chelch5/provenance-audit
01-package-scaffolding/provenance-audit/SKILL.md
Audit a skill or artifact's origin chain: where it came from, who authored it, what license applies, what modifications were made, and what trust level to assign. Use when evaluating external skills for adoption, auditing existing skills for license compliance, or establishing trust levels before execution. Do not use when creating new skills from scratch (provenance is 'authored here') or for trusted internal sources.
development
Updated Apr 20, 2026
$ install --global
skillsauthnpx skillsauth add chelch5/skilllibrary provenance-auditInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 20, 2026, 3:19 AM17.1s11 files scanned
SKILL.md
- name:
- provenance-audit
- description:
- Audit a skill or artifact's origin chain: where it came from, who authored it, what license applies, what modifications were made, and what trust level to assign. Use when evaluating external skills for adoption, auditing existing skills for license compliance, or establishing trust levels before execution. Do not use when creating new skills from scratch (provenance is 'authored here') or for trusted internal sources.
- license:
- Apache-2.0
- clients:
- [openai-codex, gemini-cli, opencode, github-copilot]
Provenance Audit
Audits a skill's origin chain and assigns a trust level.
Procedure
1. Identify origin type
| Origin Type | Description | Default Trust |
|-------------|-------------|---------------|
| authored | Created in this repo | High |
| forked | Copied from external, modified | Medium |
| imported | Copied from external, unmodified | Medium |
| generated | AI-generated from requirements | Low |
| unknown | Origin unclear | Untrusted |
2. Extract provenance metadata
From SKILL.md frontmatter: name, source, license.
From git history:
# First commit of skill
git log --follow --format="%H %an %ad %s" -- SKILL.md | tail -1
# All modifications
git log --follow --oneline -- SKILL.md
3. Verify source claims
If source claims external origin:
# Fetch and compare original
curl -s "<original-raw-url>" > /tmp/original.md
diff SKILL.md /tmp/original.md
# If different → forked (not imported)
4. Check license compatibility
| License | Category | Action | |---------|----------|--------| | Apache-2.0, MIT, BSD-* | Permissive | OK for any use | | GPL-3.0, AGPL-3.0 | Copyleft | Check derivative work implications | | (none) | Unknown | Do not adopt — flag for manual review |
5. Assign trust level
| Origin | License OK | Source Verified | Mods Reviewed | Trust | |--------|-----------|----------------|---------------|-------| | authored | N/A | N/A | N/A | HIGH | | forked | YES | YES | YES | HIGH | | forked | YES | YES | NO | MEDIUM | | imported | YES | YES | N/A | MEDIUM | | generated | N/A | N/A | YES | MEDIUM | | unknown | * | * | * | UNTRUSTED |
6. Document provenance in skill
Add provenance section to SKILL.md:
# Provenance
- Origin: [type] from [URL or "this repo"]
- License: [SPDX]
- Modifications: [list or "none"]
- Last audit: [ISO date]
- Trust level: [HIGH|MEDIUM|LOW|UNTRUSTED]
Output contract
# Provenance Audit: [skill-name]
## Origin
- Type: [authored|forked|imported|generated|unknown]
- Source: [URL or "this repo"]
- License: [SPDX]
## Trust Assessment
- License: [PASS|WARN|FAIL]
- Source verified: [YES|NO|UNABLE]
- Modifications reviewed: [YES|NO|N/A]
- Overall trust: [HIGH|MEDIUM|LOW|UNTRUSTED]
## Recommendation
[Action to take]
Failure handling
- Cannot reach source URL: Mark "source unverified", lower trust level
- License unclear: Flag for manual review, do not auto-adopt
- Conflicting provenance claims: Report conflict, require manual resolution
- Skill has no frontmatter: Treat as unknown origin, untrusted
References
- SPDX license identifiers: https://spdx.org/licenses/
Related Skills
chelch5/context-intelligence
testing
VerifiedTrustedCommunity
Manages context window budgets, loading strategies, and compaction techniques for AI-assisted coding sessions. Trigger on 'context window', 'what to load', 'context management', 'context overflow', 'token budget'. DO NOT USE for loading specific project docs into agent context (use project-context) or prompt wording and optimization (use prompt-crafting).
SKILL.mdUpdated Apr 20, 2026
chelch5/auth-patterns
development
VerifiedTrustedCommunity
Implements authentication, session, token, and authorization patterns for the current stack. Trigger on 'add auth', 'JWT', 'OAuth', 'login endpoint', 'session management', 'API key auth'. DO NOT USE for OWASP hardening checklists (use security-hardening), threat modeling (use security-threat-model), or secret rotation/storage (use security-best-practices).
SKILL.mdUpdated Apr 20, 2026
chelch5/api-schema
tools
VerifiedTrustedCommunity
Defines request/response shapes, versioning, validation, and compatibility rules for API-first work. Trigger on 'design API', 'OpenAPI spec', 'REST schema', 'API versioning', 'generate client SDK'. DO NOT USE for GraphQL schemas, gRPC/protobuf definitions (use stack-standards), auth endpoint logic (use auth-patterns), or external API client wrappers (use external-api-client).
SKILL.mdUpdated Apr 20, 2026
chelch5/ticket-pack-builder
development
VerifiedTrustedCommunity
Create a repo-local ticket system with an index, machine-readable manifest, board, and individual ticket files. Use when a repo needs task decomposition that autonomous agents can follow without re-planning the whole project each session. Do not use for executing tickets (use ticket-execution) or quick fixes that don't warrant formal tickets.
SKILL.mdUpdated Apr 20, 2026