coding-agent-skills 0.2.9 → 0.2.11

package/examples/evidence-packs/secret-audit.json

@@ -0,0 +1,55 @@
+{
+  "contractVersion": "1.0.0",
+  "skill": {"name": "secret-audit", "version": "0.2.3"},
+  "invocation": {
+    "id": "example-secret-audit",
+    "startedAt": "2026-07-03T11:00:00Z",
+    "endedAt": "2026-07-03T11:01:00Z"
+  },
+  "repository": {
+    "root": "/workspace/example-project",
+    "branch": "main",
+    "head": "0123456789abcdef",
+    "workingTreeState": "clean"
+  },
+  "userIntent": "Find possible tracked secret exposure before handoff.",
+  "declaredScope": ["/workspace/example-project"],
+  "projectAdapter": "example-secret-adapter",
+  "environmentSummary": {"platform": "linux", "shell": "bash"},
+  "status": "complete",
+  "confidence": {
+    "level": "high",
+    "reason": "Static files were scanned for high-confidence secret-like patterns with matched values omitted."
+  },
+  "commands": [
+    {
+      "command": "coding-agent-skills secret-audit /workspace/example-project",
+      "family": "secret-audit-renderer",
+      "workingDirectory": "/workspace/example-project",
+      "startedAt": "2026-07-03T11:00:20Z",
+      "endedAt": "2026-07-03T11:00:21Z",
+      "exitStatus": 0,
+      "resultStatus": "success",
+      "safetyClass": "allowed",
+      "approvalReference": null,
+      "purpose": "Render a redacted static secret-audit report.",
+      "outputSummary": "Reported finding paths, types, and counts without matched values."
+    }
+  ],
+  "skippedChecks": [],
+  "findings": [
+    {
+      "summary": "Potential secret exposure was reported by file path, type, and count only.",
+      "evidence": ["src/example.ts"]
+    }
+  ],
+  "risks": [],
+  "failures": [],
+  "unresolvedQuestions": [],
+  "changedState": {
+    "changed": false,
+    "summary": "No project, Git, dependency, runtime, service, or remote state changed."
+  },
+  "handoffSummary": "Secret-like findings require human review; matched values were omitted.",
+  "recommendedNextAction": "Review flagged files locally and rotate credentials only through approved project procedures."
+}

package/examples/manifests/env-audit.json

@@ -0,0 +1,14 @@
+{
+  "name": "env-audit",
+  "version": "0.2.3",
+  "mode": "audit-only",
+  "evidenceContract": "../../contracts/evidence-pack/evidence-pack.schema.json",
+  "commandPolicy": "../command-policies/env-audit.json",
+  "adapterSchema": "../../schemas/project-adapter.schema.json",
+  "adapterCompatibility": {
+    "contractVersion": "1.0.0",
+    "compatibleAdapterVersions": ["1.0.0"]
+  },
+  "adapterInterface": "../../skills/env-audit/adapter-interface.md",
+  "description": "Identify environment variable names without reading values."
+}

package/examples/manifests/secret-audit.json

@@ -0,0 +1,14 @@
+{
+  "name": "secret-audit",
+  "version": "0.2.3",
+  "mode": "audit-only",
+  "evidenceContract": "../../contracts/evidence-pack/evidence-pack.schema.json",
+  "commandPolicy": "../command-policies/secret-audit.json",
+  "adapterSchema": "../../schemas/project-adapter.schema.json",
+  "adapterCompatibility": {
+    "contractVersion": "1.0.0",
+    "compatibleAdapterVersions": ["1.0.0"]
+  },
+  "adapterInterface": "../../skills/secret-audit/adapter-interface.md",
+  "description": "Find high-confidence secret exposure risks without printing values."
+}

package/examples/workflows/env-audit.md

@@ -0,0 +1,16 @@
+# Env Audit Workflow
+
+Use `env-audit` before editing setup docs, config loaders, or handoff notes:
+
+```bash
+coding-agent-skills env-audit /workspace/project
+```
+
+Review:
+
+- names and classifications
+- sample files inspected
+- skipped secret-bearing paths
+- runtime and credential stores not verified
+
+Do not use the output as proof that values exist or credentials work.

package/examples/workflows/secret-audit.md

@@ -0,0 +1,10 @@
+# Secret Audit Workflow
+
+Use `secret-audit` before handoff or publication:
+
+```bash
+coding-agent-skills secret-audit /workspace/project
+```
+
+Review file paths, types, counts, skipped secret-bearing paths, and not-verified stores.
+Do not ask the tool to print matched values or rotate credentials.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coding-agent-skills",
-  "version": "0.2.9",
+  "version": "0.2.11",
   "description": "Evidence-first, read-only coding-agent skills and project adapter tooling.",
   "type": "module",
   "private": false,
@@ -10,6 +10,8 @@
     "agent-skills",
     "repo-map",
     "route-trace",
+    "env-audit",
+    "secret-audit",
     "project-adapters",
     "code-validation",
     "cli"

package/runs/skill-runs.md

@@ -186,4 +186,30 @@ This file records bounded maintainer-loop runs. Entries must not contain secrets
 - Validation commands: `git diff --check`; `bin/coding-agent-skills validate-pack`; `bin/coding-agent-skills validate-adapters tests/fixtures/external-adapters/valid-basic`; `bin/coding-agent-skills validate-project /home/oneclickwebsitedesignfactory/tax-lien-platform`; `bin/coding-agent-skills repo-map /home/oneclickwebsitedesignfactory/tax-lien-platform`; `bin/coding-agent-skills route-trace tests/fixtures/route-trace/static-project`; `bin/coding-agent-skills route-trace /home/oneclickwebsitedesignfactory/tax-lien-platform`; `node scripts/validate-pack.mjs .`; `node scripts/test-pack.mjs`; `node scripts/validate-maintainer-loop.mjs .`; `node --test`; JSON parsing; package secret scan; npm publish dry-run; tarball install smoke.
 - Validation result: pass pending final commit, tag, publication, registry smoke, npm exec, and GitHub Release evidence.
 - Real project smoke: `/home/oneclickwebsitedesignfactory/tax-lien-platform` remained repo-map-only for adapters, so route-trace reported `partial` and did not read target project route files.
+
+## implementation-v0.2.10-env-audit
+
+- Run ID: `implementation-v0.2.10-env-audit`
+- Repository: `/home/oneclickwebsitedesignfactory/coding-agent-skills`
+- Command used: `builder-mode approval for env-audit-skill implementation and release`
+- Files changed: `env-audit` skill, env-audit renderer and library, CLI wrapper, adapter schemas, pack rules, release tests, synthetic env fixtures, usage/release/safety/adapter docs, changelog, roadmap, work ledger, run log, and package metadata.
+- Safety boundary: read-only, static-analysis only, no `.env` reads, no value printing, no credential validation, no API calls, no builds, no tests in target projects, no deploys, no migrations, and no target-project mutation.
+- Validation commands: pending final release validation matrix.
+- Result: pass pending final publication evidence.
+- Commit/tag/push status: pending approved release workflow.
+
+## implementation-v0.2.11-secret-audit
+
+- Run ID: `implementation-v0.2.11-secret-audit`
+- Repository: `/home/oneclickwebsitedesignfactory/coding-agent-skills`
+- Command used: `builder-mode approval for secret-audit-skill implementation and release`
+- Files changed: `secret-audit` skill, secret-audit renderer and library, CLI wrapper,
+  adapter schemas, pack rules, release tests, synthetic secret fixtures, usage/release/
+  safety/adapter docs, changelog, roadmap, work ledger, run log, and package metadata.
+- Safety boundary: read-only, static-analysis only, no `.env` reads, no secret-file
+  reads, no matched value printing, no credential validation or rotation, no API calls,
+  no builds, no tests in target projects, no deploys, no migrations, and no
+  target-project mutation.
+- Validation commands: pending final release validation matrix.
+- Result: pass pending final publication evidence.
 - Commit/tag/push status: pending approved release workflow.

package/schemas/project-adapter-installation.schema.json

@@ -66,6 +66,8 @@
         "enum": [
           "repo-map",
           "route-trace",
+          "env-audit",
+          "secret-audit",
           "build-verify",
           "git-preflight",
           "runtime-truth",
@@ -99,6 +101,8 @@
               "enum": [
               "repo-map",
               "route-trace",
+              "env-audit",
+              "secret-audit",
               "build-verify",
               "git-preflight",
                 "runtime-truth",

package/schemas/project-adapter.schema.json

@@ -90,6 +90,8 @@
             "enum": [
               "repo-map",
               "route-trace",
+              "env-audit",
+              "secret-audit",
               "build-verify",
               "git-preflight",
               "runtime-truth",
@@ -167,6 +169,8 @@
                 "enum": [
                   "repo-map",
                   "route-trace",
+                  "env-audit",
+                  "secret-audit",
                   "build-verify",
                   "git-preflight",
                   "runtime-truth",