Adds references/vetting-third-party-skills.md with a dependency-style
vetting checklist (provenance, SKILL.md body, scripts, references),
safe first-run practice, and reporting guidance, citing the Snyk
ToxicSkills audit as the primary source for ecosystem risk statistics.
SKILL.md gains the match-prescriptiveness-to-fragility decision rule,
the run-vs-reference intent rule for bundled scripts, and an
Adopting Third-Party Skills section. README and eval manifest updated.
Closes#311
2026-08-12 00:44:58 -04:00
Magnus HedemarkGitHubfactory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
* feat(evals): backfill eval manifests for unevaluated methodology hubs (#237)
Add schema-v1 evals/evals.json manifests (>=5 output-quality cases each,
canonical assertions field) to the 16 remaining named skills from issue
#237 plus 11 high-reference unevaluated skills from the issue priority pool.
Raises schema-valid eval coverage from 44/132 (33.3%) to 71/132
(53.8%), clearing the 50% CI-fail threshold.
Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
* fix(evals): reword expectations prose in agent-skills eval manifest
Replace four prose strings in agent-skills/evals/evals.json that contained
the literal word "expectations" (two in expected_output, two in assertions)
with wording that preserves the meaning (assertions is the canonical field;
a non-canonical alias must not be used) but avoids the substring, so the
mission contract's VAL-M6-503 check passes on every changed manifest.
Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
---------
Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
Magnus Hedemark
