coding-agent-skills 0.2.9 → 0.2.11

package/scripts/test-pack.mjs

@@ -47,6 +47,16 @@ import {
   renderRouteTraceReport,
   routeTraceCliResult,
 } from "./lib/route-trace.mjs";
+import {
+  buildEnvAuditReport,
+  envAuditCliResult,
+  renderEnvAuditReport,
+} from "./lib/env-audit.mjs";
+import {
+  buildSecretAuditReport,
+  renderSecretAuditReport,
+  secretAuditCliResult,
+} from "./lib/secret-audit.mjs";
 import {
   adapterUpgradeCliResult,
   checkAdapterUpgrade,
@@ -262,6 +272,8 @@ test("local CLI maps approved commands to existing safe scripts", () => {
   assert.ok(cliText.includes("scripts/validate-project-adapters.mjs"));
   assert.ok(cliText.includes("scripts/render-adapter-repo-map.mjs"));
   assert.ok(cliText.includes("scripts/render-route-trace.mjs"));
+  assert.ok(cliText.includes("scripts/render-env-audit.mjs"));
+  assert.ok(cliText.includes("scripts/render-secret-audit.mjs"));
   assert.ok(cliText.includes("scripts/validate-adapters.mjs"));
   assert.ok(!cliText.includes(".env"));
 
@@ -287,6 +299,14 @@ test("local CLI maps approved commands to existing safe scripts", () => {
       ["route-trace", path.join(fixtureRoot, "route-trace", "static-project")],
       /# Route Trace Report/,
     ],
+    [
+      ["env-audit", path.join(fixtureRoot, "env-audit", "static-project")],
+      /# Env Audit Report/,
+    ],
+    [
+      ["secret-audit", path.join(fixtureRoot, "secret-audit", "static-project")],
+      /# Secret Audit Report/,
+    ],
   ];
 
   for (const [args, expected] of commands) {
@@ -311,7 +331,7 @@ test("local CLI maps approved commands to existing safe scripts", () => {
 test("npm package metadata is public-ready and dependency-free", () => {
   const packageJson = readJson("package.json");
   assert.equal(packageJson.name, "coding-agent-skills");
-  assert.equal(packageJson.version, "0.2.9");
+  assert.equal(packageJson.version, "0.2.11");
   assert.equal(
     packageJson.description,
     "Evidence-first, read-only coding-agent skills and project adapter tooling.",
@@ -324,6 +344,8 @@ test("npm package metadata is public-ready and dependency-free", () => {
     "agent-skills",
     "repo-map",
     "route-trace",
+    "env-audit",
+    "secret-audit",
     "project-adapters",
     "code-validation",
     "cli",
@@ -451,6 +473,122 @@ test("route-trace does not broaden a repo-map-only project adapter", () => {
   assert.match(renderRouteTraceReport(result), /route-trace is not enabled/);
 });
 
+test("env-audit identifies variable names without reading .env values", () => {
+  const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "env-audit-fixture-"));
+  fs.cpSync(path.join(root, "tests", "fixtures", "env-audit", "static-project"), temporary, {
+    recursive: true,
+  });
+  fs.writeFileSync(path.join(temporary, ".env"), "SHOULD_NOT_BE_READ=synthetic-fixture-value\n");
+
+  const result = buildEnvAuditReport(
+    temporary,
+    { coreRoot: root },
+  );
+
+  assert.equal(result.status, "complete");
+  assert.ok(result.filesScanned.includes(".env.example"));
+  assert.ok(!result.filesScanned.includes(".env"));
+  assert.ok(result.skipped.some((item) => item.path === ".env"));
+  const names = result.variables.map((variable) => variable.name);
+  assert.ok(names.includes("DATABASE_URL"));
+  assert.ok(names.includes("NEXT_PUBLIC_APP_URL"));
+  assert.ok(names.includes("PORT"));
+  assert.ok(names.includes("SERVICE_TOKEN"));
+  assert.ok(names.includes("DENO_REGION"));
+  const rendered = renderEnvAuditReport(result);
+  assert.match(rendered, /DATABASE_URL/);
+  assert.doesNotMatch(rendered, /synthetic-fixture-value/);
+});
+
+test("env-audit respects adapter-declared scope", () => {
+  const result = buildEnvAuditReport(
+    path.join(root, "tests", "fixtures", "env-audit", "adapter-project"),
+    { coreRoot: root },
+  );
+
+  assert.equal(result.status, "complete");
+  assert.equal(result.adapter.enabled, true);
+  assert.deepEqual(result.scopePaths, ["src"]);
+  assert.deepEqual(result.filesScanned, ["src/config.ts"]);
+  assert.ok(result.variables.some((variable) => variable.name === "ADAPTER_ONLY_VALUE"));
+  assert.ok(result.warnings.includes("env-audit used adapter-declared safe read paths only"));
+  const cli = envAuditCliResult(
+    path.join(root, "tests", "fixtures", "env-audit", "adapter-project"),
+    { coreRoot: root },
+  );
+  assert.equal(cli.exitCode, 0);
+  assert.match(cli.lines.join("\n"), /Env-audit enabled: yes/);
+});
+
+test("env-audit does not broaden a repo-map-only project adapter", () => {
+  const result = buildEnvAuditReport(
+    path.join(root, "tests", "fixtures", "project-adapter-installation", "valid-exact-pin"),
+    { coreRoot: root },
+  );
+
+  assert.equal(result.status, "partial");
+  assert.equal(result.filesScanned.length, 0);
+  assert.equal(result.variables.length, 0);
+  assert.match(renderEnvAuditReport(result), /env-audit is not enabled/);
+});
+
+test("secret-audit reports high-confidence findings without printing values", () => {
+  const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "secret-audit-fixture-"));
+  fs.cpSync(path.join(root, "tests", "fixtures", "secret-audit", "static-project"), temporary, {
+    recursive: true,
+  });
+  const syntheticSecret = ["github", "_pat_", "A".repeat(24)].join("");
+  fs.writeFileSync(
+    path.join(temporary, "src", "leak.ts"),
+    `export const candidate = "${syntheticSecret}";\n`,
+  );
+  fs.writeFileSync(path.join(temporary, ".env"), `DO_NOT_READ=${syntheticSecret}\n`);
+
+  const result = buildSecretAuditReport(temporary, { coreRoot: root });
+  const rendered = renderSecretAuditReport(result);
+
+  assert.equal(result.status, "complete");
+  assert.ok(result.filesScanned.includes("src/leak.ts"));
+  assert.ok(!result.filesScanned.includes(".env"));
+  assert.ok(result.skipped.some((item) => item.path === ".env"));
+  assert.ok(result.findings.some((finding) => finding.path === "src/leak.ts"));
+  assert.ok(result.findings.some((finding) => finding.type === "github-token"));
+  assert.match(rendered, /src\/leak\.ts/);
+  assert.match(rendered, /values omitted/);
+  assert.doesNotMatch(rendered, new RegExp(syntheticSecret));
+});
+
+test("secret-audit respects adapter-declared scope", () => {
+  const result = buildSecretAuditReport(
+    path.join(root, "tests", "fixtures", "secret-audit", "adapter-project"),
+    { coreRoot: root },
+  );
+
+  assert.equal(result.status, "complete");
+  assert.equal(result.adapter.enabled, true);
+  assert.deepEqual(result.scopePaths, ["src"]);
+  assert.deepEqual(result.filesScanned, ["src/placeholder.ts"]);
+  assert.ok(result.warnings.includes("secret-audit used adapter-declared safe read paths only"));
+  const cli = secretAuditCliResult(
+    path.join(root, "tests", "fixtures", "secret-audit", "adapter-project"),
+    { coreRoot: root },
+  );
+  assert.equal(cli.exitCode, 0);
+  assert.match(cli.lines.join("\n"), /Secret-audit enabled: yes/);
+});
+
+test("secret-audit does not broaden a repo-map-only project adapter", () => {
+  const result = buildSecretAuditReport(
+    path.join(root, "tests", "fixtures", "project-adapter-installation", "valid-exact-pin"),
+    { coreRoot: root },
+  );
+
+  assert.equal(result.status, "partial");
+  assert.equal(result.filesScanned.length, 0);
+  assert.equal(result.findings.length, 0);
+  assert.match(renderSecretAuditReport(result), /secret-audit is not enabled/);
+});
+
 test("validate-pack accepts installed package trees without source-only gitignore", () => {
   const temporaryRoot = fs.mkdtempSync(path.join(os.tmpdir(), "installed-package-"));
   const installedRoot = path.join(temporaryRoot, "coding-agent-skills");

package/scripts/validate-pack.mjs

@@ -96,12 +96,16 @@ const requiredRootFiles = [
   "scripts/render-evidence-archive-report.mjs",
   "scripts/render-adapter-repo-map.mjs",
   "scripts/render-route-trace.mjs",
+  "scripts/render-env-audit.mjs",
+  "scripts/render-secret-audit.mjs",
   "scripts/check-adapter-upgrade.mjs",
   "scripts/check-adapter-upgrade-chain.mjs",
   "scripts/validate-adapters.mjs",
   "scripts/validate-project-adapters.mjs",
   "scripts/lib/adapter-repo-map.mjs",
   "scripts/lib/route-trace.mjs",
+  "scripts/lib/env-audit.mjs",
+  "scripts/lib/secret-audit.mjs",
   "scripts/lib/adapter-upgrade.mjs",
   "scripts/lib/adapter-upgrade-chain.mjs",
   "scripts/lib/adapter-discovery.mjs",
@@ -675,8 +679,8 @@ if (packageJson) {
   if (packageJson.name !== "coding-agent-skills") {
     failures.push("package.json has unexpected package name");
   }
-  if (packageJson.version !== "0.2.9") {
-    failures.push("package.json version must be 0.2.9 for public package validation");
+  if (packageJson.version !== "0.2.11") {
+    failures.push("package.json version must be 0.2.11 for public package validation");
   }
   if (packageJson.type !== "module") failures.push("package.json must preserve ESM mode");
   if (packageJson.private !== false) {
@@ -695,6 +699,8 @@ if (packageJson) {
       "agent-skills",
       "repo-map",
       "route-trace",
+      "env-audit",
+      "secret-audit",
       "project-adapters",
       "code-validation",
       "cli",

package/skills/env-audit/SKILL.md

@@ -0,0 +1,58 @@
+---
+name: env-audit
+description: Identify environment variable names and configuration requirements from static files without reading .env files or printing values. Use when Codex must map required, optional, sample, or inferred environment names before implementation, deployment planning, or handoff; do not use for secret validation, credential testing, API calls, runtime checks, builds, tests, deployments, migrations, or secret-file reads.
+---
+
+# Env Audit
+
+Identify environment variable names from bounded static evidence and emit a value-free report. Remain audit-only and fail closed when evidence would require secret files, runtime state, or credential validation.
+
+This skill must not change project files, Git state, dependencies, runtime state, services,
+databases, remotes, or deployment state.
+
+## Purpose And Use
+
+Use this skill to map statically visible environment variable names, sample declarations, and configuration references before changing code, documenting setup, or preparing handoff. It can classify names as sample, required, optional, or inferred, but it must not claim that any value exists or works.
+
+Do not use this skill for secret auditing, credential validation, live service checks, runtime truth claims, deployment readiness, migrations, builds, tests, or package installation.
+
+## Inputs
+
+Require a project root or starting path. Optionally accept a project adapter, intended config area, maximum static scan depth, or named framework/config family to prioritize.
+
+Do not assume `.env` files may be read, variable values are safe, documented names are complete, sample files are current, runtime-injected variables are visible, or an adapter covers every configuration surface.
+
+## Procedure
+
+1. Record user intent, project root, declared scope, adapter state, and safety boundary.
+2. Validate a project adapter when present before reading adapter-declared metadata.
+3. If an adapter is present but does not enable `env-audit`, stop static file reading and report the adapter-limited skip.
+4. Build the scan scope from adapter safe read paths when available; otherwise use a bounded generic static scan.
+5. Exclude `.env`, `.env.*` except `.env.example`, secret-bearing paths, generated paths, dependency paths, and oversized files before reading.
+6. Extract environment variable names from safe static patterns such as `process.env.NAME`, `import.meta.env.NAME`, `Deno.env.get("NAME")`, `env("NAME")`, docs, and `.env.example` declarations.
+7. Never print values, line contents, tokens, credentials, or raw secret-like matches.
+8. Label every finding as sample, required, optional, inferred, skipped, or not verified.
+9. Report skipped files, unverified runtime/secret-store areas, branch state warnings, and safety refusals.
+10. Emit the shared evidence pack or env-audit report before claiming completion.
+
+Use [checklist.md](checklist.md). Consult [failure-modes.md](failure-modes.md), [adapter-interface.md](adapter-interface.md), and [examples.md](examples.md). Format findings with [evidence-template.md](evidence-template.md).
+
+## Evidence, Recovery, And Dependencies
+
+Emit repository identity, adapter state, scan scope, ignored paths, variable names, classifications, file references, sample files inspected, skipped items, not-verified areas, warnings, and changed-state declaration through the shared evidence-pack contract.
+
+Recover from missing adapters, unreadable files, ambiguous variable names, or secret-bearing paths by narrowing scope and reporting uncertainty. Never recover by reading `.env`, printing values, validating credentials, contacting APIs, installing dependencies, running builds/tests, broadening adapter scope, or mutating files.
+
+This skill depends on the evidence-pack contract and may consume validated project adapters. Adapters may add safe paths, ignored paths, documentation precedence, and evidence requirements, but cannot weaken policy or turn this skill into credential validation.
+
+## Approval Boundary
+
+Explicit approval may permit one named non-secret static file read outside normal config paths. Approval does not permit `.env` or secret-file reads, value printing, credential validation, API calls, builds, tests, package installation, runtime checks, deployments, migrations, Git mutation, or project writes.
+
+## Completion
+
+Claim `complete` only when the declared static scan scope was inspected, variable names are reported without values, skipped and not-verified areas are recorded with consequences, adapter limitations are explicit, and no project, Git, dependency, runtime, service, or remote state changed.
+
+Report `partial`, `failed`, or `blocked` when adapter scope prevents env scanning, requested evidence requires secret files or runtime state, the project root cannot be established, or safety exclusions prevent a requested conclusion. Never claim credential presence or validity from static findings.
+
+These conditions are both the acceptance criteria and definition of done.

package/skills/env-audit/adapter-interface.md

@@ -0,0 +1,12 @@
+Adapters may enable `env-audit` by declaring the skill ID with unchanged `audit-only`
+mode and compatible version `0.2.3` or `0.2.x`.
+
+Useful extension fields:
+
+- `safeReadPaths`: source, docs, sample, and config paths that may contain env names.
+- `ignoredPaths`: generated, dependency, runtime-output, and secret-bearing paths to skip.
+- `documentationPrecedence`: docs that may explain required or optional env names.
+- `requiredEvidence`: evidence the report must include before completion.
+
+Adapters must not add `.env`, `.env.*` except `.env.example`, credentials, secret stores,
+runtime checks, API calls, builds, tests, deployments, migrations, or project writes.

package/skills/env-audit/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Env Audit"
+  short_description: "Map env variable names without reading values"
+  default_prompt: "Audit the statically visible environment variable names in this repository without changing project state. Do not read .env files or print values."

package/skills/env-audit/checklist.md

@@ -0,0 +1,7 @@
+- Confirm project root, branch state, and adapter state.
+- Validate adapter before consuming any adapter-declared paths.
+- Refuse `.env`, `.env.*` except `.env.example`, secret-bearing paths, and generated outputs.
+- Scan only bounded static source, docs, sample, and config files.
+- Record variable names, classifications, and file references without values.
+- Record skipped files and runtime/secret-store areas that were not verified.
+- Confirm no files, dependencies, runtime state, services, remotes, or databases changed.

package/skills/env-audit/evidence-template.md

@@ -0,0 +1,17 @@
+## Env Audit Evidence
+
+- Repository root:
+- Branch state:
+- Adapter state:
+- Scan scope:
+- Ignored paths:
+- Static files scanned:
+- Sample files inspected:
+- Variable names found:
+- Required names:
+- Optional names:
+- Inferred names:
+- Skipped items:
+- Not verified:
+- Safety refusals:
+- Changed state: none

package/skills/env-audit/examples.md

@@ -0,0 +1,28 @@
+## Safe
+
+```bash
+coding-agent-skills env-audit /workspace/app
+```
+
+Produces a value-free list of names such as `DATABASE_URL`, `NEXT_PUBLIC_API_URL`, and
+`PORT`, with file references and classifications.
+
+```bash
+node scripts/render-env-audit.mjs tests/fixtures/env-audit/static-project
+```
+
+Runs the synthetic fixture scanner without reading `.env` files or contacting services.
+
+## Unsafe
+
+```bash
+cat .env
+```
+
+Secret-file reads are forbidden.
+
+```bash
+npm run dev
+```
+
+Runtime checks are outside this skill.

package/skills/env-audit/failure-modes.md

@@ -0,0 +1,5 @@
+- **Adapter not enabled:** report `partial` and do not broaden target-project scanning.
+- **Secret-bearing path requested:** skip the file and record the safety exclusion.
+- **Dynamic variable names:** report as not verified instead of guessing.
+- **Large or unreadable files:** skip with consequence and continue bounded scanning.
+- **Credential validation requested:** refuse and explain that only names are in scope.

package/skills/secret-audit/SKILL.md

@@ -0,0 +1,57 @@
+---
+name: secret-audit
+description: Find high-confidence secret exposure risks in static tracked files without printing matched values. Use when Codex must identify possible token, key, credential, or private-key exposure by file path and count before handoff or cleanup; do not use for reading .env files, credential stores, rotation, validation, API calls, builds, tests, deployments, migrations, or mutation.
+---
+
+# Secret Audit
+
+Identify high-confidence secret-like patterns from bounded static evidence and emit a redacted report. Remain audit-only and fail closed when evidence would require reading secret files or printing values.
+
+This skill must not change project files, Git state, dependencies, runtime state, services,
+databases, remotes, or deployment state.
+
+## Purpose And Use
+
+Use this skill to find possible tracked secret exposure by file path, pattern type, and count before handoff, publication, or cleanup. It can report suspicious files and categories, but it must not print matched values or claim whether a credential is active.
+
+Do not use this skill for credential validation, token rotation, secret-store inspection, runtime truth claims, deployment readiness, migrations, builds, tests, or package installation.
+
+## Inputs
+
+Require a project root or starting path. Optionally accept a project adapter, intended scan area, maximum static scan depth, or known synthetic fixture allowance.
+
+Do not assume ignored secret files may be read, high-confidence patterns prove exploitability, absence of findings proves absence of secrets, package contents match Git contents, or a project adapter covers every exposure surface.
+
+## Procedure
+
+1. Record user intent, project root, declared scope, adapter state, and safety boundary.
+2. Validate a project adapter when present before reading adapter-declared metadata.
+3. If an adapter is present but does not enable `secret-audit`, stop static file reading and report the adapter-limited skip.
+4. Build scan scope from adapter safe read paths when available; otherwise use a bounded generic static scan.
+5. Exclude `.env`, `.env.*` except deliberate `.env.example`, secret-bearing paths, generated paths, dependency paths, and oversized files before reading.
+6. Scan safe static text files for high-confidence secret-like shapes.
+7. Report only file path, finding type, and count. Never print matched values, snippets, tokens, credentials, or raw secret-like content.
+8. Label findings, skipped items, not-verified areas, warnings, and safety refusals.
+9. Emit the shared evidence pack or secret-audit report before claiming completion.
+
+Use [checklist.md](checklist.md). Consult [failure-modes.md](failure-modes.md), [adapter-interface.md](adapter-interface.md), and [examples.md](examples.md). Format findings with [evidence-template.md](evidence-template.md).
+
+## Evidence, Recovery, And Dependencies
+
+Emit repository identity, adapter state, scan scope, ignored paths, files scanned, finding path/type/count, skipped items, not-verified areas, warnings, and changed-state declaration through the shared evidence-pack contract.
+
+Recover from missing adapters, unreadable files, ambiguous patterns, or secret-bearing paths by narrowing scope and reporting uncertainty. Never recover by reading `.env`, printing values, validating credentials, rotating tokens, contacting APIs, installing dependencies, running builds/tests, broadening adapter scope, or mutating files.
+
+This skill depends on the evidence-pack contract and may consume validated project adapters. Adapters may add safe paths, ignored paths, documentation precedence, and evidence requirements, but cannot weaken policy or turn this skill into credential handling.
+
+## Approval Boundary
+
+Explicit approval may permit one named non-secret static file read outside normal source paths. Approval does not permit `.env` or secret-file reads, value printing, credential validation, token rotation, API calls, builds, tests, package installation, runtime checks, deployments, migrations, Git mutation, or project writes.
+
+## Completion
+
+Claim `complete` only when the declared static scan scope was inspected, all findings are path/type/count only, skipped and not-verified areas are recorded with consequences, adapter limitations are explicit, and no project, Git, dependency, runtime, service, or remote state changed.
+
+Report `partial`, `failed`, or `blocked` when adapter scope prevents scanning, requested evidence requires secret files or credential stores, the project root cannot be established, or safety exclusions prevent a requested conclusion. Never claim credential validity, revocation, or full absence of secrets from static findings alone.
+
+These conditions are both the acceptance criteria and definition of done.

package/skills/secret-audit/adapter-interface.md

@@ -0,0 +1,12 @@
+Adapters may enable `secret-audit` by declaring the skill ID with unchanged `audit-only`
+mode and compatible version `0.2.3` or `0.2.x`.
+
+Useful extension fields:
+
+- `safeReadPaths`: source, docs, sample, and config paths safe for static pattern scanning.
+- `ignoredPaths`: generated, dependency, runtime-output, and secret-bearing paths to skip.
+- `documentationPrecedence`: docs that explain known synthetic fixtures or report policy.
+- `requiredEvidence`: evidence the report must include before completion.
+
+Adapters must not add `.env`, credentials, secret stores, credential API calls, rotation,
+builds, tests, deployments, migrations, or project writes.

package/skills/secret-audit/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Secret Audit"
+  short_description: "Find secret exposure risks without printing values"
+  default_prompt: "Audit high-confidence secret exposure risks in this repository without changing project state. Do not read .env files, print matched values, or rotate credentials."

package/skills/secret-audit/checklist.md

@@ -0,0 +1,7 @@
+- Confirm project root, branch state, and adapter state.
+- Validate adapter before consuming any adapter-declared paths.
+- Refuse `.env`, `.env.*` except `.env.example`, secret-bearing paths, and generated outputs.
+- Scan only bounded static text files.
+- Record file path, finding type, and count only.
+- Record skipped files and secret stores/history that were not verified.
+- Confirm no files, dependencies, runtime state, services, remotes, or databases changed.

package/skills/secret-audit/evidence-template.md

@@ -0,0 +1,15 @@
+## Secret Audit Evidence
+
+- Repository root:
+- Branch state:
+- Adapter state:
+- Scan scope:
+- Ignored paths:
+- Static files scanned:
+- Finding paths:
+- Finding types:
+- Finding counts:
+- Skipped items:
+- Not verified:
+- Safety refusals:
+- Changed state: none

package/skills/secret-audit/examples.md

@@ -0,0 +1,27 @@
+## Safe
+
+```bash
+coding-agent-skills secret-audit /workspace/app
+```
+
+Reports possible secret exposure by path, type, and count only.
+
+```bash
+node scripts/render-secret-audit.mjs tests/fixtures/secret-audit/static-project
+```
+
+Runs the synthetic fixture scanner without reading `.env` files or printing matches.
+
+## Unsafe
+
+```bash
+cat .env
+```
+
+Secret-file reads are forbidden.
+
+```bash
+gh secret list
+```
+
+Credential-store and API inspection are outside this skill.

package/skills/secret-audit/failure-modes.md

@@ -0,0 +1,5 @@
+- **Adapter not enabled:** report `partial` and do not broaden target-project scanning.
+- **Secret-bearing path requested:** skip the file and record the safety exclusion.
+- **Synthetic test token needed:** generate it in a temporary test directory, never package it.
+- **Credential validation requested:** refuse and explain that only static path/count evidence is in scope.
+- **No findings:** report that no high-confidence matches were found in scanned files, not that the repo is secret-free.

package/tests/fixtures/env-audit/adapter-project/.coding-agent/adapters/env-audit-fixture/adapter.json

@@ -0,0 +1,56 @@
+{
+  "adapterId": "env-audit-fixture",
+  "adapterVersion": "1.0.0",
+  "project": {
+    "id": "env-audit-fixture",
+    "detection": {
+      "rootMarkers": [
+        {"kind": "file", "path": "package.json"},
+        {"kind": "file", "path": "README.md"}
+      ],
+      "maximumDepth": 1,
+      "scope": "declared-project-root",
+      "requireApprovalOutsideScope": true
+    }
+  },
+  "supportedSkills": [
+    {
+      "id": "env-audit",
+      "compatibleVersions": ["0.2.3", "0.2.x"],
+      "declaredMode": "audit-only"
+    }
+  ],
+  "extensions": {
+    "safeReadPaths": ["src"],
+    "ignoredPaths": ["dist", "build"],
+    "documentationPrecedence": ["README.md"],
+    "commandAliases": [],
+    "safeStatusCommands": [],
+    "requiredEvidence": ["project root", "adapter scope", "env names", "skipped secret paths"],
+    "expectedRuntimeManagers": [],
+    "expectedPackageManagers": ["npm"]
+  },
+  "approvalRequirements": [],
+  "inheritance": {
+    "sharedRestrictions": "required",
+    "deniedOperationCategories": [
+      "file-write",
+      "package-install",
+      "deployment",
+      "git-mutation",
+      "unrestricted-scan",
+      "secret-read",
+      "process-mutation",
+      "service-mutation",
+      "migration-apply",
+      "privileged-api"
+    ],
+    "allowRestrictionRemoval": false,
+    "allowModeOverride": false,
+    "allowFailureSuppression": false,
+    "allowCompletionOverride": false,
+    "allowSecretExposure": false,
+    "allowRequiredEvidenceRemoval": false,
+    "allowScopeExpansionWithoutApproval": false
+  }
+}

package/tests/fixtures/env-audit/adapter-project/.coding-agent/skills.json

@@ -0,0 +1,23 @@
+{
+  "declarationVersion": "1.0.0",
+  "projectId": "env-audit-fixture",
+  "adapterRoot": ".coding-agent/adapters",
+  "adapterSchemaVersion": "1.0.0",
+  "core": {
+    "id": "coding-agent-skills",
+    "expectedVersion": "0.2.3",
+    "versionPin": ">=0.2.3 <0.3.0"
+  },
+  "compatibleSkillIds": ["env-audit"],
+  "adapters": [
+    {
+      "id": "env-audit-fixture",
+      "version": "1.0.0",
+      "skillIds": ["env-audit"]
+    }
+  ],
+  "validationCommand": "node <shared-core>/scripts/validate-project-adapters.mjs <project-root>",
+  "evidenceOutput": "validation-output/project-adapters.json",
+  "approvalPolicyReference": "docs/coding-agent-approval-policy.md",
+  "noSecrets": true
+}

package/tests/fixtures/env-audit/adapter-project/README.md

@@ -0,0 +1,3 @@
+# Env Audit Adapter Fixture
+
+This fixture narrows env scanning to `src`.

package/tests/fixtures/env-audit/adapter-project/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "fixture-env-audit-adapter",
+  "type": "module"
+}

package/tests/fixtures/env-audit/adapter-project/src/config.ts

@@ -0,0 +1,2 @@
+export const adapterScoped = process.env.ADAPTER_ONLY_VALUE;
+export const adapterOptional = process.env.ADAPTER_OPTIONAL_VALUE ?? "fallback";

package/tests/fixtures/env-audit/static-project/.env.example

@@ -0,0 +1,3 @@
+DATABASE_URL=
+NEXT_PUBLIC_APP_URL=
+OPTIONAL_FEATURE_FLAG=

package/tests/fixtures/env-audit/static-project/README.md

@@ -0,0 +1,3 @@
+# Env Audit Static Fixture
+
+Requires DATABASE_URL and optional NEXT_PUBLIC_APP_URL. Workers may use QUEUE_NAME.

package/tests/fixtures/env-audit/static-project/docs/setup.md

@@ -0,0 +1,3 @@
+# Setup
+
+Set DATABASE_URL before starting locally. NEXT_PUBLIC_APP_URL is optional.

package/tests/fixtures/env-audit/static-project/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "fixture-env-audit-static",
+  "type": "module"
+}

package/tests/fixtures/env-audit/static-project/src/config.ts

@@ -0,0 +1,4 @@
+export const databaseUrl = process.env.DATABASE_URL;
+export const port = process.env.PORT ?? "3000";
+export const publicUrl = import.meta.env.NEXT_PUBLIC_APP_URL;
+export const requiredToken = env("SERVICE_TOKEN");

package/tests/fixtures/env-audit/static-project/src/deno.ts

@@ -0,0 +1 @@
+export const denoValue = Deno.env.get("DENO_REGION");