skill-manifest-gen — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-manifest-gen (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Every aria-skill is one executable. Claude Code discovers it via SKILL.md; other harnesses need their own discovery file. This generates all three from the same sources of truth so they can't drift:
| Harness | File it needs |
|---|---|
| OpenAI / Codex / xAI Grok | manifest/openai.json (Tool/Function schema) |
| Google Gemini | manifest/gemini.json (function_declarations) |
| MCP — VS Code, Cursor, Claude Desktop | manifest/mcp.json (tool spec 2024-11-05) |
Sources of truth: `SKILL.md` frontmatter (name + description) + the skill's script argparse (→ the input parameter schema). Nothing is hand-authored, so a regenerate always matches the skill.
# one skill (skips if manifest/ already exists)
python3 skill-manifest-gen/gen_manifests.py --skill-dir safe-restart
# blanket: every skill in the repo (existing manifests left untouched)
python3 skill-manifest-gen/gen_manifests.py --all --repo-root .
# CI drift gate: report any skill missing a manifest or whose description is stale
python3 skill-manifest-gen/gen_manifests.py --all --check # exit 2 if any
# deliberately regenerate a curated one
python3 skill-manifest-gen/gen_manifests.py --skill-dir foo --forcemanifest/ is skipped unless--force — curated manifests are often hand-tuned past what argparse exposes (richer param docs, corrected defaults), so a blanket --all is safe to run.
aria-skill-test, soa new skill that ships without manifests (or one whose SKILL.md description drifts from its manifest) FAILS the regression harness. That's how "nothing goes missing again" is guaranteed, not just fixed once.
by hand when useful, then they're protected by the no-clobber rule.
manifest/ is discovery glue only — the script remains the behavior truth.marketplace-publish (which uploads the VS Code extension /app-store builds) and aria-skill-test (the gate).
Apache 2.0
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.