provenance-tracking

What problem does it solve?

When installing skills from remote sources, it is easy to lose track of their original upstream source, miss available updates, and risk using unvetted or modified code without proper provenance tracking. This Skill eliminates that risk by enforcing mandatory source tracking and freshness checks for all remote-installed skills.

Core Features & Use Cases

• Post-Install Provenance Gate: Automatically generates source metadata and check-upstream scripts immediately after installing a remote skill.
• Freshness Checks: Detects when installed skills have upstream changes available, with support for both modified and unmodified third-party skills.
• Batch Provenance Audit: Scans all installed remote skills for missing provenance compliance, orphaned source files, and outdated assets.
• Use Case: After installing a new skill from a public repository, run the provenance gate to ensure it has proper source tracking. During periodic maintenance, run a batch audit to identify any skills that are missing provenance metadata or have pending upstream updates.

Quick Start

Use the provenance-tracking skill to audit all installed remote skills for missing source provenance and check for available upstream updates.