grtninja/repo-b-starframe-ops
skill-candidates/repo-b-starframe-ops/SKILL.md
Validate <PRIVATE_REPO_B> STARFRAME API, AvatarCore proxy, persona registry, heartbeat contract, and degraded-mode guardrails.
$ install --global
skillsauthnpx skillsauth add grtninja/skill-arbiter repo-b-starframe-opsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 5, 2026, 2:38 PM167.1s3 files scanned
SKILL.md
- name:
- repo-b-starframe-ops
- description:
- Validate <PRIVATE_REPO_B> STARFRAME API, AvatarCore proxy, persona registry, heartbeat contract, and degraded-mode guardrails.
Repo B STARFRAME Ops
Use this skill for STARFRAME runtime contract and persona/runtime behavior changes in <PRIVATE_REPO_B>.
Workflow
- Read
AGENTS.md,BOUNDARIES.md,HEARTBEAT.md, andINSTRUCTIONS.mdbefore edits. - Confirm test scope from touched files:
starframe/andstarframe/proxyflowstests/proxyintent routing and fail-closed behaviortests/starframepersona/runtime policy and scoring surfaces
- Run focused test and contract checks for any changed STARFRAME path.
- Validate proxy + service endpoints in smoke mode for stable, contract-safe responses.
- Verify heartbeat contract behavior (
HEARTBEAT_OKwhen no actionable issues). - Verify scaling/telemetry changes preserve existing contract fields and degraded-mode transitions.
Canonical Commands
Run from <PRIVATE_REPO_B> root:
python -m pytest tests/proxy/test_avatar_proxy_core.py tests/starframe/test_persona_registry.py
python -m pytest tests/starframe/test_provider_score.py tests/starframe/test_degraded_mode_rules.py
python -m pytest tests/starframe/test_unified_api.py tests/api/test_starframe_service.py
# If heartbeat behavior changed, run heartbeat-listed checks only and verify exact success token:
# HEARTBEAT_OK
Optional strict lint/test lane:
ruff check starframe tests
pytest -q
Runtime Smoke Checks
python -m starframe --host 127.0.0.1 --port 9010 --no-start-services
curl -s http://127.0.0.1:9010/health
curl -s http://127.0.0.1:9010/v1/unified/status
curl -s http://127.0.0.1:9010/v1/shim/rag/status
Proxy Contract Guards
- Keep
starframe/proxy/avatar.pydispatch/heartbeat behavior fail-closed when intent payloads are invalid. - Preserve
AvatarProxyCorebudget and penalty math unless migration is documented. - Preserve stable response keys under
Personaandtelemetrypayloads when scaling/energy logic changes. - Keep heartbeat run responses deterministic: exact
HEARTBEAT_OKwhen no actionable trust-layer issue exists.
Scope Boundary
Use this skill only for STARFRAME/AvatarCore proxy and persona-runtime governance in <PRIVATE_REPO_B>.
Do not use this for unrelated lanes; route those through $skill-hub and the most specific matching skill.
Reference
references/starframe-checklist.md
Loopback
If the lane is unresolved, blocked, or ambiguous:
- Capture failing endpoint/tests and failed assertion details.
- Route back through
$skill-hubfor chain recalculation. - Resume only after the updated chain returns a deterministic next step.
Related Skills
grtninja/white-hat
tools
VerifiedTrustedCommunity
Run a defender-first security sweep on code, configs, prompts, model/tooling surfaces, or third-party contribution lanes. Use when a request involves safe bug, leak, zero-day-class, exploit, or hack hunting for protection, when contributing to outside repositories and you want a focused security pass, or when touching auth, secrets, permissions, network exposure, prompt/tool boundaries, data flow, or update/build surfaces. This skill is defensive only and must never be used for weaponization or unauthorized access.
2SKILL.mdUpdated Apr 22, 2026
grtninja/vrm-sandbox-startup-acceptance
development
VerifiedTrustedCommunity
Validate and repair VRM Sandbox startup acceptance with shim-first local model authority, frontend/backend bring-up, and avatar-runtime launch proof. Use when launch behavior, chat handoff, voice fallback, or runtime bridge acceptance must be verified end to end.
2SKILL.mdUpdated Apr 22, 2026
grtninja/voice-catalog-runtime-alignment
documentation
VerifiedTrustedCommunity
Align documented voice-command catalogs, endpoint action allowances, and live runtime handlers so operator-visible voice surfaces match what the stack can actually execute. Use when voice command docs, parser matrices, endpoint permissions, or runtime action routing drift apart.
2SKILL.mdUpdated Apr 22, 2026
grtninja/skillhub-trend-radar
development
VerifiedTrustedCommunity
Track SkillHub trend and topic drift, maintain a bounded rewrite watchlist, and surface emerging gaps worth turning into repo-owned skills. Use when the marketplace query set shows new families or when the current shortlist has gone stale.
2SKILL.mdUpdated Apr 22, 2026