coding-agent-skills 0.2.10 → 0.2.12

package/scripts/validate-pack.mjs

@@ -97,6 +97,8 @@ const requiredRootFiles = [
   "scripts/render-adapter-repo-map.mjs",
   "scripts/render-route-trace.mjs",
   "scripts/render-env-audit.mjs",
+  "scripts/render-secret-audit.mjs",
+  "scripts/render-api-contract-audit.mjs",
   "scripts/check-adapter-upgrade.mjs",
   "scripts/check-adapter-upgrade-chain.mjs",
   "scripts/validate-adapters.mjs",
@@ -104,6 +106,8 @@ const requiredRootFiles = [
   "scripts/lib/adapter-repo-map.mjs",
   "scripts/lib/route-trace.mjs",
   "scripts/lib/env-audit.mjs",
+  "scripts/lib/secret-audit.mjs",
+  "scripts/lib/api-contract-audit.mjs",
   "scripts/lib/adapter-upgrade.mjs",
   "scripts/lib/adapter-upgrade-chain.mjs",
   "scripts/lib/adapter-discovery.mjs",
@@ -677,8 +681,8 @@ if (packageJson) {
   if (packageJson.name !== "coding-agent-skills") {
     failures.push("package.json has unexpected package name");
   }
-  if (packageJson.version !== "0.2.10") {
-    failures.push("package.json version must be 0.2.10 for public package validation");
+  if (packageJson.version !== "0.2.12") {
+    failures.push("package.json version must be 0.2.12 for public package validation");
   }
   if (packageJson.type !== "module") failures.push("package.json must preserve ESM mode");
   if (packageJson.private !== false) {
@@ -698,6 +702,8 @@ if (packageJson) {
       "repo-map",
       "route-trace",
       "env-audit",
+      "secret-audit",
+      "api-contract-audit",
       "project-adapters",
       "code-validation",
       "cli",

package/skills/api-contract-audit/SKILL.md

@@ -0,0 +1,85 @@
+---
+name: api-contract-audit
+description: Audit statically visible API contract surfaces without running servers, calling APIs, generating schemas, or modifying projects. Use when Codex must map OpenAPI or Swagger files, route handler declarations, client request patterns, and schema/type files before API work or handoff; do not use for runtime verification, network probing, code generation, builds, tests, deployments, migrations, or secret-file reads.
+---
+
+# API Contract Audit
+
+Map statically visible API contract evidence and report what is and is not verified. Remain audit-only and avoid turning contract discovery into runtime validation.
+
+This skill must not change project files, Git state, dependencies, runtime state, services,
+databases, remotes, generated clients, schemas, or deployment state.
+
+## Purpose And Use
+
+Use this skill before API work, integration handoff, or contract review when the agent needs
+to understand visible API contracts from source, docs, route handlers, client calls, and
+schema/type files.
+
+Do not use it to prove deployed behavior, call endpoints, generate clients, generate
+schemas, run validators, build, test, migrate, deploy, inspect databases, or read secrets.
+
+## Inputs
+
+Require a project root or starting path. Optionally accept a project adapter, intended scan
+area, documentation precedence, contract-file hints, or known static API boundaries.
+
+Do not assume a missing contract file means no API exists, static route declarations match
+runtime behavior, client calls cover all server routes, generated clients are current, or a
+project adapter enables this skill unless validation proves it.
+
+## Procedure
+
+1. Record user intent, project root, declared scope, adapter state, and safety boundary.
+2. Validate a project adapter when present before reading adapter-declared metadata.
+3. If an adapter is present but does not enable `api-contract-audit`, stop static file
+   reading and report the adapter-limited skip.
+4. Build scan scope from adapter safe read paths when available; otherwise use a bounded
+   generic static scan.
+5. Exclude `.env`, secret-bearing files, generated output, dependency paths, and oversized
+   files before reading.
+6. Identify statically visible OpenAPI/Swagger or API contract files.
+7. Identify route handler declarations and contract path/method declarations from static text.
+8. Identify client request call patterns and schema/type files.
+9. Report skipped items, not-verified runtime surfaces, warnings, and safety refusals.
+10. Emit the shared evidence pack or API contract audit report before claiming completion.
+
+Use [checklist.md](checklist.md). Consult [failure-modes.md](failure-modes.md),
+[adapter-interface.md](adapter-interface.md), and [examples.md](examples.md). Format findings
+with [evidence-template.md](evidence-template.md).
+
+## Evidence, Recovery, And Dependencies
+
+Emit repository identity, adapter state, scan scope, ignored paths, files scanned, contract
+files, endpoint declarations, client-call patterns, schema/type files, skipped items,
+not-verified areas, warnings, and changed-state declaration through the shared evidence-pack
+contract.
+
+Recover from missing specs, ambiguous route declarations, unreadable files, or adapter
+limits by reporting uncertainty. Never recover by running a server, calling an endpoint,
+generating a client, generating schemas, installing dependencies, building, testing,
+deploying, migrating, broadening adapter scope, or reading `.env`.
+
+This skill depends on the evidence-pack contract and may consume validated project adapters.
+Adapters may add safe paths, ignored paths, documentation precedence, and evidence
+requirements, but cannot weaken policy or turn this skill into runtime or generation work.
+
+## Approval Boundary
+
+Explicit approval may permit one named non-secret static file read outside normal source
+paths. Approval does not permit `.env` or secret-file reads, URL probes, API calls, schema
+generation, client generation, package installation, builds, tests, runtime checks,
+deployments, migrations, Git mutation, or project writes.
+
+## Completion
+
+Claim `complete` only when the declared static scan scope was inspected, visible contract
+surfaces are reported, skipped and not-verified areas are explicit, adapter limitations are
+clear, and no project, Git, dependency, runtime, service, remote, generated-code, or
+deployment state changed.
+
+Report `partial`, `failed`, or `blocked` when adapter scope prevents scanning, requested
+evidence requires runtime or network behavior, the project root cannot be established, or
+safety exclusions prevent the requested conclusion.
+
+These conditions are both the acceptance criteria and definition of done.

package/skills/api-contract-audit/adapter-interface.md

@@ -0,0 +1,16 @@
+Adapters may enable `api-contract-audit` only as an audit-only static inspection skill.
+
+Allowed adapter extensions:
+
+- `safeReadPaths` for source, docs, contract, schema, and client files.
+- `ignoredPaths` for generated, dependency, build, coverage, and output directories.
+- `documentationPrecedence` for API docs or contract references.
+- `requiredEvidence` for contract files, route declarations, client calls, schemas, and not-verified areas.
+
+Adapters must not:
+
+- Add commands for `api-contract-audit`.
+- Require runtime servers, URL probes, API calls, schema generation, or client generation.
+- Include `.env`, credential, or secret-bearing paths.
+- Change `api-contract-audit` from `audit-only` to action-capable.
+- Expand scope outside the declared project root without named approval.

package/skills/api-contract-audit/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "API Contract Audit"
+  short_description: "Map static API contract surfaces without runtime calls"
+  default_prompt: "Audit static API contract surfaces in this repository without changing project state. Do not run servers, call APIs, generate clients or schemas, read .env files, or run builds/tests."

package/skills/api-contract-audit/checklist.md

@@ -0,0 +1,7 @@
+- Confirm the project root and declared static scope.
+- Validate any project adapter before reading adapter metadata.
+- Stop with `partial` if an adapter is present but does not enable `api-contract-audit`.
+- Exclude `.env`, secret-bearing, dependency, generated, output, and oversized files.
+- Report contract files, endpoint declarations, client calls, and schema/type files.
+- Record not-verified runtime, deployment, database, auth, and semantic equivalence gaps.
+- Declare that no build, test, runtime, URL probe, API call, generation, deployment, migration, package install, secret read, or write occurred.

package/skills/api-contract-audit/evidence-template.md

@@ -0,0 +1,13 @@
+- Skill: `api-contract-audit`
+- Status: `complete`, `partial`, `failed`, or `blocked`
+- Project root and branch state
+- Adapter present/enabled state
+- Scope paths and ignored paths
+- Files scanned
+- Contract files found
+- Endpoint declarations found
+- Client-call patterns found
+- Schema/type files found
+- Skipped items and reasons
+- Not-verified runtime, deployment, database, auth, generation, and semantic-equivalence gaps
+- Changed-state declaration: no project, Git, dependency, runtime, service, remote, generated-code, or deployment state changed

package/skills/api-contract-audit/examples.md

@@ -0,0 +1,20 @@
+Safe examples:
+
+```bash
+coding-agent-skills api-contract-audit /workspace/app
+```
+
+```bash
+node scripts/render-api-contract-audit.mjs tests/fixtures/api-contract-audit/static-project
+```
+
+Expected result: a report listing static contract files, endpoint declarations, client call
+patterns, schema/type files, skipped paths, not-verified runtime behavior, and refused
+actions.
+
+## Unsafe Examples
+
+- Start the API server to verify contract behavior.
+- Call `/api/*` endpoints or remote URLs.
+- Generate an OpenAPI spec or client.
+- Read `.env`, credentials, service keys, or private runtime config.

package/skills/api-contract-audit/failure-modes.md

@@ -0,0 +1,5 @@
+- Adapter present but missing `api-contract-audit`: report `partial` and read no target files.
+- No contract file found: report the absence as static evidence, not proof that no API exists.
+- Route declarations are dynamic: record not-verified runtime behavior.
+- Client calls use variables or generated clients: report the limitation without executing code.
+- Requested proof requires runtime, network, database, generation, build, test, or secret access: stop or report blocked.

package/skills/secret-audit/SKILL.md

@@ -0,0 +1,57 @@
+---
+name: secret-audit
+description: Find high-confidence secret exposure risks in static tracked files without printing matched values. Use when Codex must identify possible token, key, credential, or private-key exposure by file path and count before handoff or cleanup; do not use for reading .env files, credential stores, rotation, validation, API calls, builds, tests, deployments, migrations, or mutation.
+---
+
+# Secret Audit
+
+Identify high-confidence secret-like patterns from bounded static evidence and emit a redacted report. Remain audit-only and fail closed when evidence would require reading secret files or printing values.
+
+This skill must not change project files, Git state, dependencies, runtime state, services,
+databases, remotes, or deployment state.
+
+## Purpose And Use
+
+Use this skill to find possible tracked secret exposure by file path, pattern type, and count before handoff, publication, or cleanup. It can report suspicious files and categories, but it must not print matched values or claim whether a credential is active.
+
+Do not use this skill for credential validation, token rotation, secret-store inspection, runtime truth claims, deployment readiness, migrations, builds, tests, or package installation.
+
+## Inputs
+
+Require a project root or starting path. Optionally accept a project adapter, intended scan area, maximum static scan depth, or known synthetic fixture allowance.
+
+Do not assume ignored secret files may be read, high-confidence patterns prove exploitability, absence of findings proves absence of secrets, package contents match Git contents, or a project adapter covers every exposure surface.
+
+## Procedure
+
+1. Record user intent, project root, declared scope, adapter state, and safety boundary.
+2. Validate a project adapter when present before reading adapter-declared metadata.
+3. If an adapter is present but does not enable `secret-audit`, stop static file reading and report the adapter-limited skip.
+4. Build scan scope from adapter safe read paths when available; otherwise use a bounded generic static scan.
+5. Exclude `.env`, `.env.*` except deliberate `.env.example`, secret-bearing paths, generated paths, dependency paths, and oversized files before reading.
+6. Scan safe static text files for high-confidence secret-like shapes.
+7. Report only file path, finding type, and count. Never print matched values, snippets, tokens, credentials, or raw secret-like content.
+8. Label findings, skipped items, not-verified areas, warnings, and safety refusals.
+9. Emit the shared evidence pack or secret-audit report before claiming completion.
+
+Use [checklist.md](checklist.md). Consult [failure-modes.md](failure-modes.md), [adapter-interface.md](adapter-interface.md), and [examples.md](examples.md). Format findings with [evidence-template.md](evidence-template.md).
+
+## Evidence, Recovery, And Dependencies
+
+Emit repository identity, adapter state, scan scope, ignored paths, files scanned, finding path/type/count, skipped items, not-verified areas, warnings, and changed-state declaration through the shared evidence-pack contract.
+
+Recover from missing adapters, unreadable files, ambiguous patterns, or secret-bearing paths by narrowing scope and reporting uncertainty. Never recover by reading `.env`, printing values, validating credentials, rotating tokens, contacting APIs, installing dependencies, running builds/tests, broadening adapter scope, or mutating files.
+
+This skill depends on the evidence-pack contract and may consume validated project adapters. Adapters may add safe paths, ignored paths, documentation precedence, and evidence requirements, but cannot weaken policy or turn this skill into credential handling.
+
+## Approval Boundary
+
+Explicit approval may permit one named non-secret static file read outside normal source paths. Approval does not permit `.env` or secret-file reads, value printing, credential validation, token rotation, API calls, builds, tests, package installation, runtime checks, deployments, migrations, Git mutation, or project writes.
+
+## Completion
+
+Claim `complete` only when the declared static scan scope was inspected, all findings are path/type/count only, skipped and not-verified areas are recorded with consequences, adapter limitations are explicit, and no project, Git, dependency, runtime, service, or remote state changed.
+
+Report `partial`, `failed`, or `blocked` when adapter scope prevents scanning, requested evidence requires secret files or credential stores, the project root cannot be established, or safety exclusions prevent a requested conclusion. Never claim credential validity, revocation, or full absence of secrets from static findings alone.
+
+These conditions are both the acceptance criteria and definition of done.

package/skills/secret-audit/adapter-interface.md

@@ -0,0 +1,12 @@
+Adapters may enable `secret-audit` by declaring the skill ID with unchanged `audit-only`
+mode and compatible version `0.2.3` or `0.2.x`.
+
+Useful extension fields:
+
+- `safeReadPaths`: source, docs, sample, and config paths safe for static pattern scanning.
+- `ignoredPaths`: generated, dependency, runtime-output, and secret-bearing paths to skip.
+- `documentationPrecedence`: docs that explain known synthetic fixtures or report policy.
+- `requiredEvidence`: evidence the report must include before completion.
+
+Adapters must not add `.env`, credentials, secret stores, credential API calls, rotation,
+builds, tests, deployments, migrations, or project writes.

package/skills/secret-audit/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Secret Audit"
+  short_description: "Find secret exposure risks without printing values"
+  default_prompt: "Audit high-confidence secret exposure risks in this repository without changing project state. Do not read .env files, print matched values, or rotate credentials."

package/skills/secret-audit/checklist.md

@@ -0,0 +1,7 @@
+- Confirm project root, branch state, and adapter state.
+- Validate adapter before consuming any adapter-declared paths.
+- Refuse `.env`, `.env.*` except `.env.example`, secret-bearing paths, and generated outputs.
+- Scan only bounded static text files.
+- Record file path, finding type, and count only.
+- Record skipped files and secret stores/history that were not verified.
+- Confirm no files, dependencies, runtime state, services, remotes, or databases changed.

package/skills/secret-audit/evidence-template.md

@@ -0,0 +1,15 @@
+## Secret Audit Evidence
+
+- Repository root:
+- Branch state:
+- Adapter state:
+- Scan scope:
+- Ignored paths:
+- Static files scanned:
+- Finding paths:
+- Finding types:
+- Finding counts:
+- Skipped items:
+- Not verified:
+- Safety refusals:
+- Changed state: none

package/skills/secret-audit/examples.md

@@ -0,0 +1,27 @@
+## Safe
+
+```bash
+coding-agent-skills secret-audit /workspace/app
+```
+
+Reports possible secret exposure by path, type, and count only.
+
+```bash
+node scripts/render-secret-audit.mjs tests/fixtures/secret-audit/static-project
+```
+
+Runs the synthetic fixture scanner without reading `.env` files or printing matches.
+
+## Unsafe
+
+```bash
+cat .env
+```
+
+Secret-file reads are forbidden.
+
+```bash
+gh secret list
+```
+
+Credential-store and API inspection are outside this skill.

package/skills/secret-audit/failure-modes.md

@@ -0,0 +1,5 @@
+- **Adapter not enabled:** report `partial` and do not broaden target-project scanning.
+- **Secret-bearing path requested:** skip the file and record the safety exclusion.
+- **Synthetic test token needed:** generate it in a temporary test directory, never package it.
+- **Credential validation requested:** refuse and explain that only static path/count evidence is in scope.
+- **No findings:** report that no high-confidence matches were found in scanned files, not that the repo is secret-free.

package/tests/fixtures/api-contract-audit/adapter-project/.coding-agent/adapters/api-contract-audit-fixture/adapter.json

@@ -0,0 +1,53 @@
+{
+  "adapterId": "api-contract-audit-fixture",
+  "adapterVersion": "1.0.0",
+  "project": {
+    "id": "api-contract-audit-fixture",
+    "detection": {
+      "rootMarkers": [{"kind": "file", "path": "package.json"}],
+      "maximumDepth": 1,
+      "scope": "declared-project-root",
+      "requireApprovalOutsideScope": true
+    }
+  },
+  "supportedSkills": [
+    {
+      "id": "api-contract-audit",
+      "compatibleVersions": ["0.2.3", "0.2.x"],
+      "declaredMode": "audit-only"
+    }
+  ],
+  "extensions": {
+    "safeReadPaths": ["src"],
+    "ignoredPaths": ["dist", "build"],
+    "documentationPrecedence": ["README.md"],
+    "commandAliases": [],
+    "safeStatusCommands": [],
+    "requiredEvidence": ["project root", "adapter scope", "contract surfaces", "not-verified runtime areas"],
+    "expectedRuntimeManagers": [],
+    "expectedPackageManagers": ["npm"]
+  },
+  "approvalRequirements": [],
+  "inheritance": {
+    "sharedRestrictions": "required",
+    "deniedOperationCategories": [
+      "file-write",
+      "package-install",
+      "deployment",
+      "git-mutation",
+      "unrestricted-scan",
+      "secret-read",
+      "process-mutation",
+      "service-mutation",
+      "migration-apply",
+      "privileged-api"
+    ],
+    "allowRestrictionRemoval": false,
+    "allowModeOverride": false,
+    "allowFailureSuppression": false,
+    "allowCompletionOverride": false,
+    "allowSecretExposure": false,
+    "allowRequiredEvidenceRemoval": false,
+    "allowScopeExpansionWithoutApproval": false
+  }
+}

package/tests/fixtures/api-contract-audit/adapter-project/.coding-agent/skills.json

@@ -0,0 +1,23 @@
+{
+  "declarationVersion": "1.0.0",
+  "projectId": "api-contract-audit-fixture",
+  "adapterRoot": ".coding-agent/adapters",
+  "adapterSchemaVersion": "1.0.0",
+  "core": {
+    "id": "coding-agent-skills",
+    "expectedVersion": "0.2.3",
+    "versionPin": ">=0.2.2 <0.3.0"
+  },
+  "compatibleSkillIds": ["api-contract-audit"],
+  "adapters": [
+    {
+      "id": "api-contract-audit-fixture",
+      "version": "1.0.0",
+      "skillIds": ["api-contract-audit"]
+    }
+  ],
+  "validationCommand": "node <shared-core>/scripts/validate-project-adapters.mjs <project-root>",
+  "evidenceOutput": ".coding-agent/evidence",
+  "approvalPolicyReference": ".coding-agent/approval-policy.md",
+  "noSecrets": true
+}

package/tests/fixtures/api-contract-audit/adapter-project/README.md

@@ -0,0 +1,3 @@
+# API Contract Audit Adapter Fixture
+
+Synthetic adapter-scoped fixture.

package/tests/fixtures/api-contract-audit/adapter-project/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "api-contract-audit-adapter-fixture",
+  "type": "module"
+}

package/tests/fixtures/api-contract-audit/adapter-project/src/routes.ts

@@ -0,0 +1 @@
+router.get("/api/adapter-items", () => {});

package/tests/fixtures/api-contract-audit/static-project/README.md

@@ -0,0 +1,3 @@
+# API Contract Audit Static Fixture
+
+Synthetic fixture for static API contract discovery.

package/tests/fixtures/api-contract-audit/static-project/app/api/users/route.ts

@@ -0,0 +1,7 @@
+export async function GET() {
+  return Response.json([]);
+}
+
+export async function POST() {
+  return Response.json({ok: true});
+}

package/tests/fixtures/api-contract-audit/static-project/docs/openapi.yaml

@@ -0,0 +1,10 @@
+openapi: 3.1.0
+info:
+  title: Fixture API
+  version: 1.0.0
+paths:
+  /api/users:
+    get:
+      summary: List users
+    post:
+      summary: Create user

package/tests/fixtures/api-contract-audit/static-project/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "api-contract-audit-static-fixture",
+  "type": "module"
+}

package/tests/fixtures/api-contract-audit/static-project/schemas/user.schema.ts

@@ -0,0 +1,4 @@
+export interface UserDto {
+  id: string;
+  email: string;
+}

package/tests/fixtures/api-contract-audit/static-project/src/client.ts

@@ -0,0 +1,3 @@
+export async function loadUsers() {
+  return fetch("/api/users");
+}

package/tests/fixtures/secret-audit/adapter-project/.coding-agent/adapters/secret-audit-fixture/adapter.json

@@ -0,0 +1,53 @@
+{
+  "adapterId": "secret-audit-fixture",
+  "adapterVersion": "1.0.0",
+  "project": {
+    "id": "secret-audit-fixture",
+    "detection": {
+      "rootMarkers": [{"kind": "file", "path": "package.json"}],
+      "maximumDepth": 1,
+      "scope": "declared-project-root",
+      "requireApprovalOutsideScope": true
+    }
+  },
+  "supportedSkills": [
+    {
+      "id": "secret-audit",
+      "compatibleVersions": ["0.2.3", "0.2.x"],
+      "declaredMode": "audit-only"
+    }
+  ],
+  "extensions": {
+    "safeReadPaths": ["src"],
+    "ignoredPaths": ["dist", "build"],
+    "documentationPrecedence": ["README.md"],
+    "commandAliases": [],
+    "safeStatusCommands": [],
+    "requiredEvidence": ["project root", "adapter scope", "finding paths", "redaction statement"],
+    "expectedRuntimeManagers": [],
+    "expectedPackageManagers": ["npm"]
+  },
+  "approvalRequirements": [],
+  "inheritance": {
+    "sharedRestrictions": "required",
+    "deniedOperationCategories": [
+      "file-write",
+      "package-install",
+      "deployment",
+      "git-mutation",
+      "unrestricted-scan",
+      "secret-read",
+      "process-mutation",
+      "service-mutation",
+      "migration-apply",
+      "privileged-api"
+    ],
+    "allowRestrictionRemoval": false,
+    "allowModeOverride": false,
+    "allowFailureSuppression": false,
+    "allowCompletionOverride": false,
+    "allowSecretExposure": false,
+    "allowRequiredEvidenceRemoval": false,
+    "allowScopeExpansionWithoutApproval": false
+  }
+}

package/tests/fixtures/secret-audit/adapter-project/.coding-agent/skills.json

@@ -0,0 +1,23 @@
+{
+  "declarationVersion": "1.0.0",
+  "projectId": "secret-audit-fixture",
+  "adapterRoot": ".coding-agent/adapters",
+  "adapterSchemaVersion": "1.0.0",
+  "core": {
+    "id": "coding-agent-skills",
+    "expectedVersion": "0.2.3",
+    "versionPin": ">=0.2.3 <0.3.0"
+  },
+  "compatibleSkillIds": ["secret-audit"],
+  "adapters": [
+    {
+      "id": "secret-audit-fixture",
+      "version": "1.0.0",
+      "skillIds": ["secret-audit"]
+    }
+  ],
+  "validationCommand": "node <shared-core>/scripts/validate-project-adapters.mjs <project-root>",
+  "evidenceOutput": "validation-output/project-adapters.json",
+  "approvalPolicyReference": "docs/coding-agent-approval-policy.md",
+  "noSecrets": true
+}

package/tests/fixtures/secret-audit/adapter-project/README.md

@@ -0,0 +1,3 @@
+# Secret Audit Adapter Fixture
+
+This fixture narrows secret scanning to `src`.

package/tests/fixtures/secret-audit/adapter-project/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "fixture-secret-audit-adapter",
+  "type": "module"
+}

package/tests/fixtures/secret-audit/adapter-project/src/placeholder.ts

@@ -0,0 +1 @@
+export const placeholder = "safe-placeholder-only";

package/tests/fixtures/secret-audit/static-project/.env.example

@@ -0,0 +1 @@
+API_TOKEN=

package/tests/fixtures/secret-audit/static-project/README.md

@@ -0,0 +1,3 @@
+# Secret Audit Static Fixture
+
+This fixture intentionally contains no packaged secret-like values.

package/tests/fixtures/secret-audit/static-project/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "fixture-secret-audit-static",
+  "type": "module"
+}

package/tests/fixtures/secret-audit/static-project/src/config.ts

@@ -0,0 +1 @@
+export const placeholder = "replace-with-token-at-runtime";

package/tests/fixtures/triggers/cases.json

@@ -43,6 +43,30 @@
       "expectedSkill": "env-audit",
       "notSkills": ["build-verify", "deployment-preflight"]
     },
+    {
+      "id": "secret-audit-exposure",
+      "prompt": "Run a secret audit for hardcoded tokens and private keys without printing matched values.",
+      "expectedSkill": "secret-audit",
+      "notSkills": ["env-audit", "runtime-truth"]
+    },
+    {
+      "id": "secret-audit-tracked-secrets",
+      "prompt": "Check for tracked secret exposure in source files without reading .env or credential stores.",
+      "expectedSkill": "secret-audit",
+      "notSkills": ["repo-map", "build-verify"]
+    },
+    {
+      "id": "api-contract-audit-openapi",
+      "prompt": "Audit the OpenAPI file, endpoint declarations, client calls, and API schema files without running the server.",
+      "expectedSkill": "api-contract-audit",
+      "notSkills": ["route-trace", "runtime-truth"]
+    },
+    {
+      "id": "api-contract-audit-drift",
+      "prompt": "Map possible API contract drift between static route handlers and client calls before handoff.",
+      "expectedSkill": "api-contract-audit",
+      "notSkills": ["build-verify", "llm-drift-control"]
+    },
     {
       "id": "build-after-implementation",
       "prompt": "The implementation is finished. Run the existing typecheck, tests, and build.",
@@ -95,7 +119,7 @@
       "id": "negative-deploy",
       "prompt": "Deploy this application to production.",
       "expectedSkill": null,
-      "notSkills": ["repo-map", "route-trace", "env-audit", "build-verify", "git-preflight", "runtime-truth", "llm-drift-control"]
+      "notSkills": ["repo-map", "route-trace", "env-audit", "secret-audit", "api-contract-audit", "build-verify", "git-preflight", "runtime-truth", "llm-drift-control"]
     },
     {
       "id": "negative-install",

package/tests/trigger/README.md

@@ -6,6 +6,10 @@
 - Static route-surface tracing must trigger `route-trace`, not repository mapping or runtime truth.
 - Value-free environment variable mapping must trigger `env-audit`, not runtime truth or
   secret-value inspection.
+- Redacted high-confidence secret exposure detection must trigger `secret-audit`, not
+  environment variable mapping or runtime truth.
+- Static API contract mapping must trigger `api-contract-audit`, not runtime truth or
+  build verification.
 - Local validation must trigger `build-verify` only when project-native checks are requested.
 - Git readiness must trigger `git-preflight`, not publication.
 - Process/listener/health questions must trigger `runtime-truth`, not restart behavior.