Skip to content
Back to skills

Register Ai Agent

ASecurity

Verify and register a GitHub-linked AI co-author through a PR. Use only for a missing identity reported by attribute-ai-commits or an explicit registration request.

  • 2 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added November 7, 2026
developmentrustbashnodegitdocumentation

Security analysis

A100/100

Pro scans all 3 files and shows the line behind each finding

Scanned November 7, 2026

npx -y skills add a-novel-kit/stack --skill register-ai-agent --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Register Ai Agent?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Register Ai Agent
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/a-novel-kit-register-ai-agent/badge)](https://www.skillsdirectory.com/skills/a-novel-kit-register-ai-agent)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: register-ai-agent
description: >
  Verify and register a GitHub-linked AI co-author through a PR. Use only for a missing identity
  reported by attribute-ai-commits or an explicit registration request.
---

# Register AI Agent

Register only the current missing agent. Never guess another provider's account or use another
provider's bot. The registry review is the trust boundary.

## Discover and verify

1. Search official provider documentation, official repositories, and GitHub for the agent's
   canonical co-author identity.
2. Require evidence that the exact email resolves to the expected provider-controlled account:
   - A numeric `users.noreply.github.com` address must contain the matching GitHub account ID and
     login.
   - A provider-domain address needs a public proof commit where GitHub's rendered author mapping
     links that email to the expected account.
3. Verify the candidate programmatically:

   ```bash
   node <skill-dir>/scripts/verify-coauthor.mjs \
     --agent <agent> \
     --label '<display label>' \
     --github-login '<login>' \
     --email '<email>' \
     [--proof-commit '<github-commit-url>']
   ```

The command exits `0` only when the identity resolves to the expected GitHub account. It emits a
registry-ready verified entry and stores rendered proof hashes in validated fragments so secret
scanners do not mistake public commit IDs for credentials.

## Update the registry

1. On successful verification, add the emitted entry to the sibling
   `attribute-ai-commits/references/providers.json` registry.
2. If diligent official-source research finds no valid identity, add an `unavailable` entry with
   `aliases`, `status`, `reason`, `evidence`, and `checked_at`. Do not use a syntactically plausible
   but unlinked email.
3. Update the registry `as_of` date and validate it:

   ```bash
   node <skills-dir>/attribute-ai-commits/scripts/coauthor-registry.mjs validate
   ```

4. Commit the change, push it, and open a PR. Include it in the current feature PR when one already
   exists; otherwise use a dedicated `docs/skills/register-<agent>` PR. The registry lives in
   `a-novel-kit/stack`, which takes PRs only from its writers
   ([check-access](../check-access/SKILL.md)). Without Write there, report the verified entry to the
   developer and commit without the trailer.
5. Use the new verified identity only after its registry entry exists on the branch. Never rewrite
   already-published commits merely to add attribution.

Existing registry entries are durable memory and are intentionally not rechecked during ordinary
commits. Correct or retire one only through another reviewed registry change.

Files in this skill

  • SKILL.md2.6 KB
  • agents/openai.yaml217 B
  • scripts/verify-coauthor.mjs4.9 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.