← Back to Skills Marketplace
Skill Provenance
by
Sam Rogers
· GitHub ↗
· v4.9.0
· MIT-0
464
Downloads
0
Stars
1
Active Installs
3
Versions
Install in OpenClaw
/install skill-provenance
Description
Version tracking for Agent Skills bundles and their associated files across sessions, surfaces, and platforms. Use when creating, editing, versioning, valida...
Usage Guidance
This bundle appears coherent and low-risk: it only operates on local bundle files, performs SHA-256 checks, and creates derived install copies. Before using: (1) review package.sh and validate.sh (they will copy and may rewrite MANIFEST.yaml and derived SKILL.md), (2) run validate.sh in verify mode first (no --update) to see mismatches, (3) operate on a local copy or backup the bundle before allowing automatic updates, and (4) avoid running these scripts against untrusted bundles unless you inspect those bundles first. The skill does not request credentials or perform network calls.
Capability Analysis
Type: OpenClaw Skill
Name: skill-provenance
Version: 4.9.0
The 'skill-provenance' bundle is a meta-skill designed for versioning and manifest management of AgentSkills. It includes two bash scripts, 'package.sh' and 'validate.sh', which perform local file operations (copying, hashing, and text processing via awk) to maintain bundle integrity and create platform-specific distributions. The instructions in 'SKILL.md' define a clear protocol for the agent to manage version headers and changelogs without any evidence of malicious intent, data exfiltration, or unauthorized remote execution. All behaviors are strictly aligned with the stated purpose of providing a provenance system for skill bundles.
Capability Assessment
Purpose & Capability
The name/description (version tracking, manifest, changelog, packaging) match the provided artifacts: SKILL.md, MANIFEST.yaml, CHANGELOG.md, evals, and two shell helpers (package.sh and validate.sh) that implement packaging and hash verification. Nothing requested or included is out of scope for a provenance/packaging tool.
Instruction Scope
SKILL.md instructs the agent to inventory, add version headers where appropriate, create/maintain MANIFEST.yaml and CHANGELOG.md, and package derived copies. These actions require read/write access to the bundle files and the scripts likewise operate on bundle files; that is expected. There are no instructions to read unrelated system files, secrets, or phone-home endpoints.
Install Mechanism
No install spec or remote downloads are present; this is instruction-only with local, zero-dependency shell helpers. No archive downloads, URL-based installs, or external package pulls are used.
Credentials
The skill declares no required environment variables, credentials, or external config paths. The included scripts rely only on common local utilities (shasum/sha256sum, awk, cp, mktemp) consistent with their purpose.
Persistence & Privilege
The skill does not request always:true or system-wide privileges. However, the runtime model and helper scripts intentionally read and modify bundle files (they can rewrite SKILL.md in derived copies and update MANIFEST.yaml when hashes change). This is expected behavior for packaging/validation but means you should permit the agent to edit only bundles you trust or work on a copy.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install skill-provenance - After installation, invoke the skill by name or use
/skill-provenance - Provide required inputs per the skill's parameter spec and get structured output
Version History
v4.9.0
Trust narrative reframe, 4 new evals (30 total), plugin system fix, GitHub Pages site at skillprovenance.dev, Gemini CLI and Perplexity Computer upgraded to pass, use case walkthroughs for untrusted bundles and team sharing.
v4.7.2
Since 4.2.1, Skill Provenance has expanded from a core versioning workflow into a more complete cross-surface skill maintenance system. Newer releases added capability-based compatibility metadata, Claude API and Agent SDK guidance, dependency tracking, deployment drift records, trust/audit checks, and broader eval coverage for redeploys, conflicts, hash mismatches, packaged subsets, and distribution scenarios.
The current 4.7.2 release also improves publishing and portability directly: it adds author/source attribution in SKILL.md, clarifies the three-state model of canonical source bundle vs. strict-platform install copy vs. registry package, and includes a zero-dependency package.sh helper to generate strict-platform and ClawHub-ready outputs reproducibly. The published ClawHub artifact is a reduced consumer package and excludes local shell helper scripts from the upload.
v4.2.1
Semver adoption, cross-platform portability, ClawHub readiness
Metadata
Frequently Asked Questions
What is Skill Provenance?
Version tracking for Agent Skills bundles and their associated files across sessions, surfaces, and platforms. Use when creating, editing, versioning, valida... It is an AI Agent Skill for Claude Code / OpenClaw, with 464 downloads so far.
How do I install Skill Provenance?
Run "/install skill-provenance" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Skill Provenance free?
Yes, Skill Provenance is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Skill Provenance support?
Skill Provenance is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Skill Provenance?
It is built and maintained by Sam Rogers (@snapsynapse); the current version is v4.9.0.
More Skills