	}
 	/**
-	* Parses a GitHub URL into owner and repository name.
+	* Parses a GitHub URL into owner and repository name. Anchored to the
+	* start of the string so a URL like `https://evil.com/?x=github.com/a/b`
+	* — where "github.com/owner/repo" only appears as a substring, not as the
+	* actual host — is correctly rejected instead of silently resolving to
+	* `a/b` on the real github.com API.
 	* @param url The GitHub URL to parse
 	* @returns Object containing owner and repo, or null if invalid
 	*/
 	static parseGitHubUrl(url) {
-		const m = url.match(/github\.com\/([^/]+)\/([^/]+)/i);
+		const m = url.match(/^https?:\/\/(?:www\.)?github\.com\/([^/\s]+)\/([^/\s]+)/i);
 		if (!m) return null;
 		return {
 			owner: m[1],
@@ -2563,7 +2858,7 @@ var InitCommand = class {
 		const { frameworkChoices, agentChoices, defaultFramework } = this.initService.getPromptChoices(context, categories);
 		const answers = await inquirer.default.prompt([
 			{
-				type: "list",
+				type: "rawlist",
 				name: "framework",
 				message: "Select Framework:",
 				choices: frameworkChoices,
@@ -2589,7 +2884,7 @@ var InitCommand = class {
 			message: "Enable MCP server integration?",
 			default: true
 		}, {
-			type: "list",
+			type: "rawlist",
 			name: "mcpScope",
 			message: "Where should sync write MCP configs?",
 			when: (a) => a.mcpEnabled === true,
@@ -2717,7 +3012,7 @@ var ListSkillsCommand = class {
 				value: f.id
 			}));
 			framework = (await inquirer.default.prompt([{
-				type: "list",
+				type: "rawlist",
 				name: "framework",
 				message: "Select framework to list available skills for:",
 				choices,
@@ -2850,11 +3145,17 @@ var getTargets = (home = os.default.homedir()) => {
 * a user-home file is about to be modified.
 */
 var McpConfigService = class {
-	/** Returns the standard MCP server entry our CLI proposes. */
+	/**
+	* Returns the standard MCP server entry our CLI proposes. Defaults to the
+	* version this CLI was released with rather than an unversioned `npx -y
+	* <package>`, which would otherwise pull whatever is latest on npm the
+	* moment the agent starts — an unpinned update-drift surface (AST07).
+	* Pass an explicit `version` (from `mcp.version` in .skillsrc) to override.
+	*/
 	buildEntry(version) {
 		return {
 			command: "npx",
-			args: ["-y", version ? `${PACKAGE}@${version}` : PACKAGE]
+			args: ["-y", `${PACKAGE}@${version || "0.6.0"}`]
 		};
 	}
 	/** For testing: allows overriding the home directory. */
@@ -3402,10 +3703,7 @@ var AgentBridgeService = class {
 				case "cursor":
 					content += `---\ndescription: ${commonDescription}\nglobs: ['**/*']\nalwaysApply: true\n---\n\n`;
 					break;
-				case "copilot":
-					content += `---\ndescription: ${commonDescription}\napplyTo: '**/*'\n---\n\n`;
-					break;
-				case "none": break;
+				case "copilot": content += `---\ndescription: ${commonDescription}\napplyTo: '**/*'\n---\n\n`;
 			}
 			if (agentId === Agent.Claude) {
 				const claudeProtocol = [
@@ -3543,6 +3841,7 @@ var IndexGeneratorService = class {};
 * Centralized patterns for detecting and sanitizing prompt injection.
 * Shared between the CLI and CI scanning scripts.
 */
+/** Applied to the SKILL.md frontmatter `description` field. Always error-level. */
 var INJECTION_PATTERNS = [
 	/ignore\s+(?:all\s+|previous\s+|prior\s+)*(?:instructions?|rules?|guidance)/gi,
 	/you\s+(?:must|should|shall|will)\s+(?:now|immediately)\b/gi,
@@ -3550,6 +3849,23 @@ var INJECTION_PATTERNS = [
 	/(?:^|\n)\s*-{3,}\s*(?:\n|$)/g,
 	/<(?:script|iframe|style)[^>]*\s*>[\s\S]*?<\/(?:script|iframe|style)[^>]*\s*>/gi
 ];
+new RegExp(`[${[
+	8203,
+	8204,
+	8205,
+	8206,
+	8207,
+	8234,
+	8235,
+	8236,
+	8237,
+	8238,
+	8294,
+	8295,
+	8296,
+	8297,
+	65279
+].map((cp) => String.fromCodePoint(cp)).join("")}]`, "g");
 //#endregion
 //#region src/services/MetadataReader.ts
 /**
@@ -3629,7 +3945,7 @@ var MetadataReader = class {
 		try {
 			const frontmatterMatch = (await fs_extra.default.readFile(skillPath, "utf8")).match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n([\s\S]*)$/);
 			if (!frontmatterMatch) return null;
-			const fm = js_yaml.default.load(frontmatterMatch[1]);
+			const fm = js_yaml.load(frontmatterMatch[1]);
 			const priorityMatch = frontmatterMatch[2].match(/## \*\*Priority:\s*([^*]+)\*\*/);
 			const priority = priorityMatch ? priorityMatch[1].trim() : "P1";
 			const rawTriggers = (fm?.metadata || {})?.triggers || {};
@@ -3858,6 +4174,14 @@ var IndexGeneratorServiceImpl = class extends IndexGeneratorService {
 			coveredCategories.add("quality-engineering");
 			routerRows.push("| QE workflow | `<SKILLS>/quality-engineering/_INDEX.md` |");
 		}
+		if (availableCategories.includes("system-design")) {
+			coveredCategories.add("system-design");
+			routerRows.push("| Architecture or scale request | `<SKILLS>/system-design/_INDEX.md` |");
+		}
+		if (availableCategories.includes("cybersecurity")) {
+			coveredCategories.add("cybersecurity");
+			routerRows.push("| Cybersecurity investigation or authorized exercise | `<SKILLS>/cybersecurity/_INDEX.md` |");
+		}
 		return [
 			"## Agent Skills Index",
 			"",
@@ -3915,9 +4239,24 @@ var IndexGeneratorServiceImpl = class extends IndexGeneratorService {
 //#endregion
 //#region src/services/SkillSyncService.ts
 /**
+* A selected registry category or package could not be assembled completely.
+* Callers must not write installations or lockfiles from this partial result.
+*/
+var SkillAssemblyError = class extends Error {
+	failures;
+	constructor(failures) {
+		super(`Failed to assemble selected skills: ${failures.join(", ")}`);
+		this.failures = failures;
+		this.name = "SkillAssemblyError";
+	}
+};
+/**
 * Service responsible for synchronizing agent skills from a remote registry.
 */
 var SkillSyncService = class {
+	githubService;
+	failedPackagesByCategory = /* @__PURE__ */ new Map();
+	failedCategories = /* @__PURE__ */ new Set();
 	constructor(githubService) {
 		this.githubService = githubService;
 	}
@@ -3925,11 +4264,13 @@ var SkillSyncService = class {
 	* Assembles skills from the remote registry based on provided categories and configuration.
 	*/
 	async assembleSkills(categories, config) {
+		this.failedPackagesByCategory.clear();
+		this.failedCategories.clear();
 		const collected = [];
 		const githubMatch = GithubService.parseGitHubUrl(config.registry);
 		if (!githubMatch) {
 			console.log(picocolors.default.red("Error: Only GitHub registries supported."));
-			return [];
+			throw new SkillAssemblyError(["registry is not a GitHub repository"]);
 		}
 		const { owner, repo } = githubMatch;
 		for (const category of categories) {
@@ -3938,15 +4279,23 @@ var SkillSyncService = class {
 			console.log(picocolors.default.gray(`  - Discovering ${category} (${ref})...`));
 			const treeData = await this.githubService.getRepoTree(owner, repo, ref);
 			if (!treeData) {
+				this.failedCategories.add(category);
 				console.log(picocolors.default.red(`    ❌ Failed to fetch ${category}@${ref}.`));
 				continue;
 			}
 			const foldersToSync = this.identifyFoldersToSync(category, catConfig, treeData.tree);
 			for (const absOrRelSkill of foldersToSync) {
 				const skill = await this.fetchSkill(owner, repo, ref, category, absOrRelSkill, treeData.tree);
-				if (skill) collected.push(skill);
+				if (skill) {
+					collected.push(skill);
+					continue;
+				}
+				const [sourceCategory, skillName] = absOrRelSkill.includes("/") ? absOrRelSkill.split("/") : [category, absOrRelSkill];
+				if (sourceCategory && skillName) this.markPackageFailed(sourceCategory, skillName);
 			}
 		}
+		const failures = [...this.failedCategories, ...Array.from(this.failedPackagesByCategory).flatMap(([category, skills]) => Array.from(skills, (skill) => `${category}/${skill}`))];
+		if (failures.length > 0) throw new SkillAssemblyError(failures);
 		return collected;
 	}
 	/**
@@ -3955,75 +4304,89 @@ var SkillSyncService = class {
 	async writeSkills(skills, config, agents) {
 		const overrides = config.custom_overrides || [];
 		const fetchedSkillsByCategory = {};
-		for (const skill of skills) {
-			if (!fetchedSkillsByCategory[skill.category]) fetchedSkillsByCategory[skill.category] = /* @__PURE__ */ new Set();
-			fetchedSkillsByCategory[skill.category].add(skill.skill);
-		}
+		for (const skill of skills) (fetchedSkillsByCategory[skill.category] ??= /* @__PURE__ */ new Set()).add(skill.skill);
 		for (const agentId of agents) {
-			const agentDef = SUPPORTED_AGENTS.find((a) => a.id === agentId);
-			if (!agentDef || !agentDef.path) continue;
+			const agentDef = SUPPORTED_AGENTS.find((agent) => agent.id === agentId);
+			if (!agentDef?.path) continue;
 			const basePath = agentDef.path;
 			await fs_extra.default.ensureDir(basePath);
-			if (config.prune !== false) for (const category of Object.keys(fetchedSkillsByCategory)) {
-				const categoryPath = path.default.join(basePath, category);
-				if (await fs_extra.default.pathExists(categoryPath)) {
-					const existingDirs = await fs_extra.default.readdir(categoryPath);
-					for (const dir of existingDirs) if (!fetchedSkillsByCategory[category].has(dir)) {
-						const fullPath = path.default.join(categoryPath, dir);
-						if (!this.isOverridden(fullPath, overrides)) await fs_extra.default.remove(fullPath);
-					}
-				}
-			}
-			for (const skill of skills) await this.writeSkillForAgent(agentId, skill, overrides, basePath);
+			for (const skill of skills) if (!await this.writeSkillForAgent(agentId, skill, overrides, basePath)) this.markPackageFailed(skill.category, skill.skill);
+			if (config.prune !== false) await this.pruneOrphanedSkills(basePath, fetchedSkillsByCategory, overrides);
 			console.log(picocolors.default.gray(`  - Updated ${basePath}/ (${agentDef.name})`));
 		}
 	}
 	async writeSkillForAgent(agentId, skill, overrides, basePath) {
 		const isKiro = agentId === Agent.Kiro;
-		const kiroFolder = `${skill.category}-${skill.skill}`;
-		const skillPath = isKiro ? path.default.join(basePath, kiroFolder) : path.default.join(basePath, skill.category, skill.skill);
-		await fs_extra.default.ensureDir(skillPath);
+		const skillPath = isKiro ? path.default.join(basePath, `${skill.category}-${skill.skill}`) : path.default.join(basePath, skill.category, skill.skill);
+		if (!this.isPathSafe(skillPath, basePath)) {
+			console.log(picocolors.default.red(`    ❌ Security Error: Invalid skill path ${skill.category}/${skill.skill}`));
+			throw new Error(`Invalid skill path ${skill.category}/${skill.skill}`);
+		}
 		for (const fileItem of skill.files) {
 			const targetFilePath = path.default.join(skillPath, fileItem.name);
-			if (this.isOverridden(targetFilePath, overrides)) {
-				console.log(picocolors.default.yellow(`    ⚠️  Skipping overridden: ${this.normalizePath(targetFilePath)}`));
-				continue;
-			}
 			if (!this.isPathSafe(targetFilePath, skillPath)) {
 				console.log(picocolors.default.red(`    ❌ Security Error: Invalid path ${fileItem.name}`));
-				continue;
+				throw new Error(`Invalid path ${fileItem.name}`);
 			}
-			let content = fileItem.content;
-			if (isKiro && fileItem.name === "SKILL.md") content = this.transformSkillForKiro(content, skill.category);
-			await fs_extra.default.outputFile(targetFilePath, content);
+		}
+		const stagingPath = path.default.join(path.default.dirname(skillPath), `.${path.default.basename(skillPath)}.ags-staging`);
+		if (await fs_extra.default.pathExists(stagingPath)) throw new Error(`Refusing to replace ${skill.category}/${skill.skill}: staging path already exists at ${stagingPath}`);
+		await fs_extra.default.ensureDir(path.default.dirname(skillPath));
+		try {
+			if (this.hasOverridesInsideSkill(skillPath, overrides)) await this.copyOverrides(skillPath, stagingPath, overrides);
+			for (const fileItem of skill.files) {
+				const targetFilePath = path.default.join(skillPath, fileItem.name);
+				if (this.isOverridden(targetFilePath, overrides)) {
+					console.log(picocolors.default.yellow(`    ⚠️  Skipping overridden: ${this.normalizePath(targetFilePath)}`));
+					continue;
+				}
+				const stagedFilePath = path.default.join(stagingPath, fileItem.name);
+				let content = fileItem.bytes ?? fileItem.content;
+				if (isKiro && fileItem.name === "SKILL.md") content = this.transformSkillForKiro(fileItem.content, skill.category);
+				await fs_extra.default.outputFile(stagedFilePath, content);
+			}
+			await this.replaceSkillDirectory(stagingPath, skillPath);
+			return true;
+		} catch (error) {
+			await fs_extra.default.remove(stagingPath);
+			throw error;
 		}
 	}
 	async fetchSkill(owner, repo, ref, category, absOrRelSkill, tree) {
 		const [sourceCat, skillName] = absOrRelSkill.includes("/") ? absOrRelSkill.split("/") : [category, absOrRelSkill];
+		if (!sourceCat || !skillName) return null;
 		const prefix = `skills/${sourceCat}/${skillName}/`;
-		const downloadTasks = tree.filter((f) => f.path.startsWith(prefix) && f.type === "blob").filter((f) => {
-			const rel = f.path.replace(prefix, "");
-			return rel === "SKILL.md" || /^(references|scripts|assets)\//.test(rel);
-		}).map((f) => ({
+		const packageFiles = tree.filter((file) => file.type === "blob" && file.path.startsWith(prefix) && this.isPackageResource(file.path.slice(prefix.length)));
+		const rootAttributionFiles = tree.filter((file) => file.type === "blob" && this.isRootAttributionFile(file.path) && !packageFiles.some((packageFile) => packageFile.path.slice(prefix.length).toLowerCase() === file.path.toLowerCase()));
+		const downloadTasks = [...packageFiles, ...rootAttributionFiles].sort((left, right) => left.path.localeCompare(right.path)).map((file) => ({
 			owner,
 			repo,
 			ref,
-			path: f.path
+			path: file.path,
+			sha: file.sha
 		}));
-		const files = await this.githubService.downloadFilesConcurrent(downloadTasks);
-		if (files.length === 0) return null;
+		const { ok: files, failed } = await this.githubService.downloadFilesConcurrentBytes(downloadTasks);
+		for (const failure of failed) console.log(picocolors.default.red(`    ❌ ${sourceCat}/${skillName}: ${failure.path} — ${failure.reason}`));
+		if (!packageFiles.some((file) => file.path === `${prefix}SKILL.md`) || failed.length > 0 || files.length !== downloadTasks.length) return null;
 		console.log(picocolors.default.gray(`    + Fetched ${sourceCat}/${skillName} (${files.length} files)`));
 		return {
 			category: sourceCat,
 			skill: skillName,
-			files: files.map((f) => ({
-				name: f.path.replace(prefix, ""),
-				content: f.content
+			files: files.map((file) => ({
+				name: file.path.startsWith(prefix) ? file.path.slice(prefix.length) : file.path,
+				content: file.content.toString("utf8"),
+				bytes: file.content
 			}))
 		};
 	}
 	identifyFoldersToSync(category, catConfig, tree) {
-		const skillFolders = new Set(tree.filter((f) => f.path.startsWith(`skills/${category}/`)).map((f) => f.path.split("/")[2]).filter(Boolean));
+		const hasSkillMd = tree.some((f) => f.type === "blob" && f.path.startsWith(`skills/${category}/`) && f.path.endsWith("/SKILL.md"));
+		const skillFolders = new Set(tree.filter((f) => {
+			if (!f.path.startsWith(`skills/${category}/`)) return false;
+			if (hasSkillMd) return f.type === "blob" && f.path.endsWith("/SKILL.md");
+			const rel = f.path.slice(`skills/${category}/`.length);
+			return !rel.startsWith("references/") && rel !== "references" && rel !== "_INDEX.md";
+		}).map((f) => f.path.split("/")[2]).filter(Boolean));
 		const folders = Array.from(skillFolders).filter((folder) => {
 			if (catConfig.include && !catConfig.include.includes(folder)) return false;
 			if (catConfig.exclude && catConfig.exclude.includes(folder)) return false;
@@ -4035,21 +4398,128 @@ var SkillSyncService = class {
 	expandAbsoluteInclude(absSkill, folders, tree) {
 		const [targetCat, targetSkill] = absSkill.split("/");
 		if (!targetCat || !targetSkill) return;
-		if (targetSkill === "*") new Set(tree.filter((f) => f.path.startsWith(`skills/${targetCat}/`)).map((f) => f.path.split("/")[2]).filter(Boolean)).forEach((s) => {
-			const fullPath = `${targetCat}/${s}`;
-			if (!folders.includes(fullPath)) folders.push(fullPath);
-		});
-		else if (!folders.includes(absSkill)) if (tree.some((f) => f.path.startsWith(`skills/${targetCat}/${targetSkill}/`))) folders.push(absSkill);
-		else console.log(picocolors.default.yellow(`    ⚠️  Absolute include ${absSkill} not found in repository.`));
+		if (targetSkill === "*") {
+			const hasTargetSkillMd = tree.some((f) => f.type === "blob" && f.path.startsWith(`skills/${targetCat}/`) && f.path.endsWith("/SKILL.md"));
+			new Set(tree.filter((f) => {
+				if (!f.path.startsWith(`skills/${targetCat}/`)) return false;
+				if (hasTargetSkillMd) return f.type === "blob" && f.path.endsWith("/SKILL.md");
+				const rel = f.path.slice(`skills/${targetCat}/`.length);
+				return !rel.startsWith("references/") && rel !== "references" && rel !== "_INDEX.md";
+			}).map((f) => f.path.split("/")[2]).filter(Boolean)).forEach((s) => {
+				const fullPath = `${targetCat}/${s}`;
+				if (!folders.includes(fullPath)) folders.push(fullPath);
+			});
+		} else if (!folders.includes(absSkill)) {
+			if (tree.some((f) => f.path.startsWith(`skills/${targetCat}/${targetSkill}/`))) folders.push(absSkill);
+			else console.log(picocolors.default.yellow(`    ⚠️  Absolute include ${absSkill} not found in repository.`));
+		}
 	}
+	/**
+	* Kiro has no file/keyword routing concept, so `metadata.triggers` is
+	* intentionally dropped here (Kiro users get skills with no auto-routing
+	* — a known, documented limitation, not a bug). Every other declared
+	* field — including the optional Universal-Skill-Format fields
+	* (version/risk_tier/allowed-tools/permissions/content_hash/signature) —
+	* is preserved rather than silently discarded.
+	*
+	* Uses a real YAML parse + js-yaml dump (matching SpecialistTransformer)
+	* instead of regex-extract-and-reinterpolate: the previous implementation
+	* built `description: ${description}` via raw string interpolation, which
+	* had the same YAML-key-injection exposure fixed elsewhere in this PR — a
+	* description containing a quote+newline could inject a new top-level key
+	* into the emitted Kiro frontmatter.
+	*/
 	transformSkillForKiro(content, category) {
-		const frontmatterMatch = content.match(/^---\n([\s\S]*?)\n---/);
+		const frontmatterMatch = content.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n([\s\S]*)$/);
 		if (!frontmatterMatch) return content;
-		const [fullMatch, frontmatter] = frontmatterMatch;
-		const body = content.slice(fullMatch.length);
-		const name = frontmatter.match(/^name:\s*(.+)$/m)?.[1].trim() || "";
-		const description = frontmatter.match(/^description:\s*(.+)$/m)?.[1].trim() || "";
-		return `---\nname: ${`${category.charAt(0).toUpperCase() + category.slice(1)} - ${name}`}\ndescription: ${description}\n---` + body;
+		let metadata;
+		try {
+			metadata = js_yaml.load(frontmatterMatch[1]) ?? {};
+		} catch {
+			return content;
+		}
+		const body = frontmatterMatch[2];
+		const name = typeof metadata.name === "string" ? metadata.name : "";
+		const displayName = `${category.charAt(0).toUpperCase() + category.slice(1)} - ${name}`;
+		const fm = {
+			...metadata,
+			name: displayName,
+			description: typeof metadata.description === "string" ? metadata.description : ""
+		};
+		const kiroMetadata = fm.metadata;
+		if (this.isRecord(kiroMetadata)) {
+			const preservedMetadata = { ...kiroMetadata };
+			delete preservedMetadata.triggers;
+			fm.metadata = preservedMetadata;
+		}
+		return `---\n${js_yaml.dump(fm, { lineWidth: -1 }).trimEnd()}\n---\n\n${body}`;
+	}
+	isPackageResource(relativePath) {
+		return relativePath === "SKILL.md" || /^(references|scripts|assets)\//.test(relativePath) || this.isRootAttributionFile(relativePath);
+	}
+	isRootAttributionFile(filePath) {
+		return !filePath.includes("/") && /^(LICENSE|NOTICE)(?:\.(?:md|txt))?$/i.test(filePath);
+	}
+	markPackageFailed(category, skill) {
+		let failedSkills = this.failedPackagesByCategory.get(category);
+		if (!failedSkills) {
+			failedSkills = /* @__PURE__ */ new Set();
+			this.failedPackagesByCategory.set(category, failedSkills);
+		}
+		failedSkills.add(skill);
+	}
+	async pruneOrphanedSkills(basePath, fetchedSkillsByCategory, overrides) {
+		for (const [category, fetchedSkills] of Object.entries(fetchedSkillsByCategory)) {
+			if (this.failedCategories.has(category)) continue;
+			const categoryPath = path.default.join(basePath, category);
+			if (!await fs_extra.default.pathExists(categoryPath)) continue;
+			const failedSkills = this.failedPackagesByCategory.get(category);
+			const existingDirs = await fs_extra.default.readdir(categoryPath);
+			for (const directory of existingDirs) {
+				const fullPath = path.default.join(categoryPath, directory);
+				if (fetchedSkills.has(directory) || failedSkills?.has(directory) || this.isOverridden(fullPath, overrides)) continue;
+				await fs_extra.default.remove(fullPath);
+			}
+		}
+	}
+	hasOverridesInsideSkill(skillPath, overrides) {
+		const skillRelativePath = this.normalizePath(skillPath);
+		const skillSuffix = skillRelativePath.split("/").slice(-2).join("/");
+		return overrides.some((override) => {
+			const normalizedOverride = override.replace(/\\/g, "/").replace(/\/$/, "");
+			return this.isOverridden(skillPath, [override]) || normalizedOverride.startsWith(`${skillRelativePath}/`) || normalizedOverride.includes(`/${skillRelativePath}/`) || normalizedOverride === skillSuffix || normalizedOverride.startsWith(`${skillSuffix}/`) || normalizedOverride.includes(`/${skillSuffix}/`);
+		});
+	}
+	async copyOverrides(sourcePath, targetPath, overrides) {
+		if (!await fs_extra.default.pathExists(sourcePath)) return;
+		const sourceStat = await fs_extra.default.lstat(sourcePath);
+		if (sourceStat.isSymbolicLink() || !sourceStat.isDirectory()) {
+			console.log(picocolors.default.yellow(`    ⚠️  Skipping override copy outside installation root: ${this.normalizePath(sourcePath)}`));
+			return;
+		}
+		const entries = await fs_extra.default.readdir(sourcePath, { withFileTypes: true });
+		for (const entry of entries) {
+			const source = path.default.join(sourcePath, entry.name);
+			const target = path.default.join(targetPath, entry.name);
+			if (entry.isDirectory()) await this.copyOverrides(source, target, overrides);
+			else if (entry.isFile() && this.isOverridden(source, overrides)) await fs_extra.default.copy(source, target);
+		}
+	}
+	async replaceSkillDirectory(stagingPath, skillPath) {
+		const backupPath = `${skillPath}.ags-backup`;
+		if (await fs_extra.default.pathExists(backupPath)) throw new Error(`Refusing to replace ${this.normalizePath(skillPath)}: backup path already exists at ${backupPath}`);
+		const hadExistingSkill = await fs_extra.default.pathExists(skillPath);
+		if (hadExistingSkill) await fs_extra.default.move(skillPath, backupPath, { overwrite: false });
+		try {
+			await fs_extra.default.move(stagingPath, skillPath, { overwrite: false });
+		} catch (error) {
+			if (hadExistingSkill) await fs_extra.default.move(backupPath, skillPath, { overwrite: false });
+			throw error;
+		}
+		if (hadExistingSkill) await fs_extra.default.remove(backupPath);
+	}
+	isRecord(value) {
+		return typeof value === "object" && value !== null && !Array.isArray(value);
 	}
 	isOverridden(targetPath, overrides) {
 		const rel = this.normalizePath(targetPath);
@@ -4067,6 +4537,21 @@ var SkillSyncService = class {
 	}
 };
 //#endregion
+//#region src/services/utils/tomlEscape.ts
+/**
+* Escapes backslashes and double quotes for embedding inside any TOML basic
+* string — single-line `"..."` or multi-line `"""..."""`.
+*
+* Escaping every quote (not just runs of 3+) sidesteps the ambiguity around
+* multi-line basic strings, where an unescaped run of 3+ quote characters
+* can be misread as the closing delimiter: with every quote escaped, no
+* unescaped `"""` sequence can ever occur in the output, regardless of how
+* many consecutive quote characters the source content contains.
+*/
+function escapeTomlString(value) {
+	return value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"");
+}
+//#endregion
 //#region src/services/utils/WorkflowTransformer.ts
 var WORKFLOW_ARGUMENTS = "Optional args: slug=<feature>, ticket=<id/url>, mode=interactive|autonomous|channel, channel=<id>, auto_continue=true|false, profile=business|hybrid|technical.";
 /**
@@ -4133,8 +4618,10 @@ var WorkflowTransformer = class {
 			body: content
 		};
 		const descMatch = match[1].match(/description:\s*(.+)/);
+		const rawDescription = descMatch ? descMatch[1].trim() : "";
+		const quotedMatch = rawDescription.match(/^"(.*)"$|^'(.*)'$/);
 		return {
-			description: descMatch ? descMatch[1].trim() : "",
+			description: quotedMatch ? quotedMatch[1] ?? quotedMatch[2] : rawDescription,
 			body: match[2]
 		};
 	}
@@ -4167,13 +4654,13 @@ ${body}`;
 	* User invokes via /<name> [arguments]
 	*/
 	static toGeminiCommand(description, body) {
-		return `description = "${description.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"
+		return `description = "${escapeTomlString(description)}"
 prompt = """
 Execute this workflow for: {{args}}
 
 ${WORKFLOW_ARGUMENTS}
 
-${body.replace(/"""/g, "\\\"\\\"\\\"")}
+${escapeTomlString(body)}
 """
 `;
 	}
@@ -4183,7 +4670,7 @@ ${body.replace(/"""/g, "\\\"\\\"\\\"")}
 	* User invokes via /prompt-name in Copilot chat.
 	*/
 	static toCopilotPrompt(description, body) {
-		return `---\ndescription: "${description}"\n---\n${body}`;
+		return `---\ndescription: "${description.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"\n---\n${body}`;
 	}
 	/**
 	* Agent Skill (SKILL.md) format.
@@ -4225,6 +4712,7 @@ ${body}
 * Service responsible for synchronizing agent workflows from a remote registry.
 */
 var WorkflowSyncService = class {
+	githubService;
 	constructor(githubService) {
 		this.githubService = githubService;
 	}
@@ -4283,12 +4771,14 @@ var WorkflowSyncService = class {
 			if (Array.isArray(config.workflows)) return config.workflows.includes(this.workflowNameFromPath(f.path));
 			return false;
 		});
-		const files = await this.githubService.downloadFilesConcurrent(workflowFiles.map((f) => ({
+		const { ok: files, failed } = await this.githubService.downloadFilesConcurrent(workflowFiles.map((f) => ({
 			owner,
 			repo,
 			ref,
-			path: f.path
+			path: f.path,
+			sha: f.sha
 		})));
+		for (const failure of failed) console.log(picocolors.default.red(`    ❌ ${failure.path} — ${failure.reason}`));
 		if (files.length > 0) {
 			console.log(picocolors.default.gray(`    + Fetched ${files.length} workflows`));
 			return [{
@@ -4371,6 +4861,46 @@ var WorkflowSyncService = class {
 };
 //#endregion
 //#region src/services/utils/SpecialistTransformer.ts
+var FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---\r?\n([\s\S]*)$/;
+/**
+* Serializes frontmatter fields via js-yaml so every value — including a
+* `description` sourced from skill content — is safely quoted/escaped.
+* Interpolating raw strings into a hand-built YAML template let a crafted
+* description inject its own top-level keys (e.g. a second `tools:`) into
+* the emitted agent file; js-yaml can't be tricked that way.
+*/
+function dumpFrontmatter(fields) {
+	return js_yaml.dump(fields, { lineWidth: -1 }).trimEnd();
+}
+/**
+* Codex is the only target with a native least-privilege primitive
+* (sandbox_mode). L2/L3 map to workspace-write; danger-full-access is never
+* auto-granted regardless of declared risk_tier — that always requires
+* explicit user configuration outside the sync pipeline.
+*/
+function sandboxModeFor(riskTier) {
+	return riskTier === "L2" || riskTier === "L3" ? "workspace-write" : "read-only";
+}
+/** Summarizes whichever of risk_tier/allowed-tools/permissions a specialist declared, for a warning comment. */
+function summarizeDeclaredPermissions(metadata) {
+	const parts = [];
+	if (metadata.risk_tier) parts.push(`risk_tier: ${metadata.risk_tier}`);
+	if (metadata["allowed-tools"]) parts.push(`allowed-tools: ${JSON.stringify(metadata["allowed-tools"])}`);
+	if (metadata.permissions) parts.push(`permissions: ${JSON.stringify(metadata.permissions)}`);
+	return parts.length > 0 ? parts.join("; ") : null;
+}
+/**
+* For platforms with no way to express a declared risk_tier/permissions/
+* allowed-tools, prepend a visible warning rather than silently dropping
+* the declaration — a persona authored as restricted for one platform
+* should not read as unconstrained everywhere else without at least a
+* trace of what was intended.
+*/
+function unenforceableWarningComment(metadata, agentName) {
+	const declared = summarizeDeclaredPermissions(metadata);
+	if (!declared) return "";
+	return `<!-- ags: permissions not enforceable on ${agentName}; declared: ${declared} -->\n`;
+}
 /**
 * Transforms specialist skill markdown into platform-specific agent personas.
 */
@@ -4378,45 +4908,82 @@ var SpecialistTransformer = class {
 	static transform(source, agentId) {
 		const agentDef = getAgentDefinition(agentId);
 		if (!agentDef) return null;
-		const parts = source.content.split("---");
-		if (parts.length < 3) return null;
-		const metadata = js_yaml.default.load(parts[1]);
-		const body = parts.slice(2).join("---").trim();
+		const match = source.content.match(FRONTMATTER_RE);
+		if (!match) return null;
+		const metadata = js_yaml.load(match[1]);
+		const body = match[2].trim();
 		const baseName = source.name.replace(/^specialist-/, "");
 		const fullName = source.name;
 		const description = metadata.description || `Specialist persona for ${baseName}`;
 		switch (agentId) {
-			case Agent.Claude: return {
-				name: `${baseName}.md`,
-				content: `---\nname: ${baseName}\ndescription: "${description}"\n---\n\n${body}`
-			};
+			case Agent.Claude: {
+				const fm = {
+					name: baseName,
+					description
+				};
+				const allowedTools = metadata["allowed-tools"];
+				if (metadata.tools) fm.tools = Array.isArray(metadata.tools) ? metadata.tools.join(", ") : metadata.tools;
+				else if (Array.isArray(allowedTools) && allowedTools.length > 0) fm.tools = allowedTools.join(", ");
+				else if (typeof allowedTools === "string" && allowedTools.trim().length > 0) fm.tools = allowedTools.trim();
+				if (metadata.model) fm.model = metadata.model;
+				if (metadata.color) fm.color = metadata.color;
+				return {
+					name: `${baseName}.md`,
+					content: `---\n${dumpFrontmatter(fm)}\n---\n\n${body}`
+				};
+			}
 			case Agent.Cursor: return {
 				name: `${fullName}.mdc`,
-				content: `---\ndescription: ${description}\nglobs: ["**/*"]\n---\n# Specialist: ${baseName}\n\n${body}`
+				content: `${unenforceableWarningComment(metadata, "Cursor")}---\n${dumpFrontmatter({
+					description,
+					globs: ["**/*"]
+				})}\n---\n# Specialist: ${baseName}\n\n${body}`
 			};
 			case Agent.Copilot: return {
 				name: `${fullName}.instructions.md`,
-				content: `---\ndescription: "${description}"\napplyTo: "**/*"\n---\n\n${body}`
+				content: `${unenforceableWarningComment(metadata, "Copilot")}---\n${dumpFrontmatter({
+					description,
+					applyTo: "**/*"
+				})}\n---\n\n${body}`
 			};
 			case Agent.OpenCode: return {
 				name: `${baseName}.md`,
-				content: `---\ndescription: "${description}"\nmode: subagent\n---\n\n${body}`
+				content: `${unenforceableWarningComment(metadata, "OpenCode")}---\n${dumpFrontmatter({
+					description,
+					mode: "subagent"
+				})}\n---\n\n${body}`
 			};
 			case Agent.Gemini: return {
 				name: `${baseName}.md`,
-				content: `---\nname: ${baseName}\ndescription: "${description}"\nkind: local\n---\n\n${body}`
+				content: `${unenforceableWarningComment(metadata, "Gemini")}---\n${dumpFrontmatter({
+					name: baseName,
+					description,
+					kind: "local"
+				})}\n---\n\n${body}`
 			};
 			case Agent.Kiro: return {
 				name: `${baseName}.md`,
-				content: `---\nname: ${baseName}\ndescription: "${description}"\n---\n\n${body}`
-			};
-			case Agent.Codex: return {
-				name: `${baseName}.toml`,
-				content: `name = "${baseName}"\ndescription = "${description}"\nsandbox_mode = "read-only"\ndeveloper_instructions = """\n${body}\n"""`
+				content: `${unenforceableWarningComment(metadata, "Kiro")}---\n${dumpFrontmatter({
+					name: baseName,
+					description
+				})}\n---\n\n${body}`
 			};
+			case Agent.Codex: {
+				const sandboxMode = sandboxModeFor(metadata.risk_tier);
+				const unenforceable = [];
+				if (metadata["allowed-tools"]) unenforceable.push("allowed-tools");
+				const permissions = metadata.permissions;
+				if (permissions?.network) unenforceable.push("permissions.network");
+				if (permissions?.filesystem) unenforceable.push("permissions.filesystem");
+				const comment = unenforceable.length > 0 ? `# ags: ${unenforceable.join(", ")} declared but not enforceable via Codex TOML (only sandbox_mode is projected)\n` : "";
+				return {
+					name: `${baseName}.toml`,
+					content: `${comment}name = "${escapeTomlString(baseName)}"\ndescription = "${escapeTomlString(description)}"\nsandbox_mode = "${sandboxMode}"\ndeveloper_instructions = """\n${escapeTomlString(body)}\n"""`
+				};
+			}
 			default: return {
 				name: `${baseName}${agentDef.ruleExtension || ".md"}`,
-				content: body
+				content: `${unenforceableWarningComment(metadata, agentDef.name)}${body}`
 			};
 		}
 	}
@@ -4428,6 +4995,7 @@ var SpecialistTransformer = class {
 * to native agent configuration directories.
 */
 var SpecialistSyncService = class {
+	githubService;
 	constructor(githubService = new GithubService(process.env.GITHUB_TOKEN)) {
 		this.githubService = githubService;
 	}
@@ -4599,6 +5167,86 @@ var GitService = class {
 	}
 };
 //#endregion
+//#region src/services/LockfileService.ts
+var LOCKFILE_NAME = ".skills-lock.json";
+function sha256(content) {
+	return (0, node_crypto.createHash)("sha256").update(content, Buffer.isBuffer(content) ? void 0 : "utf8").digest("hex");
+}
+function contentHashOf(files) {
+	return sha256(Object.keys(files).sort().map((p) => `${p}\0${files[p]}\n`).join(""));
+}
+/**
+* Records the sha256 of every file `ags sync` writes for a skill, so a later
+* `ags verify` can detect drift between what was fetched and what's actually
+* on disk — tampering, a partial write, or a manual edit that silently
+* diverged from the registry. This is deliberately scoped to local
+* tamper-detection: it does not (yet) resolve refs to commits or detect a
+* moved tag on the registry side — see docs/SECURITY.md's OWASP AST table
+* (AST07) for that follow-up.
+*/
+var LockfileService = class {
+	lockfilePath(rootDir) {
+		return path.default.join(rootDir, LOCKFILE_NAME);
+	}
+	buildEntries(skills, refByCategory) {
+		const entries = {};
+		for (const skill of skills) {
+			const files = {};
+			for (const file of skill.files) files[file.name] = sha256(file.bytes ?? Buffer.from(file.content, "utf8"));
+			entries[`${skill.category}/${skill.skill}`] = {
+				ref: refByCategory[skill.category] || "unknown",
+				files,
+				contentHash: contentHashOf(files)
+			};
+		}
+		return entries;
+	}
+	async write(rootDir, registry, skills, refByCategory) {
+		if (skills.length === 0) return;
+		const lock = {
+			version: 1,
+			registry,
+			generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			skills: this.buildEntries(skills, refByCategory)
+		};
+		await fs_extra.default.writeJson(this.lockfilePath(rootDir), lock, { spaces: 2 });
+	}
+	async read(rootDir) {
+		const file = this.lockfilePath(rootDir);
+		if (!await fs_extra.default.pathExists(file)) return null;
+		return fs_extra.default.readJson(file);
+	}
+	/**
+	* Recomputes the sha256 of every file the lockfile knows about, under
+	* `installedPath/<category>/<skill>/<relPath>` (the standard, non-Kiro
+	* layout `SkillSyncService.writeSkillForAgent` uses), and compares.
+	*/
+	async verify(rootDir, installedPath) {
+		const lock = await this.read(rootDir);
+		if (!lock) return {
+			ok: false,
+			mismatches: [],
+			missing: [`${LOCKFILE_NAME} not found — run 'ags sync' first`]
+		};
+		const mismatches = [];
+		const missing = [];
+		for (const [skillKey, entry] of Object.entries(lock.skills)) for (const [relPath, expectedHash] of Object.entries(entry.files)) {
+			const label = `${skillKey}/${relPath}`;
+			const filePath = path.default.join(installedPath, skillKey, relPath);
+			if (!await fs_extra.default.pathExists(filePath)) {
+				missing.push(label);
+				continue;
+			}
+			if (sha256(await fs_extra.default.readFile(filePath)) !== expectedHash) mismatches.push(label);
+		}
+		return {
+			ok: mismatches.length === 0 && missing.length === 0,
+			mismatches,
+			missing
+		};
+	}
+};
+//#endregion
 //#region src/services/utils/MarkdownUtils.ts
 /**
 * Utility functions for manipulating markdown content
@@ -4616,7 +5264,7 @@ var MarkdownUtils = class {
 		const updated = [];
 		for (const target of targets) {
 			const targetPath = path.default.join(rootDir, target);
-			let content = "";
+			let content;
 			const markerStart = "<!-- SKILLS_INDEX_START -->";
 			const markerEnd = "<!-- SKILLS_INDEX_END -->";
 			if (await fs_extra.default.pathExists(targetPath)) {
@@ -4656,6 +5304,7 @@ var SyncService = class {
 	workflowSyncService = new WorkflowSyncService(this.githubService);
 	specialistSyncService = new SpecialistSyncService();
 	gitService = new GitService();
+	lockfileService = new LockfileService();
 	async reconcileConfig(config, projectDeps) {
 		const reenabled = this.configService.reconcileDependencies(config, projectDeps);
 		if (reenabled.length > 0) {
@@ -4686,7 +5335,18 @@ var SyncService = class {
 	async writeSkills(skills, config) {
 		await this.cleanupOldFolders();
 		const agents = await this.resolveTargetAgents(config);
-		return this.skillSyncService.writeSkills(skills, config, agents);
+		await this.skillSyncService.writeSkills(skills, config, agents);
+		await this.writeLockfile(skills, config);
+	}
+	/**
+	* Records what was actually fetched (per-file sha256) so `ags verify` can
+	* later detect drift between the lockfile and what's on disk. No-op if
+	* nothing was fetched (e.g. every category failed to resolve).
+	*/
+	async writeLockfile(skills, config) {
+		const refByCategory = {};
+		for (const [category, entry] of Object.entries(config.skills)) refByCategory[category] = entry.ref || "main";
+		await this.lockfileService.write(process.cwd(), config.registry, skills, refByCategory);
 	}
 	async assembleWorkflows(config) {
 		return this.workflowSyncService.assembleWorkflows(config);
@@ -4737,8 +5397,10 @@ var SyncService = class {
 			if ((await MarkdownUtils.injectIndex(process.cwd(), ["AGENTS.md"], routerIndex)).length > 0) console.log(picocolors.default.green("  ✅ AGENTS.md router index updated."));
 			else console.log(picocolors.default.yellow("  ⚠️  Skipped AGENTS.md update: index markers <!-- SKILLS_INDEX_START --> … <!-- SKILLS_INDEX_END --> are missing or out of order. Opt-in by adding these markers to your file."));
 			const serverDir = path.default.join(process.cwd(), "server");
-			if (await fs_extra.default.pathExists(serverDir)) if ((await MarkdownUtils.injectIndex(serverDir, ["AGENTS.md"], routerIndex)).length > 0) console.log(picocolors.default.green("  ✅ server/AGENTS.md router index updated."));
-			else console.log(picocolors.default.yellow("  ⚠️  Skipped server/AGENTS.md update: index markers <!-- SKILLS_INDEX_START --> … <!-- SKILLS_INDEX_END --> are missing or out of order in server/AGENTS.md. Opt-in via markers."));
+			if (await fs_extra.default.pathExists(serverDir)) {
+				if ((await MarkdownUtils.injectIndex(serverDir, ["AGENTS.md"], routerIndex)).length > 0) console.log(picocolors.default.green("  ✅ server/AGENTS.md router index updated."));
+				else console.log(picocolors.default.yellow("  ⚠️  Skipped server/AGENTS.md update: index markers <!-- SKILLS_INDEX_START --> … <!-- SKILLS_INDEX_END --> are missing or out of order in server/AGENTS.md. Opt-in via markers."));
+			}
 			await new AgentBridgeService().bridge(process.cwd(), agents);
 		} catch (error) {
 			console.log(picocolors.default.yellow(`  ⚠️  Failed to update index: ${error}`));
@@ -4758,8 +5420,29 @@ var SyncService = class {
 			const latestRef = `${remoteMetaCat.tag_prefix || ""}${remoteMetaCat.version}`;
 			if (catConfig.ref !== latestRef) updates[cat] = latestRef;
 		}
+		this.warnAboutRevokedRefs(config, remoteMeta);
 		return updates;
 	}
+	/**
+	* Prints a warning (does not block sync) for any installed category ref
+	* that appears in the registry's `revocations` list — e.g. a version
+	* later found to carry a vulnerability. Checked against the *live*
+	* registry metadata.json (fetched above), not this repo's own local copy,
+	* so a revocation recorded after a consumer's initial sync is still seen
+	* on their next sync/update check.
+	*/
+	warnAboutRevokedRefs(config, remoteMeta) {
+		const revocations = remoteMeta.revocations ?? [];
+		if (revocations.length === 0) return;
+		for (const [cat, catConfig] of Object.entries(config.skills)) {
+			if (!catConfig.ref) continue;
+			const hit = revocations.find((r) => r.category === cat && r.refs.includes(catConfig.ref));
+			if (!hit) continue;
+			console.log(picocolors.default.red(`\n🚨 ${cat}@${catConfig.ref} has been revoked: ${hit.reason}`));
+			if (hit.advisory) console.log(picocolors.default.gray(`   Advisory: ${hit.advisory}`));
+			console.log(picocolors.default.yellow("   Run `ags sync --yes` to update to a non-revoked version."));
+		}
+	}
 	async resolveTargetAgents(config) {
 		if (config.agents && config.agents.length > 0) return config.agents;
 		const detectedMap = await this.detectionService.detectAgents();
@@ -4767,6 +5450,29 @@ var SyncService = class {
 		if (detected.length > 0) return detected;
 		return [];
 	}
+	/**
+	* Verifies installed skill files against `.skills-lock.json`. Checks the
+	* first configured agent's skill directory by default (or `agentId` if
+	* given) — the standard `<agentPath>/<category>/<skill>/<file>` layout;
+	* Kiro's flattened `<category>-<skill>/` layout isn't supported yet.
+	*/
+	async verifyLockfile(config, agentId) {
+		const targetAgentId = agentId ?? config.agents?.[0];
+		const agentDef = SUPPORTED_AGENTS.find((a) => a.id === targetAgentId);
+		if (!agentDef?.path) return {
+			agent: null,
+			result: {
+				ok: false,
+				mismatches: [],
+				missing: ["no configured agent with a skill directory to verify"]
+			}
+		};
+		const result = await this.lockfileService.verify(process.cwd(), path.default.join(process.cwd(), agentDef.path));
+		return {
+			agent: agentDef.id,
+			result
+		};
+	}
 	async cleanupOldFolders() {
 		const oldPath = path.default.join(process.cwd(), ".agent");
 		const newPath = path.default.join(process.cwd(), ".agents");
@@ -4821,15 +5527,17 @@ var SyncCommand = class {
 				console.log(picocolors.default.yellow("\n🚀 New skill versions detected:"));
 				for (const [cat, ref] of Object.entries(updates)) console.log(picocolors.default.gray(`  - ${cat}: ${config.skills[cat].ref} -> ${ref}`));
 				let update = options.yes;
-				if (update === void 0) if (!process.stdin.isTTY) {
-					console.log(picocolors.default.cyan("ℹ️  Non-interactive environment detected. Skipping version updates. Use --yes to auto-confirm."));
-					update = false;
-				} else update = (await inquirer.default.prompt([{
-					type: "confirm",
-					name: "update",
-					message: "Do you want to update .skillsrc with these versions?",
-					default: true
-				}])).update;
+				if (update === void 0) {
+					if (!process.stdin.isTTY) {
+						console.log(picocolors.default.cyan("ℹ️  Non-interactive environment detected. Skipping version updates. Use --yes to auto-confirm."));
+						update = false;
+					} else update = (await inquirer.default.prompt([{
+						type: "confirm",
+						name: "update",
+						message: "Do you want to update .skillsrc with these versions?",
+						default: true
+					}])).update;
+				}
 				if (update) {
 					for (const [cat, ref] of Object.entries(updates)) config.skills[cat].ref = ref;
 					await this.configService.saveConfig(config);
@@ -4846,7 +5554,7 @@ var SyncCommand = class {
 			await this.syncService.applyIndices(config, config.agents);
 			console.log(picocolors.default.green("✅ All skills synced successfully!"));
 			await this.runMcpPhase(config, options);
-			await this.runHookPhase(config);
+			await this.runHookPhase(config, options);
 		} catch (error) {
 			if (error instanceof Error) console.error(picocolors.default.red("❌ Sync failed:"), error.message);
 			else console.error(picocolors.default.red("❌ Sync failed:"), String(error));
@@ -4932,7 +5640,7 @@ var SyncCommand = class {
 			message: "Enable MCP server integration?",
 			default: true
 		}, {
-			type: "list",
+			type: "rawlist",
 			name: "scope",
 			message: "Where should sync write MCP configs?",
 			when: (a) => a.enabled === true,
@@ -4959,7 +5667,7 @@ var SyncCommand = class {
 	* files up to date. Claude's script is preserved if already customized; Kiro's
 	* markdown hook is kept in sync with the embedded template.
 	*/
-	async runHookPhase(config) {
+	async runHookPhase(config, options = {}) {
 		const agents = config.agents ?? [];
 		if (agents.length === 0) return;
 		const mcp = config.mcp ?? defaultMcpConfig();
@@ -4970,9 +5678,23 @@ var SyncCommand = class {
 			});
 			return;
 		}
+		const promptPermission = options.yes ? async () => true : async (agent) => {
+			if (!process.stdin.isTTY) {
+				console.log(picocolors.default.gray(`\nℹ️  Skipping MCP permission grant for ${agent} (non-interactive; use --yes to auto-confirm).`));
+				return false;
+			}
+			const { ok } = await inquirer.default.prompt([{
+				type: "confirm",
+				name: "ok",
+				message: `Allow ${picocolors.default.cyan(agent)} to auto-run the agent-skills-standard MCP tools (adds "${CLAUDE_MCP_PERMISSION}" to permissions.allow)?`,
+				default: true
+			}]);
+			return ok;
+		};
 		const writes = (await this.hookService.install({
 			rootDir: process.cwd(),
-			agents
+			agents,
+			promptPermission
 		})).writes.filter((w) => w.action !== "skipped-existing");
 		if (writes.length === 0) return;
 		console.log(picocolors.default.cyan("\n🪝 Updating skill-loader hooks..."));
@@ -4983,6 +5705,39 @@ var SyncCommand = class {
 	}
 };
 //#endregion
+//#region src/commands/audit.ts
+/**
+* Prints the skill inventory recorded in .skills-lock.json — the AST09
+* "skill inventory" governance control: what's installed, from which ref,
+* and how many files each skill carries.
+*/
+var AuditCommand = class {
+	lockfileService;
+	constructor(lockfileService) {
+		this.lockfileService = lockfileService || new LockfileService();
+	}
+	async run() {
+		const lock = await this.lockfileService.read(process.cwd());
+		if (!lock) {
+			console.log(picocolors.default.yellow("No .skills-lock.json found. Run `ags sync` first to generate one."));
+			process.exitCode = 1;
+			return;
+		}
+		const entries = Object.entries(lock.skills).sort(([a], [b]) => a.localeCompare(b));
+		console.log(picocolors.default.cyan(`📋 Skill inventory (${lock.registry})`));
+		console.log(picocolors.default.gray(`   Generated: ${lock.generatedAt}\n`));
+		if (entries.length === 0) {
+			console.log(picocolors.default.gray("  (no skills recorded)"));
+			return;
+		}
+		for (const [skillKey, entry] of entries) {
+			const fileCount = Object.keys(entry.files).length;
+			console.log(`  ${picocolors.default.bold(skillKey.padEnd(40))} ${picocolors.default.gray(entry.ref.padEnd(24))} ${fileCount} file${fileCount === 1 ? "" : "s"}`);
+		}
+		console.log(picocolors.default.gray(`\n  ${entries.length} skill(s) total`));
+	}
+};
+//#endregion
 //#region src/commands/upgrade.ts
 /**
 * Command for upgrading the `agent-skills-standard` CLI to the latest version.
@@ -4997,7 +5752,7 @@ var UpgradeCommand = class {
 	async run(options) {
 		console.log(picocolors.default.cyan("🔍 Checking for updates..."));
 		const currentVersion = this.currentVersion;
-		let latestVersion = null;
+		let latestVersion;
 		try {
 			latestVersion = (0, child_process.execSync)("npm view agent-skills-standard version", { encoding: "utf8" }).trim();
 		} catch {
@@ -5031,7 +5786,8 @@ var UpgradeCommand = class {
 				(0, child_process.execSync)(upgradeCmd, { stdio: "inherit" });
 			} catch {
 				console.log(picocolors.default.yellow(`⚠️  Failed to install v${latestVersion}. Retrying with @latest...`));
-				(0, child_process.execSync)(this.getUpgradeCommand(pm, "latest"), { stdio: "inherit" });
+				const fallbackCmd = this.getUpgradeCommand(pm, "latest");
+				(0, child_process.execSync)(fallbackCmd, { stdio: "inherit" });
 			}
 			if (pm === "pnpm") {
 				const installedVersion = this.getInstalledVersionFromPnpm(latestVersion);
@@ -5252,11 +6008,88 @@ var SkillDiscoveryService = class {
 	}
 };
 //#endregion
+//#region src/schemas/skill-frontmatter.ts
+/**
+* Optional Universal-Skill-Format-style fields a SKILL.md's frontmatter may
+* declare, per the OWASP Agentic Skills Top 10 (AST03 least-privilege
+* manifests / AST04 schema validation). All optional and additive: the
+* existing 281-skill corpus has none of these today and stays valid without
+* modification. `FrontmatterRule` validates whichever of these a skill
+* chooses to declare; nothing here is enforced yet by the sync/transform
+* pipeline — that's tracked as follow-up work (see docs/SECURITY.md's AST
+* table, AST03).
+*/
+var RISK_TIERS = [
+	"L0",
+	"L1",
+	"L2",
+	"L3"
+];
+var SEMVER_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+var SHA256_RE = /^sha256:[0-9a-f]{64}$/;
+var skillPermissionsSchema = zod.z.object({
+	network: zod.z.object({ allow: zod.z.array(zod.z.string()).default([]) }).strict().optional(),
+	filesystem: zod.z.object({ deny: zod.z.array(zod.z.string()).default([]) }).strict().optional(),
+	exec: zod.z.boolean().optional()
+}).strict();
+var skillSignatureSchema = zod.z.object({
+	alg: zod.z.literal("ed25519"),
+	keyid: zod.z.string().min(1),
+	sig: zod.z.string().min(1)
+}).strict();
+/**
+* One upstream dependency a skill (or, in skills/metadata.json, a category)
+* tracks for freshness auditing. `source: github` needs a `repo`;
+* `source: manual` is checked only by its `reviewed` age.
+* See docs/FRESHNESS.md.
+*/
+var upstreamEntrySchema = zod.z.object({
+	name: zod.z.string().min(1),
+	source: zod.z.enum(["github", "manual"]),
+	repo: zod.z.string().regex(/^[\w.-]+\/[\w.-]+$/, "repo must be \"owner/name\"").optional(),
+	pinned: zod.z.string().min(1),
+	tag_pattern: zod.z.string().min(1).optional(),
+	reviewed: zod.z.string().regex(/^\d{4}-\d{2}-\d{2}$/, "reviewed must be YYYY-MM-DD"),
+	acknowledged: zod.z.string().min(1).optional()
+}).strict().refine((e) => e.source !== "github" || Boolean(e.repo), {
+	message: "repo is required when source is \"github\"",
+	path: ["repo"]
+});
+/**
+* Validates only the *optional, additive* Universal-Skill-Format fields.
+* `name`/`description` (required, with legacy hand-rolled error messages)
+* are validated separately in FrontmatterRule to preserve exact wording an
+* existing test suite and tooling depend on.
+*/
+var optionalSkillFieldsSchema = zod.z.object({
+	version: zod.z.string().regex(SEMVER_RE, "version must be a semver string (e.g. \"1.0.0\")").optional(),
+	risk_tier: zod.z.enum(RISK_TIERS, { error: `risk_tier must be one of ${RISK_TIERS.join(", ")}` }).optional(),
+	"allowed-tools": zod.z.union([zod.z.string(), zod.z.array(zod.z.string())]).optional(),
+	permissions: skillPermissionsSchema.optional(),
+	content_hash: zod.z.string().regex(SHA256_RE, "content_hash must match \"sha256:<64 hex chars>\"").optional(),
+	signature: skillSignatureSchema.optional(),
+	/**
+	* `metadata` also carries `triggers` (validated by TriggersRule) — passthrough
+	* keeps those keys intact while `upstream` gets schema-checked here.
+	*/
+	metadata: zod.z.object({ upstream: zod.z.array(upstreamEntrySchema).optional() }).passthrough().optional()
+});
+/**
+* L2/L3 declare meaningfully elevated capability (exec, broad network) — if
+* a skill claims that tier it should also say what it needs via
+* `permissions`, otherwise the tier declaration is decorative.
+*/
+function validateRiskTierNeedsPermissions(fields) {
+	if ((fields.risk_tier === "L2" || fields.risk_tier === "L3") && !fields.permissions) return `risk_tier ${fields.risk_tier} should declare a permissions block`;
+	return null;
+}
+//#endregion
 //#region src/services/validation/rules.ts
 /**
 * Enforces a maximum line count for skill files to ensure token efficiency.
 */
 var SizeRule = class {
+	maxLines;
 	name = "Size Limit";
 	constructor(maxLines = 100) {
 		this.maxLines = maxLines;
@@ -5276,7 +6109,15 @@ var SizeRule = class {
 	}
 };
 /**
-* Validates frontmatter presence and required fields.
+* Validates frontmatter presence, required fields, and — for any of the
+* optional Universal-Skill-Format fields a skill chooses to declare
+* (version, risk_tier, allowed-tools, permissions, content_hash, signature)
+* — their shape, via cli/src/schemas/skill-frontmatter.ts.
+*
+* Uses a real YAML parse (`yaml.load`) rather than substring `includes()`
+* checks, so e.g. a body line that happens to contain the text `name:`
+* cannot be mistaken for the frontmatter field, and a malformed YAML block
+* is reported instead of silently passing.
 */
 var FrontmatterRule = class {
 	name = "Frontmatter";
@@ -5292,20 +6133,35 @@ var FrontmatterRule = class {
 			errors: ["Missing or invalid frontmatter"],
 			warnings: []
 		};
-		const frontmatter = frontmatterMatch[1];
-		if (!frontmatter.includes("name:")) {
+		let parsed;
+		try {
+			parsed = js_yaml.load(frontmatterMatch[1]);
+		} catch {
+			return {
+				passed: false,
+				errors: ["Invalid YAML frontmatter"],
+				warnings: []
+			};
+		}
+		const fm = parsed && typeof parsed === "object" ? parsed : {};
+		if (typeof fm.name !== "string" || fm.name.length === 0) {
 			result.errors.push("Missing \"name\" field in frontmatter");
 			result.passed = false;
 		}
-		if (!frontmatter.includes("description:")) {
+		if (typeof fm.description !== "string" || fm.description.length === 0) {
 			result.errors.push("Missing \"description\" field in frontmatter");
 			result.passed = false;
+		} else if (fm.description.length > 1024) {
+			result.errors.push(`Description too long (${fm.description.length} chars > 1024 limit)`);
+			result.passed = false;
+		} else if (fm.description.length > 300) result.warnings.push(`Description is ${fm.description.length} chars (> 300); trim for _INDEX.md readability`);
+		const optionalParse = optionalSkillFieldsSchema.safeParse(fm);
+		if (!optionalParse.success) {
+			for (const issue of optionalParse.error.issues) result.errors.push(`${issue.path.join(".")}: ${issue.message}`);
+			result.passed = false;
 		} else {
-			const descMatch = frontmatter.match(/description:\s*(.+)/);
-			if (descMatch && descMatch[1].length > 1024) {
-				result.errors.push(`Description too long (${descMatch[1].length} chars > 1024 limit)`);
-				result.passed = false;
-			} else if (descMatch && descMatch[1].length > 300) result.warnings.push(`Description is ${descMatch[1].length} chars (> 300); trim for _INDEX.md readability`);
+			const tierWarning = validateRiskTierNeedsPermissions(optionalParse.data);
+			if (tierWarning) result.warnings.push(tierWarning);
 		}
 		return result;
 	}
@@ -5358,6 +6214,7 @@ var CANONICAL_PRIORITY_LABELS = {
 * is 'error', that its label matches the canonical vocabulary.
 */
 var PriorityRule = class {
+	labelSeverity;
 	name = "Priority Section";
 	constructor(labelSeverity = "warning") {
 		this.labelSeverity = labelSeverity;
@@ -5405,7 +6262,7 @@ var TriggersRule = class {
 		};
 		let parsed;
 		try {
-			parsed = js_yaml.default.load(frontmatterMatch[1]);
+			parsed = js_yaml.load(frontmatterMatch[1]);
 		} catch {
 			return {
 				passed: false,
@@ -5443,12 +6300,15 @@ var DirectoryStructureRule = class {
 		const scriptsDir = path.default.join(skillDir, "scripts");
 		if (await fs_extra.default.pathExists(scriptsDir)) {
 			const scriptFiles = await fs_extra.default.readdir(scriptsDir);
-			for (const file of scriptFiles) if (![
-				".py",
-				".js",
-				".ts",
-				".sh"
-			].includes(path.default.extname(file))) result.warnings.push(`Script without standard extension: ${file}`);
+			for (const file of scriptFiles) {
+				if ((await fs_extra.default.stat(path.default.join(scriptsDir, file))).isDirectory()) continue;
+				if (![
+					".py",
+					".js",
+					".ts",
+					".sh"
+				].includes(path.default.extname(file))) result.warnings.push(`Script without standard extension: ${file}`);
+			}
 		}
 		const refsDir = path.default.join(skillDir, "references");
 		if (await fs_extra.default.pathExists(refsDir)) {
@@ -5550,7 +6410,7 @@ var SkillValidator = class {
 				console.log(picocolors.default.green(`✅ Category metadata valid: ${category} (v${catConfig.version}, ${catConfig.tag_prefix})`));
 			}
 		} catch (error) {
-			throw new Error(`Metadata validation failed: ${error instanceof Error ? error.message : error}`);
+			throw new Error(`Metadata validation failed: ${error instanceof Error ? error.message : error}`, { cause: error });
 		}
 	}
 	generateSummary() {
@@ -5597,6 +6457,50 @@ var ValidateCommand = class {
 	}
 };
 //#endregion
+//#region src/commands/verify.ts
+/**
+* Command that checks installed skill files against .skills-lock.json,
+* catching drift between what `ags sync` fetched and what's actually on
+* disk — a tampered file, a partial write, or a manual edit.
+*/
+var VerifyCommand = class {
+	configService;
+	syncService;
+	constructor(configService, syncService) {
+		this.configService = configService || new ConfigService();
+		this.syncService = syncService || new SyncService();
+	}
+	async run(options = {}) {
+		const config = await this.configService.loadConfig();
+		if (!config) {
+			console.log(picocolors.default.red("❌ Error: .skillsrc not found. Run `init` first."));
+			process.exitCode = 1;
+			return;
+		}
+		const { agent, result } = await this.syncService.verifyLockfile(config, options.agent);
+		if (!agent) {
+			console.log(picocolors.default.red(`❌ ${result.missing.join(", ")}`));
+			process.exitCode = 1;
+			return;
+		}
+		console.log(picocolors.default.cyan(`🔍 Verifying skills installed for ${agent}...`));
+		if (result.ok) {
+			console.log(picocolors.default.green("✅ All installed skill files match the lockfile."));
+			return;
+		}
+		if (result.missing.length > 0) {
+			console.log(picocolors.default.red(`\n❌ Missing (${result.missing.length}):`));
+			for (const m of result.missing) console.log(picocolors.default.red(`  - ${m}`));
+		}
+		if (result.mismatches.length > 0) {
+			console.log(picocolors.default.red(`\n❌ Content mismatch (${result.mismatches.length}):`));
+			for (const m of result.mismatches) console.log(picocolors.default.red(`  - ${m}`));
+		}
+		console.log(picocolors.default.yellow("\nRun `ags sync` to restore the registry version, or investigate why these files diverged."));
+		process.exitCode = 1;
+	}
+};
+//#endregion
 //#region src/index.ts
 dotenv.default.config();
 var _agsExecPath = process.argv[1] ?? "";
@@ -5609,6 +6513,12 @@ program.command("init").description("Initialize a .skillsrc configuration file i
 program.command("sync").description("Sync skills to AI Agent skill directories").option("-y, --yes", "Automatically confirm interactive prompts (e.g. update versions)").option("--snippets", "Generate JSON config snippets in ./mcp-config-snippets/; if MCP is disabled, run snippet-only mode").action(async (options) => {
 	await new SyncCommand().run(options);
 });
+program.command("verify").description("Check installed skill files against .skills-lock.json (catches tampering, partial writes, or manual drift)").option("--agent <agent>", "Which agent skill directory to verify (default: first configured agent)").action(async (options) => {
+	await new VerifyCommand().run(options);
+});
+program.command("audit").description("Print the installed skill inventory recorded in .skills-lock.json").action(async () => {
+	await new AuditCommand().run();
+});
 program.command("list-skills").description("List available framework skills and detection status").option("-f, --framework <framework>", "The framework to list skills for").action(async (options) => {
 	await new ListSkillsCommand().run(options);
 });
@@ -5626,8 +6536,8 @@ program.command("mcp <action> [scope]").description("Manage the optional MCP ser
 	if (positional) merged.scope = opts.scope ?? positional;
 	await new McpCommand().run(action, merged);
 });
-program.command("hooks <action>").description("Manage the PreToolUse skill-loader hook. Actions: status | install | uninstall").action(async (action) => {
-	await new HooksCommand().run(action);
+program.command("hooks <action>").description("Manage the PreToolUse skill-loader hook. Actions: status | install | uninstall").option("--enforce", "With \"install\": Claude blocks (does not just remind) edits to SOUL.md, MEMORY.md, .env*, .ssh/, credentials*.json|yaml").action(async (action, options) => {
+	await new HooksCommand().run(action, options);
 });
 program.command("evals <action>").description("Verify or display live skill-eval runs. Actions: verify | report").option("--run <runId>", "For verify: check a single run id instead of all committed runs").action(async (action, opts) => {
 	await new EvalsCommand().run(action, opts);