skills.rest
Military-Veteran-Team-LPT-Realty
Military-Veteran-Team-LPT-RealtyOFFICIAL
Explore all skills by this author →
GitHub

safe-artifact-packager

Create reviewable archives with manifests, checksums, and sensitive-content scanning.

Updated Sep 16, 2026
Search Tags:#packaging#release#evidence#manifest#archive#checksums#secret scanning
One-click install
npx skills add https://github.com/Military-Veteran-Team-LPT-Realty/mvt-manus-public-skills --skill safe-artifact-packager-military-veteran-team-lpt-realty
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: safe-artifact-packager
Source: https://github.com/Military-Veteran-Team-LPT-Realty/mvt-manus-public-skills/tree/main/skills/safe-artifact-packager
Command: npx skills add https://github.com/Military-Veteran-Team-LPT-Realty/mvt-manus-public-skills --skill safe-artifact-packager-military-veteran-team-lpt-realty

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Delivering code, reports, or evidence as downloadable files risks leaking secrets, private keys, or unrelated data, and often lacks verifiable proof of what was shipped. This Skill enforces a controlled packaging workflow so every archive is reviewable, checksummed, and free of sensitive content. ## Core Features & Use Cases - Inclusion and Exclusion Rules: Build an explicit inclusion list and denylist before collecting files, blocking sensitive values, private keys, raw logs, and quarantined artifacts. - Manifests and Checksums: Generate a manifest with file lists, checksums, version identifiers, and intended use, then verify archive contents after creation. - Evidence Records: Produce a structured evidence record with PASS, BLOCKED, or UNKNOWN status backed by dated, source-linked evidence. - Use Case: When handing off a recovery package or audit evidence bundle, use this Skill to scan for secrets, generate checksums, and mark the archive review-only until a separate approval authorizes use. ## Quick Start Package the current project folder into a reviewable archive with a manifest, checksums, and a sensitive-content scan, excluding any private keys or raw logs.

Frequently Asked Questions about safe-artifact-packager

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create a verifiable archive with checksums for delivery?▼

Define an explicit inclusion list and denylist first, then generate a manifest containing the file list, checksums, version identifiers, and intended use. After creating the archive, verify its contents against the manifest before delivery.

How to exclude secrets and private keys when packaging files?▼

Apply exclusion rules that block sensitive values, private keys, raw logs, unrelated private data, and quarantined artifacts before collecting any files. The sensitive-content scan runs as part of the packaging workflow to catch anything missed.

What should a release manifest include for audit evidence?▼

A manifest should include the full file list, checksums for each file, version identifiers, and the intended use of the archive. Pair it with an evidence record capturing scope, status, sanitized evidence references, and any approvals needed.

When should an archive be marked review-only?▼

Mark an archive review-only by default after creation and verification. Only a separate, explicit approval for the exact action authorizes the archive for use, since approval of a related action does not extend to consequential changes.

What are the limitations of automated sensitive-content scanning?▼

Scanning reduces risk but cannot guarantee detection of every secret format or obfuscated credential. Treat claims as unverified until backed by dated, source-linked evidence, and keep the completion status at BLOCKED or UNKNOWN when verification is incomplete.

Related Skills

Explore More Software Engineering Skills→
u9401066u9401066

temp-cleaner

Remove temporary files, caches, and build artifacts from Python and Node.js projects.

Community
Basic
Veloxia-agencyVeloxia-agency

decision-logger

Log board meeting decisions into a two-layer memory archive with YAML frontmatter.

Community
Advanced
asochan-aiasochan-ai

security-scan

Run a three-stage security audit with secret scanning, dependency checks, and AI attacker analysis.

Official
Advanced
whatwedowhatwedo
47

releasing

Generates a synchronized CHANGELOG entry and GPG-signed tag for dde releases.

Official
Advanced