Install
$ agentstack add skill-jasontang-ai-acp-operator-audit ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
What this skill is for
Use this skill to determine whether an ACP cycle has reviewable evidence for what happened.
When to use it
- Before declaring a demo, pilot, or benchmark run complete.
- When an export, replay, or lifecycle claim needs evidence.
- When a failure needs a preserved audit trail.
When not to use it
- Do not use it to optimize routing.
- Do not use it to infer missing metrics.
- Do not use it to mutate protocol history.
Inputs expected
- Cycle id or cycle JSON
- Desired export mode
- Claim boundary being evaluated
Preflight / prerequisites
- Confirm whether the review is source, generated evidence, or local debris.
- Confirm exports are generated through Relay, not hand-authored.
- Keep audit review separate from field-efficacy claims.
Workflow
- Fetch cycle, audit events, telemetry events, metrics, digests, routing decisions, and exports.
- Generate missing canonical exports if explicitly requested.
- Check for lifecycle anomalies, telemetry gaps, and missing output evidence.
- Produce a compact review summary with gaps and next actions.
Decision rules / judgment criteria
- Claims require artifacts, not memory.
- Missing telemetry is a gap, not a value to infer.
- Generated evidence must be classified before commit or freeze.
- Replay is an inspection path, not a semantic source of truth.
Escalation rules
Escalate when audit events contradict cycle state, export modes are missing, telemetry is absent for claim-bearing flows, or generated evidence is too broad to freeze safely.
Available scripts
scripts/build-audit-summary.mjs: inspect audit, telemetry, export, and lifecycle evidence from cycle JSON or a local demo cycle.
Outputs
- Audit timeline
- Telemetry summary
- Export readiness report
- Claim-safe evidence notes
Failure handling
Preserve failure outputs. Do not clean, rewrite, or regenerate evidence until the failure has been classified.
Trust / safety notes
Audit skills protect claim boundaries. They should make uncertainty more visible, not make the project look cleaner than it is.
Composition notes
Use inside pilot-cycle-review, foresight-submission-prep, and release evidence workflows.
Examples to inspect next
Read examples/casebook.md for audit success, missing export, ambiguous telemetry, and overclaiming examples.
Evaluation hooks
Run scripts/build-audit-summary.mjs and npm run skills:audit.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: jasontang-ai
- Source: jasontang-ai/acp
- License: Apache-2.0
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.