A one-time setup procedure for adding version tracking to an existing skill bundle. It creates a MANIFEST.yaml file, adds version information where appropriate, and starts a changelog.

Use it when a directory contains SKILL.md but lacks a manifest, version headers, and changelog. It inventories related evaluations, scripts, generated files, and source material before setting an initial version.

It gives an untracked skill bundle a defined identity and an inventory of its files. That makes later changes easier to verify and understand.

bootstrap — Skill by snapsynapse

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/snapsynapse/skill-provenance/bootstrap

Any agent

npx skills add snapsynapse/skill-provenance --skill bootstrap

Clone the repo

git clone --depth 1 https://github.com/snapsynapse/skill-provenance

Made for: Claude Code, Codex.

Per session 91 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,084 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00091	$0.01084
Opus 5	$0.00046	$0.00542
Sonnet 5	$0.00018	$0.00217
Haiku 4.5	$0.00009	$0.00108

Measured 2d ago against content hash f58012b0cc7b, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

bootstrap scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/bootstrap/SKILL.md · 119 lines

How it starts

The opening of the file, as written. The whole thing — 119 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Skill Provenance: Bootstrap

Add provenance tracking to an existing unversioned skill bundle. This is a one-time operation that creates the initial manifest, version headers, and changelog.

When to use

Run /skill-provenance:bootstrap when you have a skill directory that contains a SKILL.md but lacks MANIFEST.yaml. This is the entry point for adopting Skill Provenance on an existing project.

If the bundle already has a MANIFEST.yaml, use /skill-provenance:open instead.

Protocol

Inventory all files. Read the directory structure yourself — do not ask the user to list files. Identify:
- SKILL.md (required — if missing, this isn't a skill bundle)
- Evals files (e.g., evals.json)
- Scripts (e.g., generate.js, validate.sh)
- Output artifacts (.docx, .pdf)
- Source material provided by the user
- Any other files present
Propose version numbers. Ask the user what version to assign. If there's a handoff note, git history, or other context suggesting prior versions, propose a number based on that history. Default to 1.0.0 for the bundle and 1 for individual files if no history exists.
Add internal version headers to files that can safely carry YAML frontmatter. Use the metadata block pattern for SKILL.md:
```
---
name: skill-name
description: What the skill does.
metadata:
  skill_bundle: skill-name
  file_role: skill
  version: 1
  version_date: 2026-04-11
  previous_version: null
  change_summary: Initial versioned release.
---
```
For files that cannot safely carry frontmatter (.json, .sh, binaries), the manifest tracks their version — no modification needed.
Determine frontmatter mode. Maintain the canonical source in frontmatter_mode: metadata when richer provenance is useful. For Codex, Gemini CLI, or another strict loader, derive a minimal-frontmatter install copy rather than weakening the canonical source in place. If the user explicitly wants one strict-only bundle, minimal is valid.

Read the full file on GitHub · 119 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 119 lines · 91 tokens per session scan A f58012b0cc7b

Subscribe to this mod's changes

bootstrap is a skill published in the GitHub repository snapsynapse/skill-provenance (7 stars, last pushed 4d ago), licensed MIT. It adds 91 tokens to every session and 1,084 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

LLM agentskills ai-agents claude-ai developer-tools gemini

audit-pr

Audit a whole PR against the delivery contract and return MERGE-READY or evidenced blockers with the full URL. Consumes the current review-change REVIEW-PASS receipt instead of re-running review axes; posts a SHA-bound ready comment; never edits or merges. Triggers: "audit-pr", "is this PR ready", "merge gate".

gtrabanco/agentic-workflow · 71 tokens

product-audit

Audit the whole product across code, quality, process, docs, roadmap, and tooling. Persist one severity-ranked, F-numbered report with proposals; never fix or file work. Triggers: "product-audit", "audit the product", "full health check", "are we product-ready", "CTO review".

gtrabanco/agentic-workflow · 69 tokens

audit-docs

Audit cross-document coherence: docs ↔ roadmap ↔ code ↔ fix index ↔ issues. Finds drift — features in docs/ not in the roadmap (or vice versa), fix-index entries already merged/closed, broken documentation-map links, dependency cycles, artifacts in the wrong language, naming-convention violations — and reports them…

gtrabanco/agentic-workflow · 188 tokens

design-feature

Turn a raw idea or existing feature into a designed product SPEC by completing entity, integration, role, and expectation closure. Upserts never destroy recorded decisions. Triggers: "design-feature", "design this feature", "define product scope".

gtrabanco/agentic-workflow · 51 tokens

init-workspace

Adapt the workflow scaffold to a new repository or add only missing substrate blocks to an existing install. Every install, hook, and overwrite needs explicit consent. Triggers: "init-workspace", "set up agentic workflow", "upgrade workflow scaffold".

gtrabanco/agentic-workflow · 54 tokens

log-session

Append a structured entry to the project's session log (docs/LOGS.md): what was done this session, files touched, decisions taken, and the next step — so the next session (or another person) can pick up the thread without re-reading git history. Run it before /clear, before closing Claude Code, or at any natural…

gtrabanco/agentic-workflow · 183 tokens