DaoFlow-dev/cli-contract-change
.agents/skills/cli-contract-change/SKILL.md
Use when changing DaoFlow CLI commands or agent-facing CLI behavior, including contract updates, JSON output, scope enforcement, mutation flags, and authz updates.
$ install --global
skillsauthnpx skillsauth add DaoFlow-dev/DaoFlow cli-contract-changeInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 15, 2026, 9:00 PM81.4s2 files scanned
SKILL.md
- name:
- cli-contract-change
- description:
- Use when changing DaoFlow CLI commands or agent-facing CLI behavior, including contract updates, JSON output, scope enforcement, mutation flags, and authz updates.
CLI Contract Change
Use this skill when work touches packages/cli command behavior or the CLI contract.
Load First
- Repository root AGENTS.md
- packages/cli/AGENTS.md
- cli-contract.md
- validation-gates before commit or push
Contract
- cli-contract.md is the source of truth for command lanes, scopes, JSON output, and mutation guardrails.
- Keep JSON output on stdout and route progress or prose to stderr when practical.
- Preserve structured permission-denied responses with the exact required scope.
- Mutating commands must keep
--dry-run,--yes, and idempotency behavior aligned with the contract. - Update
packages/shared/src/authz.tswhen a command introduces or changes scopes.
Required Flow
- Change the relevant
src/commands/<name>.tsmodule and any supporting CLI helpers. - Update
src/index.tswhen command registration changes. - Update cli-contract.md when flags, JSON shape, scopes, or command lanes change.
- Add or update tests covering JSON output, permission checks, and mutation flags for the touched command.
- Smoke-test
./dist/daoflow --helpwhen packaging, help text, or command registration changes. - Run validation-gates.
Guardrails
- Do not import from
@daoflow/serveror@daoflow/client. - Prefer explicit typed API calls over shell execution.
- Keep command files focused; split broad files instead of extending them.
Related Skills
DaoFlow-dev/daoflow-github-loop
development
VerifiedTrustedCommunity
Use when working DaoFlow GitHub issues end-to-end with Codex; this compatibility entrypoint loads the repo-local GitHub, validation, and review skills.
10SKILL.mdUpdated Apr 15, 2026
DaoFlow-dev/validation-gates
development
VerifiedTrustedCommunity
Use when validating DaoFlow changes before commit or push, including format, tests, lint, typecheck, conditional instruction checks, and CI follow-through.
10SKILL.mdUpdated Apr 15, 2026
DaoFlow-dev/server-schema-change
data-ai
VerifiedTrustedCommunity
Use when changing DaoFlow server schema or persistence flows, including Drizzle schema files, migrations, seed ordering, and database safety rules.
10SKILL.mdUpdated Apr 15, 2026
DaoFlow-dev/github-issue-loop
testing
VerifiedTrustedCommunity
Use when executing DaoFlow GitHub issue or PR work with gh, including issue intake, durable progress comments, status labels, PR updates, and CI follow-through.
10SKILL.mdUpdated Apr 15, 2026