Skip to content

feat(agent-skills): add transitive link traversal to skill validator#56

Merged
jdutton merged 7 commits intomainfrom
feat/audit-link-traversal
Mar 4, 2026
Merged

feat(agent-skills): add transitive link traversal to skill validator#56
jdutton merged 7 commits intomainfrom
feat/audit-link-traversal

Conversation

@jdutton
Copy link
Owner

@jdutton jdutton commented Mar 4, 2026

Summary

  • Adds transitive link traversal to vat audit for standalone skills (SKILL.md files not in a VAT project)
  • Follows all local file links from SKILL.md via BFS with cycle detection
  • Reports broken links (LINK_INTEGRITY_BROKEN error), boundary escapes (OUTSIDE_PROJECT_BOUNDARY warning), and unreferenced markdown files (SKILL_UNREFERENCED_FILE info with --warn-unreferenced-files)
  • Excludes CLAUDE.md, README.md, and other navigation files from unreferenced file detection

Test plan

  • 12 test cases covering: valid links, broken links, escaped links, unreferenced files (on/off), circular links, transitive links, navigation file exclusion, non-markdown assets, external URLs, anchor fragments
  • All 14 validation steps pass (lint, typecheck, unit/integration/system tests, duplication check)
  • Manual verification against real standalone skills (cpto-exec-kb, avonrisk-exec-kb)

🤖 Generated with Claude Code

jdutton and others added 3 commits March 4, 2026 09:01
validateSkill() now performs BFS link graph traversal after frontmatter
validation, checking all local file links for existence and boundary
escapes. Linked markdown files are recursively traversed with cycle
detection. Supports unreferenced file detection via checkUnreferencedFiles
option. Navigation files (README.md, index.md, etc.) and CLAUDE.md are
excluded from unreferenced checks.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Instead of silently skipping files that exist but fail to parse,
emit a LINK_INTEGRITY_BROKEN warning so users know something went wrong.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@codecov
Copy link

codecov bot commented Mar 4, 2026

Codecov Report

❌ Patch coverage is 92.50936% with 20 lines in your changes missing coverage. Please review.
✅ Project coverage is 74.22%. Comparing base (0fb2446) to head (1f25f78).
⚠️ Report is 1 commits behind head on main.

Files with missing lines Patch % Lines
...ges/agent-skills/src/validators/skill-validator.ts 92.50% 20 Missing ⚠️
Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##             main      #56      +/-   ##
==========================================
+ Coverage   73.82%   74.22%   +0.40%     
==========================================
  Files         164      164              
  Lines       12049    12315     +266     
  Branches     2112     2173      +61     
==========================================
+ Hits         8895     9141     +246     
- Misses       3154     3174      +20     
Files with missing lines Coverage Δ
...ges/agent-skills/src/validators/skill-validator.ts 94.81% <92.50%> (-5.19%) ⬇️
Files with missing lines Coverage Δ
...ges/agent-skills/src/validators/skill-validator.ts 94.81% <92.50%> (-5.19%) ⬇️
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

jdutton and others added 4 commits March 4, 2026 10:01
Add system tests verifying:
- Dist skills audit scans multiple files without errors
- Transitive link following works end-to-end via CLI
- Broken links detected via CLI exit code
- Unreferenced files reported with --warn-unreferenced-files
- CLAUDE.md and README.md never flagged as unreferenced

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Skills are LLM-interpreted, so file references in code blocks and prose
are functionally valid even without formal markdown inline links.
Documents this pattern observed in official Claude Marketplace plugins
(superpowers) and recommends using inline links for auditability.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Encourage AI assistants to run vat audit --user as best-effort QA
when changing audit, validation, or link traversal code. Not a hard
gate — agentic guidance to catch regressions in real-world usability.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…positive unreferenced file warnings

Adds extractImplicitReferences() that scans BFS-visited files for non-markdown-link
references to companion files (backtick-quoted, bold, DOT graphviz, bare prose, @-prefix).
Files found via implicit reference now get SKILL_IMPLICIT_REFERENCE instead of
SKILL_UNREFERENCED_FILE, eliminating false positives for real-world skill conventions.

Reduces unreferenced file false positives from 18 to 9 when auditing installed plugins.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@sonarqubecloud
Copy link

sonarqubecloud bot commented Mar 4, 2026

@jdutton jdutton merged commit 0e1de12 into main Mar 4, 2026
5 checks passed
@jdutton jdutton deleted the feat/audit-link-traversal branch March 4, 2026 18:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant