skvlt.yaml for Skills Vault ↓
SaferSkills independently audited skvlt (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
_[汉语](./README.zh.md)_
This repository is organized around a single-file Agent Skills manifest, skvlt.yaml, for Skills Vault.
It is intended for people who want a reviewed, portable snapshot of approved skill sources and installed skill names.
skvlt.yaml: the source-of-truth manifestMANIFEST_POLICY.md: the agent-facing policy for additions, replacements, rejections, and escalations[!IMPORTANT] In normal use, manifest changes are proposed and applied by agents following the policy.
The manifest records:
total_sources, total_skills, and per-source countglobalMinimal example:
total_sources: 21
total_skills: 137
scope: "global"
sources:
"openai/skills":
count: 27
skills:
- "openai-docs"
- "slides"
- "sentry"Today, the manifest covers a broad set of real-world development tasks, including general engineering workflows, AI, cloud platforms, security, testing, documentation, design, deployment, and research-oriented work.
It is especially useful for:
This repository is a maintained manifest source intended to be used with Skills Vault.
Recommended workflow:
Example:
git clone https://github.com/xixu-me/skvlt.git
cd skvlt
bunx skvlt restore --allThis repository is not a standalone installer. Its role is to provide a maintained manifest for the Skills Vault toolchain.
[!IMPORTANT] This repository is meant to be used with Skills Vault. Standalone use outside the Skills Vault workflow is not considered a supported primary workflow.
This repository now includes a lightweight Prettier-based formatting toolchain for Markdown and YAML files.
Local commands:
bun install
bun run format:check
bun run formatGitHub Actions workflows:
Format Check: runs formatting validation on pull requests and pushes to mainFormat Fix: manual workflow_dispatch workflow that formats the selected branch and pushes a chore: apply formatting commit only when changes are neededBecause this manifest is global rather than project-specific, changes are handled conservatively.
High-level rules include:
See MANIFEST_POLICY.md for the complete decision model.
In most cases, manifest changes should be requested through an agent rather than edited directly in skvlt.yaml.
Recommended flow:
MANIFEST_POLICY.md and prepare a patch if the change is justified.If the case is ambiguous, high-impact, or source-level, the agent should normally escalate to a human instead of applying the change automatically.
Released under the MIT License. See LICENSE for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.