skill-governance
An agent skill by daymade, from daymade/claude-code-skills. Tags: catalog, configuration, governance, setup, validation.
What it does
Govern the real Claude Code and Codex Skill surface without losing cold capability. Use when users ask how many Skills are loaded, why the catalog is huge or descriptions are truncated, want only routers visible while gstack/Lark/IMA/UiPath stay on disk, or need to reconcile source/install/cache drift, `.agents/skills`/`.claude/skills`/legacy `.codex/skills`, loose or duplicate Skills, discovery policy, marketplace sources, suite migrations, superseded plugins, or old cache versions. Verifies the fresh host catalog and router resources; filesystem counts or completed cleanup are not success.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add daymade/claude-code-skills --skill skill-governanceOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/daymade/claude-code-skills
cp -r claude-code-skills/daymade-skill/skill-governance ~/.claude/skills/skill-governanceSafety box score
Grade C, moderate risk: 44 of 100 risk points, rated 2026-09-24. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill audits and governs the Claude/Codex Skill surface, including user-home skill roots, config, activation manifests, and live `codex`/`claude` CLI probes. The main risks are broad local code execution through external binaries and an `exec`-loaded resolver script, plus the ability to change what Skills are discoverable or retired if its mutation workflows are used.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 3 (high) | The shipped audit scripts spawn live `codex`/`claude` subprocesses and `_read_activation_manifest()` does `exec(compile(resolver_path.read_text(...), str(resolver_path), "exec"), owner.__dict__)`, which can execute code from an external path. |
| Network access | 2 (moderate) | The probes send initialize/prompt traffic to the installed `codex`/`claude` runtimes (`subprocess.run([binary, "-p", ...])`, `codex debug prompt-input`), so this skill can reach beyond the local bundle. |
| Filesystem reach | 2 (moderate) | It reads and governs user-global paths such as `~/.agents/skills`, `~/.codex/config.toml`, and `~/.config/claude-switch-models-setup/codex-active-skills.json`, which are broader than the project directory. |
| Secrets & credentials | 1 (low) | The Claude probe explicitly strips `ANTHROPIC_*` env vars and notes stderr can contain account details, so it intersects with credential-bearing runtime state even though it tries to avoid using secrets. |
| Privilege & persistence | 0 (none) | The bundle does not request sudo, service registration, global installs, or shell-startup edits in the shipped scripts. |
| Instruction hijack surface | 0 (none) | I found no hidden instructions, remote-content following, or prompts to bypass safeguards or confirmations. |
| Irreversible actions | 2 (moderate) | The skill’s stated purpose includes reconciling installs, cache repair, moves, and recoverable retirement of Skills, which can change the host’s discoverable agent surface. |
| Transparency | 2 (moderate) | It depends on unbundled external code and binaries, especially the `--source-sync-script` loaded from disk and the installed `codex`/`claude` executables, so reviewers cannot fully inspect runtime behavior from this bundle alone. |
Before installing
- Read `scripts/audit_codex_skill_surface.py` and only point `--source-sync-script` at a trusted file you control.
- Try the CLI probes in a disposable account or with network controls if you do not want live catalog traffic.
- Confirm you are comfortable granting read access to `~/.agents/skills`, `~/.codex/config.toml`, and the Daymade activation manifest.
Rated 2026-09-24 by an automated review of 8 files from the skill's repository.
Source
- Repository
- daymade/claude-code-skills (all skills from this repository)
- Path
- daymade-skill/skill-governance/SKILL.md
- Branch
- main
- Updated
- 2026-09-20
Related skills
- openclaw — Manage OpenClaw (龙虾) instance configurations.
- setup-matt-pocock-skills — Configure this repo for the engineering skills: set up its issue tracker, triage label vocabulary, and domain doc layout.
- check-agent-compatibility
- create-plugin-scaffold — Create a new Cursor plugin scaffold with a valid manifest, component directories, and marketplace wiring.
- principle-encode-lessons-in-structure — Apply when you catch yourself writing the same instruction a second time, or notice a recurring correction.
- review-plugin-submission — Audit a Cursor plugin for marketplace readiness. Use when validating manifests, component metadata, discovery paths, and submission quality before publishing.