memproof 0.1.0__tar.gz → 0.3.0__tar.gz

{memproof-0.1.0 → memproof-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: memproof
-Version: 0.1.0
+Version: 0.3.0
 Summary: Evidence-first health checks for Markdown knowledge vaults.
 Author: memproof contributors
 License-Expression: MIT
@@ -19,24 +19,49 @@ License-File: LICENSE
 Requires-Dist: pyyaml>=6.0
 Provides-Extra: dev
 Requires-Dist: pytest>=8.0; extra == "dev"
-Requires-Dist: ruff>=0.6; extra == "dev"
+Requires-Dist: ruff==0.17.2; extra == "dev"
 Requires-Dist: mypy>=1.11; extra == "dev"
 Dynamic: license-file
 
 # memproof
 
+[![PyPI](https://img.shields.io/pypi/v/memproof.svg)](https://pypi.org/project/memproof/)
+[![test](https://github.com/hsys123/memproof/actions/workflows/test.yml/badge.svg)](https://github.com/hsys123/memproof/actions/workflows/test.yml)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+
 Evidence-first health checks for Markdown knowledge vaults.
 
 `memproof` answers one question: **can you prove what your knowledge base claims?**
 Every finding carries a `path:line`, the evidence behind it, and a concrete fix.
 It is read-only, offline, and deterministic.
 
+## Security rule layer
+
+memproof skills also scans every skill for credential-shaped strings,
+rule-override instructions, memory-file tampering, and fetch-piped-to-execute
+combos. Evidence for matched secrets is masked in the report - the finding tells
+you where and what shape, never the value itself. Use --no-security to run
+spec/registry checks only.
+
+## Check Agent Skills (agentskills.io)
+
+Point `memproof skills` at a directory of `skills/<name>/SKILL.md` to validate the agentskills.io
+contract: kebab-case names that match their directory, description limits,
+optional-field types and unknown keys. Add `--registry skills.json` to diff the disk against a declared skill registry in both directions.
+
+```bash
+memproof skills ./skills --registry config/skills.json --fail-on high
+```
+
 ## Install
 
 ```bash
 uv tool install memproof
 # or
 pip install memproof
+
+# before the PyPI release, install straight from GitHub:
+uv tool install git+https://github.com/hsys123/memproof
 ```
 
 ## Use

{memproof-0.1.0 → memproof-0.3.0}/README.md

@@ -1,17 +1,42 @@
 # memproof
 
+[![PyPI](https://img.shields.io/pypi/v/memproof.svg)](https://pypi.org/project/memproof/)
+[![test](https://github.com/hsys123/memproof/actions/workflows/test.yml/badge.svg)](https://github.com/hsys123/memproof/actions/workflows/test.yml)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+
 Evidence-first health checks for Markdown knowledge vaults.
 
 `memproof` answers one question: **can you prove what your knowledge base claims?**
 Every finding carries a `path:line`, the evidence behind it, and a concrete fix.
 It is read-only, offline, and deterministic.
 
+## Security rule layer
+
+memproof skills also scans every skill for credential-shaped strings,
+rule-override instructions, memory-file tampering, and fetch-piped-to-execute
+combos. Evidence for matched secrets is masked in the report - the finding tells
+you where and what shape, never the value itself. Use --no-security to run
+spec/registry checks only.
+
+## Check Agent Skills (agentskills.io)
+
+Point `memproof skills` at a directory of `skills/<name>/SKILL.md` to validate the agentskills.io
+contract: kebab-case names that match their directory, description limits,
+optional-field types and unknown keys. Add `--registry skills.json` to diff the disk against a declared skill registry in both directions.
+
+```bash
+memproof skills ./skills --registry config/skills.json --fail-on high
+```
+
 ## Install
 
 ```bash
 uv tool install memproof
 # or
 pip install memproof
+
+# before the PyPI release, install straight from GitHub:
+uv tool install git+https://github.com/hsys123/memproof
 ```
 
 ## Use

{memproof-0.1.0 → memproof-0.3.0}/memproof/__init__.py

@@ -1,3 +1,3 @@
 """memproof — evidence-first health checks for Markdown knowledge vaults."""
 
-__version__ = "0.1.0"
+__version__ = "0.3.0"

{memproof-0.1.0 → memproof-0.3.0}/memproof/cli.py

@@ -10,6 +10,15 @@ from .checks import ALL_CHECKS
 from .checks import links as links_check
 from .model import Finding
 from .report import render_json, render_markdown, write_report
+from .skills import (
+    render_json as render_skills_json,
+)
+from .skills import (
+    render_markdown as render_skills_markdown,
+)
+from .skills import (
+    scan_skills,
+)
 from .vault import load_vault
 
 FAIL_RANK = {"high": 0, "medium": 1, "low": 2}
@@ -56,6 +65,20 @@ def build_parser() -> argparse.ArgumentParser:
         default=None,
         help="reference date for freshness checks (YYYY-MM-DD)",
     )
+    skills = subparsers.add_parser("skills", help="check Agent Skills (SKILL.md) spec conformance")
+    skills.add_argument("path", type=Path, help="directory containing skills/<name>/SKILL.md")
+    skills.add_argument("--registry", type=Path, help="JSON file listing the expected skill ids")
+    skills.add_argument(
+        "--no-security", action="store_true", help="skip the secret/injection/exec rule layer"
+    )
+    skills.add_argument("--format", choices=("markdown", "json"), default="markdown")
+    skills.add_argument("--output", type=Path, help="write the report to this file")
+    skills.add_argument(
+        "--fail-on",
+        choices=("none", "low", "medium", "high"),
+        default="none",
+        help="exit 1 when a finding at or above this severity exists",
+    )
     subparsers.add_parser("version", help="print the version")
     return parser
 
@@ -80,6 +103,33 @@ def main(argv: list[str] | None = None) -> int:
         print(__version__)
         return 0
 
+    if args.command == "skills":
+        skills_root = args.path
+        if not skills_root.is_dir():
+            print(f"memproof: not a directory: {skills_root}", file=sys.stderr)
+            return 2
+        skill_findings, scan = scan_skills(
+            skills_root, args.registry, security=not args.no_security
+        )
+        content = (
+            render_skills_markdown(scan, skill_findings)
+            if args.format == "markdown"
+            else render_skills_json(scan, skill_findings)
+        )
+        if args.output:
+            write_report(args.output, content)
+            print(f"wrote {args.output}")
+        else:
+            sys.stdout.write(content)
+        if args.fail_on == "none":
+            return 0
+        threshold = FAIL_RANK[args.fail_on]
+        worst = min(
+            (FAIL_RANK.get(finding.severity, 99) for finding in skill_findings),
+            default=99,
+        )
+        return 1 if worst <= threshold else 0
+
     root = args.path
     if not root.is_dir():
         print(f"memproof: not a directory: {root}", file=sys.stderr)