open skill
Verifies the integrity, completeness, and version consistency of a skill bundle directory using manifest files and SHA-256 hashes.
- GitHub stars
- 7
- Files
- 1
- Last commit
- Nov 9, 2026
- License
- MIT
- Allowed tools
- —
What does the open skill do?
open verifies the integrity, completeness, and version consistency of a skill bundle directory using manifest files and SHA-256 hashes.
Summary generated from the skill's SKILL.md.
About the open skill
Verifying the integrity and version consistency of a skill bundle directory is the primary function of this tool. Developers use it when loading a project directory to ensure they are working from a known-good state. The skill checks for file completeness by comparing the disk contents against a MANIFEST.yaml file, which serves as the single source of truth. It identifies missing files, unlisted files, and structural errors.
To ensure security and accuracy, the tool verifies SHA-256 hashes for pinned files, preferring the use of a validate.sh script if one is available. It also reviews CHANGELOG.md to summarize recent changes and detects staleness through hash drift or internal-header conflicts. If deployment drift is detected in the manifest, the skill surfaces this information without causing alarm. When version conflicts arise between file headers and the manifest, the tool presents the discrepancies and asks for user confirmation rather than resolving them silently.
What an agent can do with it
- 1Validate project integrityCheck if all files listed in the manifest are present on the disk and identify any unlisted files.
- 2Verify file securityConfirm that file contents have not been tampered with by checking SHA-256 hashes.
- 3Review recent updatesGet a summary of the most recent changes made to the skill bundle.
- 4Detect version conflictsIdentify when a file's internal version header does not match the version recorded in the manifest.
Written from the skill's SKILL.md. Every use case is checked against a quote from it.
How to install the open skill
Each command copies the skill folder into the client's skills directory. Restart the client or start a new session to load it.Install the open skill in Plugin
/plugin marketplace add snapsynapse/skill-provenance /plugin install skill-provenance@snapsynapse-skill-provenance
Install the open skill in Claude Code
~/.claude/skills/open/SKILL.md
$ npx degit snapsynapse/skill-provenance/skills/open ~/.claude/skills/openInstall the open skill in Claude Code (project)
.claude/skills/open/SKILL.md
$ npx degit snapsynapse/skill-provenance/skills/open .claude/skills/openInstall the open skill in Codex
~/.agents/skills/open/SKILL.md
$ npx degit snapsynapse/skill-provenance/skills/open ~/.agents/skills/openInstall the open skill in Gemini CLI
~/.gemini/skills/open/SKILL.md
$ npx degit snapsynapse/skill-provenance/skills/open ~/.gemini/skills/openInstall the open skill in Claude.ai
npx degit snapsynapse/skill-provenance/skills/open open && zip -r open.zip open # claude.ai → Customize → Skills → + → Create skill → Upload a skill → open.zip
SKILL.md
View on GitHubSkill Provenance: Open
Verify a skill bundle when opening a session. This ensures you start from a known-good state before making any changes.
When to use
Run /skill-provenance:open at the start of any session where you'll work
on a skill bundle — a directory containing SKILL.md and optionally
MANIFEST.yaml, CHANGELOG.md, evals, scripts, and other tracked files.
Protocol
-
Read MANIFEST.yaml first. It is the single source of truth for what the bundle contains. If no manifest exists, tell the user and suggest running
/skill-provenance:bootstrapinstead. -
Verify the inventory is complete. Report any files listed in the manifest but missing from disk, and any files on disk the manifest does not list. Unlisted files fail verification.
-
Verify structure and hashes. Prefer the bundle's
validate.shwhen available so constrained path grammar, duplicate inventory entries, symlink components, missing or malformed hashes, and explicithash: nullopt-outs are handled consistently. Otherwise compute SHA-256 manually for every manifest-listed pinned file and report reduced assurance. -
Read CHANGELOG.md. Summarize the most recent 2-3 entries so the user knows what changed recently.
-
Check for staleness. Use hash drift, recent changelog dependency notes, internal-header conflicts,
validated_against, and deployment records. Never compare per-file revision integers numerically with bundle semver; they are separate version domains. -
Check deployment drift. If the manifest has a
deploymentssection, note any deployed copies whose version appears behind the current bundle version. Don't alarm — just surface the information. -
Resolve conflicts if found. If a file's internal version header disagrees with the manifest's version for that file, or two files claim different bundle versions:
- Present the specific discrepancy to the user.
- Show what each version claims via its
change_summary. - Default recommendation: trust the most recent
version_date. - Always ask the user for explicit confirmation. Never silently resolve a version conflict.
-
Report. Give the user a concise summary:
- Bundle name and version
- File count: present / expected
- Hash check: pass / N mismatches
- Structural errors and explicit hash opt-outs
- Matching, stale, or malformed attestation records when present
- Stale files (if any)
- Deployment drift (if any)
- Recommended first action for this session
Conventions referenced
This skill follows the Skill Provenance open standard. Key conventions:
- Version identity lives inside files (via YAML frontmatter
metadatablock) and inMANIFEST.yaml, never in filenames. - MANIFEST.yaml is not self-listed. It tracks other files but does not contain its own hash.
- Per-file versions are integers counting revisions. Bundle version
(
bundle_version) is semver. - Hashes are SHA-256 of file contents, computed on save, verified on load.
For the full spec: https://skillprovenance.dev
Files in this skill
1open skill questions
How do I install the open skill in Claude Code?
Run npx degit snapsynapse/skill-provenance/skills/open ~/.claude/skills/open. Claude Code loads skills from ~/.claude/skills (all projects) or .claude/skills (one project) and uses a skill when its description matches the task.
Which clients can use the open skill?
Any client that reads the Agent Skills format: Claude Code, Codex, Gemini CLI and claude.ai (upload as a ZIP). Scripts in the skill run only where the client allows code execution.
What should I do if there is no MANIFEST.yaml file?
If no manifest exists, you should inform the user and suggest they run the /skill-provenance:bootstrap command instead.
How are file versions and bundle versions handled?
Per-file versions are integers representing revisions, while the bundle version follows semantic versioning (semver); these are treated as separate version domains.
How does the tool handle version conflicts between files?
The tool presents the specific discrepancy to the user and shows the change summary for each version, but it will always ask for explicit user confirmation rather than resolving it silently.