provider-manager-d2afc2 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited provider-manager-d2afc2 (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Manage provider configuration as a guided runtime setup, not as manual file editing.
Use this when a skill reports missing provider configuration, the user wants to set a self-hosted service URL, or a provider needs one or more API keys. Public package files only declare provider capabilities. Personal endpoints and key references live in user config.
Do not ask the user to find and edit config files by hand. Help them run the setup command.
Provider config defaults to:
~/.config/ark-space/providers.jsonProvider state defaults to:
~/.local/state/ark-space/provider-state.jsonProvider secrets default to:
~/.config/ark-space/secrets.jsonOverride paths with ARKSPACE_PROVIDER_CONFIG, ARKSPACE_PROVIDER_STATE, ARKSPACE_PROVIDER_SECRETS, --config-path, or --state-path.
Resolve the installed ArkSpace package root before running commands. Replace <installed-arkspace-path> with the directory two levels above the loaded ArkSpace SKILL.md, such as /Users/<user>/.claude/plugins/cache/ark-space/ark-space/0.1.2. Use the installed package path, not a repository-relative command, in installed host sessions.
Show paths:
python3 <installed-arkspace-path>/scripts/arkspace.py provider pathsConfigure a self-hosted SearXNG endpoint:
python3 <installed-arkspace-path>/scripts/arkspace.py provider configure searxng --base-url "https://searx.example.org"Configure API-backed skills with ArkSpace defaults:
python3 <installed-arkspace-path>/scripts/arkspace.py provider setup tavily --wizard --key-count 2
python3 <installed-arkspace-path>/scripts/arkspace.py provider check tavily --capability web_search
python3 <installed-arkspace-path>/scripts/arkspace.py provider setup exa --wizard --key-count 2
python3 <installed-arkspace-path>/scripts/arkspace.py provider check exa --capability web_search
python3 <installed-arkspace-path>/scripts/arkspace.py provider setup firecrawl --wizard --key-count 2
python3 <installed-arkspace-path>/scripts/arkspace.py provider check firecrawl --capability web_search
python3 <installed-arkspace-path>/scripts/arkspace.py provider check firecrawl --capability structured_extract
python3 <installed-arkspace-path>/scripts/arkspace.py provider check firecrawl --capability web_interact
python3 <installed-arkspace-path>/scripts/arkspace.py provider check firecrawl --capability web_monitorInspect provider config without secret values:
python3 <installed-arkspace-path>/scripts/arkspace.py provider showResolve a provider before use:
python3 <installed-arkspace-path>/scripts/arkspace.py provider resolve searxng --capability web_searchAdd API key references for future API-backed providers:
python3 <installed-arkspace-path>/scripts/arkspace.py provider add-key brave-search --env BRAVE_API_KEY_1 --header X-Subscription-Token
python3 <installed-arkspace-path>/scripts/arkspace.py provider add-key brave-search --env BRAVE_API_KEY_2 --header X-Subscription-TokenThe provider config stores env:BRAVE_API_KEY_1, env:TAVILY_API_KEY_1, env:EXA_API_KEY_1, or env:FIRECRAWL_API_KEY_1 references. When --save-secret is used, the actual key values are stored in the local private secrets file with 0600 permissions.
Use provider setup when a provider has ArkSpace defaults, such as Tavily, Exa, or Firecrawl. Use provider configure and provider add-key as advanced commands for self-hosted endpoints or new providers that do not have setup defaults yet.
ArkSpace provider runtime supports multiple API key references per provider. It resolves available env:<NAME> values from the process environment first, then ArkSpace's private secrets file, selects the least recently used key, and stores cooldown state locally after failures.
Default rotation behavior:
| Setting | Default |
|---|---|
| Strategy | round_robin using least recently used state |
| Retry statuses | 429,500,502,503,504 |
| Disable statuses | 401,403 |
| Cooldown | 300 seconds |
Provider scripts should record request results through arkspace_runtime.provider_config.record_provider_result() when they add API-backed calls.
When a provider is missing:
web_search.provider setup <provider> --wizard.--wizard through that tool. Offer either interactive terminal setup or saving a pasted key through provider setup tavily --save-secret TAVILY_API_KEY --secret-stdin, provider setup exa --save-secret EXA_API_KEY --secret-stdin, or provider setup firecrawl --save-secret FIRECRAWL_API_KEY --secret-stdin.For secrets, never ask the user to paste a raw API key into committed files. Use the private ArkSpace secrets file through --save-secret or environment variables.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.