Skip to content
Back to skills

Status

ASecurity

Report this repo's rhiza state — whether the config is valid, and what was actually synced. Read-only. Add --files for a tree of managed files, or --check for upstream drift.

  • 4 stars
  • 0 votes
  • 0 copies
  • 6 views
  • Added September 5, 2026
ai-agentspythongobashgit

Works with

  • cli

Security analysis

A100/100

Scanned September 5, 2026

npx -y skills add Jebel-Quant/rhiza-claude --skill status --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Status?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Status
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/jebel-quant-status/badge)](https://www.skillsdirectory.com/skills/jebel-quant-status)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
description: Report this repo's rhiza state — whether the config is valid, and what was actually synced. Read-only. Add --files for a tree of managed files, or --check for upstream drift.
argument-hint: "[path to a repo root]  (optional; defaults to the current repo)"
allowed-tools: Bash(uv*), Read
---

You are running `/status` in the **current working directory's repo**.

**A repo's rhiza state has two halves, and this reports both:**

| half | file | question |
| --- | --- | --- |
| **config** | `.rhiza/template.yml` + repo structure | is what we'd sync *from* well-formed? |
| **sync** | `.rhiza/template.lock` | what was actually synced, and when? |

They can disagree in both directions, which is why reporting one without the other
misleads: a freshly `/init`-ed repo has a valid config and **no lock at all**, and a
long-synced repo can have a lock alongside a config someone has since broken by hand.

**This command is a thin wrapper around two bundled scripts** —
`plugin/scripts/validate.py` and `plugin/scripts/status.py`, both deterministic and stdlib-only (no
`rhiza` CLI, no PyYAML). Do **not** re-implement the parsing or gather fields
yourself; run them and relay the output.

Purely descriptive: it **reports; it does not score, fix, or file anything**.

Argument (optional): `$ARGUMENTS` — a path to the repo root to inspect; default is
the current directory.

## 1. Validate the config

`${CLAUDE_PLUGIN_ROOT}` resolves at runtime (**keep the quotes**); in a source
checkout it's empty, so fall back to the repo-relative path.

```bash
uv run --python 3.12 --no-project python "${CLAUDE_PLUGIN_ROOT}/scripts/validate.py" $ARGUMENTS
```

It checks more than the file: that the target is a git repo, that it has the expected
language-specific structure (a `pyproject.toml` is required for Python), that
`template.yml` exists and parses, and that its fields are present and well-typed. It
exits **non-zero on any of those failing** — that's its contract as a gate, so it stays
usable in CI. Here, treat a failure as a *finding to report*, not a reason to
stop: still run step 2, because a broken config alongside a good lock is exactly the
situation worth surfacing. Lead the report with the validation failure.

If there's no `template.yml` at all, the repo isn't rhiza-managed. Say so and point at
`/rhiza:init`; skip step 2.

## 2. Report the sync state

```bash
uv run --python 3.12 --no-project python "${CLAUDE_PLUGIN_ROOT}/scripts/status.py" $ARGUMENTS
```

Flags, added only when the user asks for them:

- `--json` — machine-readable; the default is the human summary. (Its `files` array
  is always present, so `--json` and `--files` don't combine usefully.)
- `--files` (alias `--tree`) — list the managed files as a directory tree beneath the
  summary. This is the view the retired `/rhiza:tree` gave.
- `--check` — compare the pinned `ref` to the latest upstream release via
  `git ls-remote --tags` (no `gh`, no auth) and print an `Update` line, e.g.
  `v1.0.0 → v1.2.0 (2 releases behind) — run /update`, or `up to date`. **The only
  part of this command that touches the network**; a git or network failure is
  reported, never fatal.

## 3. If a script can't run

If `uv` is missing, or a script isn't found at either path, report that plainly and
stop — don't hand-roll the status or the validation as a substitute.

## 4. Relay the results

Show each script's output as-is; both are already formatted. Then, at most **one short
line** tying the two halves together — whether the config is sound and how fresh the
sync looks. **No scores, no recommendations.**

Two non-error states worth naming explicitly rather than reporting as failures:

- **`No template.lock found`** — the repo is configured but never synced. Point at
  `/update`, which performs the first sync.
- **Config valid, lock present, `--check` says behind** — normal; that's what
  `/update` is for.

For an assessment rather than a report, point the user at `/quality`.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.