ariffazil/AUDIT-drift-detector
skills/AUDIT-drift-detector/SKILL.md
Real-time drift detection across tool manifests, agent cards, skill registries, and runtime-injected files. Compares live state against saved baselines and reports mismatches. USE WHEN: "check drift", "verify registry", "detect manifest drift", "tool surface audit", "runtime injection detection".
$ install --global
skillsauthnpx skillsauth add ariffazil/openclaw-workspace AUDIT-drift-detectorInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Aug 8, 2026, 3:48 AM194.4s2 files scanned
SKILL.md
- name:
- AUDIT-drift-detector
- id:
- audit-drift-detector
- risk_tier:
- low
- description:
- Real-time drift detection across tool manifests, agent cards, skill
- and reports mismatches. USE WHEN:
- check drift", "verify registry", "detect manifest
- version:
- 2026.07.19
- owner:
- A-FORGE
- autonomy_tier:
- T0
AUDIT-drift-detector
Purpose
The federation has multiple registries (tool_registry.json, agent cards, SKILL_ALIAS_TABLE, affordances.yaml). Drift between them causes routing failures, orphaned skills, and silent capability loss.
Drift Dimensions
- Build vs Runtime Manifest Drift — Canonical drift check via
arifOS/runtime/manifest.py(build_manifestvsruntime_manifest). This is the primary drift detection mechanism post-KSR Epoch 1+2. - Tool Manifest Drift — Live MCP tools vs registered tools vs agent card references
- Skill Registry Drift — SKILL_ALIAS_TABLE vs actual directories vs agent card skill IDs
- Agent Card Drift — Card skill IDs vs existing skill directories
- Schema Drift — Tool input schemas vs documented schemas
- Floor Drift — Declared floor_scope vs actual floor enforcement
- Verdict Taxonomy Drift — Verdict emissions vs closed 6-value set (OBSERVE_ONLY|SEAL|SABAR|VOID|HOLD|888_HOLD)
Detection Pipeline
- Snapshot — Capture current state of all registries
- Compare — Diff against saved baseline (or last-known-good)
- Classify — Each mismatch: CRITICAL (breaks routing), WARNING (orphan), INFO (cosmetic)
- Report — Structured drift report with fix recommendations
- Escalate — CRITICAL drift → 888_HOLD before any SEAL operation
⚠️ Runtime-Injected Files (2026-07-19)
Some organ services modify files at runtime. Known patterns:
- WELL
index.html: WebMCP adapter injected on service start → dirty after commit - arifOS session-state: Runtime state files that change during operation
When dirty after clean commit: check if injected content was already committed → if yes, re-commit; if no, actual drift.
Baselines
- Canonical drift check:
arifOS/runtime/manifest.py—build_manifestvsruntime_manifest(post-KSR Epoch 1+2) - Tool registry:
/root/arifOS/tool_registry.json - Agent cards:
/root/AAA/a2a-server/agent-cards/ - Skill alias:
/root/AAA/skills/SKILL_ALIAS_TABLE.json - MCP surface: Live
tools/listfrom each organ - Verdict taxonomy:
arifOS/runtime/verdict.py— closed 6-value set
Floors
- F2 TRUTH: Report only what is actually observed. No inference without evidence.
- F4 CLARITY: Drift report must be actionable, not noise.
- F11 AUDITABILITY: Every drift check logged with timestamp and findings.
Related Skills
ariffazil/openclaw
testing
VerifiedTrustedCommunity
OpenClaw edge agent bridge — operational triage, doctor, restart, and A2A bridge routing for the federation edge (Telegram surface). USE WHEN: "openclaw unhealthy", "gateway down", "edge bot not responding", "a2a bridge disconnected", "watchdog tripped", "openclaw doctor", "openclaw restart". NOT for token/security audit — use FORGE-telegram-audit.
2SKILL.mdUpdated Aug 8, 2026
ariffazil/MiniMax Image Generation
tools
VerifiedTrustedCommunity
Generate images, videos, TTS, voice clone, and music via MiniMax MCP server. Use when user asks to "draw", "generate image", "create picture", "make a photo", "text to image", "image generation".
2SKILL.mdUpdated Aug 8, 2026
ariffazil/arifos-constitutional-judge
testing
VerifiedTrustedCommunity
Single load-bearing constitutional-judgment skill. Routes all F1–F13, verdict, hold, seal, scope, authority and floor-check calls through the live arif_judge surface. Replaces 7 overlapping predecessors (arifos-constitutional-judge, arifos-constitutional-judge, arifos-constitutional-judge, arifos-constitutional-judge, arifos-constitutional-judge, arifos-constitutional-judge, arifos-constitutional-judge).
2SKILL.mdUpdated Aug 8, 2026
ariffazil/FORGE-lsp-pre-edit-gate
development
VerifiedTrustedCommunity
MANDATORY LSP grounding gate BEFORE any code mutation on .ts, .py, .js, .tsx, .jsx files. Forces the agent to read real-time compiler diagnostics and structural project context before editing — eliminating blind guesses and anchoring every mutation in F2 (TRUTH). Routes through arifOS kernel (:8088) for centralized gate logic.
2SKILL.mdUpdated Aug 8, 2026