feat: add AI agent skills inventory scanning support#162
Open
raysubham wants to merge 5 commits into
Open
Conversation
Scan for Agent Skills installed for AI coding agents at global and per-project scope, covering Claude Code skills and skills.sh-managed installs (including plugin-provided skills). For each skill the scan records metadata (name, agent, scope, source), a SHA-256 hash of its SKILL.md for drift detection, skills.sh provenance from lock files, and a stat-only census of the skill folder. Skill file contents are never read beyond SKILL.md and are never transmitted; local source paths from lock files are recorded by alias only. The ~/.claude.json project-registry discovery is shared with the MCP detector.
raysubham
changed the title
The home directory appears in the ~/.claude.json project registry whenever Claude Code has been run from $HOME. Treating it as a project re-scanned the global skill dirs (~/.claude/skills, ~/.agents/skills) and re-emitted every global skill as a project-scoped duplicate, also double-counting roots_scanned. Skip the home directory in project discovery — its dotfile skill dirs are the global roots. Adds a regression test covering a registry that lists both home and a genuine sub-project.
…s-inventory # Conflicts: # internal/featuregate/featuregate.go
skills.sh installs a skill once and symlinks it into each agent's own root, so enumeration emitted one record per root and inflated a single physical skill into N+1 records. Collapse those shadows into one record per physical skill dir, keyed on the symlink-resolved path: the real directory is canonical and the linked roots are recorded in a new symlink_sources field. Drop lock-only synthesis — a lock entry with no folder on disk is not an installed skill — and remove the now-constant is_symlink and present_on_disk fields. Also add Pi, Factory, Amp, and Copilot skill roots (global and project), including Factory's singular .agent/skills and Copilot's .github/skills.
The ~/.claude/plugins/{cache,repos} subtrees are no longer walked for
skill directories, and claude_plugin is removed from the source set.
Skills are discovered through the global, project, and skills.sh
lock-managed roots only; a plugin's skill is inventoried when it is
symlinked or installed into one of those roots.
The per-skill has_plugin_manifest census flag and the skills.sh lock's
plugin_name provenance are unchanged.
Also stop echoing the canonical record's own source into symlink_sources
when another member of its collapse group shares that source.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a detector that inventories Agent Skills installed for AI coding agents, at both global and per-project scope. It covers Claude Code skills and skills.sh-managed installs (including plugin-provided skills).
For each discovered skill the scan records:
SKILL.md(for drift detection)Lock entries with no corresponding folder on disk are surfaced as "configured but not present" records.
Privacy
SKILL.md, and are never transmitted.SKILL.mdis recorded — never its contents.Notes
SKILL.mddiscovery is case-sensitive (exactSKILL.md).~/.claude.jsonproject-registry discovery is shared with the MCP detector.Testing
go build ./...,go vet ./..., andgofmtare cleango test ./...passes for the affected packages