skills.rest
kvithayathil
kvithayathilCOMMUNITY
Explore all skills by this author →
GitHub

provenance-tracking

Audit installed remote skills for source provenance and upstream updates.

Updated Apr 14, 2026
Search Tags:#github#audit#provenance#updates#skill-management#source-tracking#freshness-check
One-click install
npx skills add https://github.com/kvithayathil/agent-resources --skill provenance-tracking
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: provenance-tracking
Source: https://github.com/kvithayathil/agent-resources/tree/main/.agents/skills/provenance-tracking
Command: npx skills add https://github.com/kvithayathil/agent-resources --skill provenance-tracking

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires gh, jq, and includes scripts (resource) and references (resource) components.

What problem does it solve?

When installing skills from remote sources, it is easy to lose track of their original upstream source, miss available updates, and risk using unvetted or modified code without proper provenance tracking. This Skill eliminates that risk by enforcing mandatory source tracking and freshness checks for all remote-installed skills.

Core Features & Use Cases

  • Post-Install Provenance Gate: Automatically generates source metadata and check-upstream scripts immediately after installing a remote skill.
  • Freshness Checks: Detects when installed skills have upstream changes available, with support for both modified and unmodified third-party skills.
  • Batch Provenance Audit: Scans all installed remote skills for missing provenance compliance, orphaned source files, and outdated assets.
  • Use Case: After installing a new skill from a public repository, run the provenance gate to ensure it has proper source tracking. During periodic maintenance, run a batch audit to identify any skills that are missing provenance metadata or have pending upstream updates.

Quick Start

Use the provenance-tracking skill to audit all installed remote skills for missing source provenance and check for available upstream updates.

Frequently Asked Questions about provenance-tracking

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I track the upstream source of installed GitHub skills?▼

You track upstream sources by enforcing mandatory references/SOURCE.md files and source blocks in SKILL.md frontmatter for all remote-installed skills to eliminate unvetted code.

How do I check if a remote skill has available upstream updates?▼

Check for upstream updates using idempotent check-upstream.sh scripts that perform change detection and update synchronization against GitHub repositories or gists.

What is skill source provenance and when do I need it?▼

Skill source provenance tracks the original upstream source of remote-installed agent skills to prevent using outdated or modified code, needed during post-install validation and periodic batch audits.

Do I need jq and gh to run a batch provenance audit?▼

Yes, you need both jq and gh CLI dependencies installed to batch scan installed remote skills for missing provenance compliance, orphaned source files, and outdated assets.

What's the best way to audit installed skills for missing source tracking metadata?▼

Run a batch provenance audit to scan all installed remote skills, identifying any missing provenance metadata, orphaned source files, and pending upstream updates in one pass.

Why does provenance tracking require a SOURCE.md file for remote skills?▼

Provenance tracking requires SOURCE.md files to enforce mandatory source metadata generation immediately after installing a remote skill, ensuring proper upstream tracking and freshness checks.

Related Skills

Explore More Software Engineering Skills→
JoeyJoziahJoeyJoziah

github

Retrieve GitHub issues, pull requests, workflow runs, and repository metadata via gh CLI.

Community
Intermediate
brazil-benchbrazil-bench
11

re-evaluate

Detect new commits and closed issues, then re-run evaluations and update reports.

Official
Advanced
powdreampowdream

review-shell-scripts

Audit .sh files with shellcheck and apply Bash Script Convention fixes.

Community
Advanced
0xjitsu0xjitsu
1

secret-scanner

Scan full git history for leaked secrets and produce masked remediation reports.

Community
Advanced