Use when building, publishing, comparing, debugging, or accepting binaries, archives, generated files, installers, models, or release assets.
Scanned 9/3/2026
Install to Claude Code
Skills Directorynpx -y skills add ShugokiFable/Ultimate-AI-Starter-Bundle --skill artifact-provenance --agent claude-codeInstalls into .claude/skills of the current project.
Are you the author of Artifact Provenance?
Add the live security badge to your README — it updates automatically with every re-scan.
[](https://www.skillsdirectory.com/skills/shugokifable-artifact-provenance-4e41bb04)More formats (shields.io, HTML) on the badges page.
---
name: artifact-provenance
description: Use when building, publishing, comparing, debugging, or accepting binaries, archives, generated files, installers, models, or release assets.
---
# Artifact Provenance
## Core rule
Every important artifact should answer: exactly what produced these bytes?
Record the source **commit** or immutable revision, dirty/clean state, build command, relevant **toolchain** versions, platform, dependency lock state, and resulting hashes. Treat those facts as the artifact's **provenance** record.
Build release artifacts from the same verified revision whose tests/CI you trust. Never reuse an archive built before the final fix or infer that moving a tag changes existing bytes.
After publishing or copying, hash the delivered file again and compare it with the build record. If provenance cannot be established, label the artifact unverified rather than blending it with known-good outputs.
Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.
No comments yet. Be the first to comment!
