Skip to content
Back to skills

Project Continuity

ASecurity

Maintain AI-KIT's own context, template boundaries, and installer verification when kit structure or procedures change.

  • 11 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added October 16, 2026
ai-agentspythonrustgonodedockergitapisecuritydocumentation

Works with

  • cli
  • api
  • mcp

Security analysis

A100/100

Scanned October 16, 2026

npx -y skills add tigusigalpa/ai-kit --skill project-continuity --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Project Continuity?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Project Continuity
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/tigusigalpa-project-continuity/badge)](https://www.skillsdirectory.com/skills/tigusigalpa-project-continuity)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: project-continuity
description: Maintain AI-KIT's own context, template boundaries, and installer verification when kit structure or procedures change.
---

# AI-KIT maintenance continuity

Read [contribution rules](../../../CONTRIBUTING.md). Read optional local `../../../PROJECT_CONTEXT.md`, `../../../AGENTS.md` and `../../../WIKI.md` when present; otherwise verify facts from public source/configuration. These three root files stay local and untracked, outside wheel/Docker payloads; their template counterparts stay public. Check distributions with and without local copies and preserve their on-disk bytes when untracking.
Keep the root context/history about this kit; keep template project facts uninitialized.
For a procedure change, update current maintainer commands, this pointer contract, and relevant implementation docs in the same task.
When verified facts or agreements change, synchronize this skill's scope/procedure/pointers and WIKI with the context; keep actual facts in context.
Validate templates/links/registry, the agent registry (integrations/agents.json), and behavioral installation scenarios; record root CHANGELOG entries. Keep the root SKILL.md (the repository as a skill) consistent with the CLI, presets, extras, and policies.
Review explicit semantic acceptance and future-upgrade conflicts whenever installer baseline behavior changes.
Check candidate draft preservation, state/settings validation, and adapter retirement conflicts when changing installation. Exercise installed Git visibility and portable linked-path refusal; distinguish synthetic fixtures from real application trials. Verify the conditional Docker trigger in installed AGENTS and preserve edited entry points during upgrades.
Exercise file-versus-directory native rule layouts on both probe and selected-write paths: simulate POSIX ENOTDIR on Windows, preserve existing file markers and rerun stability, and refuse blocked selected parents before writes. Do not hide permission failures or linked-path refusals during optional adapter probes; see [file-parent compatibility](../../../docs/ADAPTER_PATH_FIX.md).
Exercise manifest-based profile detection and project-fact drafts (version/commands into PROJECT_CONTEXT and project.json), scoped Node/Python ignore rules, the installed-project doctor report, opt-in extras (session-start, guards, CI) including key-level client settings merges, legacy whole-file migration, and hook execution, client detection markers, interactive/check onboarding, the adr/changelog helpers, and the offline router helper (route/configure with provider selection) when installer behavior changes.
For generated client configuration, exercise private/team settings files and mode switches, owned-entry moves, project.json precedence, secret lists, ignore blocks, every scoped rule format with root modules and skipped paths, presets that turn extras off, and workflow skill copies; recheck client formats against primary docs before changing them.
For routing, compare the implementation ladder with canonical POLICY, exercise English/Russian operation/risk regressions and override precedence, provider-review status/sources, and distinguish recommendations from executed model controls. For stack profiles, exercise manifest evidence, module scoping, and command drafting; for Filament specifically test Composer dependency/lock evidence and source/native skill lifecycle. For optional metrics, verify failure/recovery accounting, missing-value coverage, duplicate/lock/path guards, private/team journal visibility, schema 1/2 compatibility, experiment/arm/task identity, per-provider analyze output, and upgrade preservation. Exercise context snapshots and doctor warnings for new/removed modules, profile drift, and manifest changes. Exercise adapter reports plus explicit retirement of unchanged files, backups/state updates, and modified-file conflicts. Exercise opaque evaluator pair coverage without task-text persistence. Use the [evaluation protocol](../../../docs/EVALUATION.md) for separately authorized application trials; synthetic fixtures establish no savings.
Record actual OS/runtime and unavailable checks in the implementation record; keep source visibility checks separate from client activation.
For measurement-led changes, test schema 1/2/3 compatibility, fixed A/B controls, immutable Git blobs and isolated repeated workspaces, missing/estimated telemetry, semantic-review gates, interrupted runs and idempotent private exports. Exercise resume identity checks, per-unit failure recording and configurable kit-arm agents/presets. Check that worker Git discovery cannot reach the source through parents: a ceiling at cwd itself is ineffective. Keep worker requests separate from observed execution. Exercise routing modes/pins/profiles, distinct-case quality floors, matched history, unsupported controls, immutable proposal history and explicit backed-up restore. Exercise module context scope, duplicate content, critical rules/ADRs above byte budgets and linked paths. Follow [the staged plan](../../../docs/DEVELOPMENT_PLAN.md) and [worker contract](../../../docs/BENCHMARK.md); defer live adapters/orchestration until their mechanisms and total coordination costs are verified.
Resolve temporary fixture roots before deriving paths used by guards, assertions, or injected failures. Test equivalent path spellings; keep cleanup bound to original disposable directories. [Windows CI regression](../../../docs/WINDOWS_CI_FIX.md) records the relevant scenario.
For reference upgrades, check the actual published tree and old paths left by overlays. Compatibility pointers link to canonical owners; never hide broken legacy links from the checker.
When editing onboarding docs, verify examples against the actual CLI/defaults and preserve links to policy owners. Keep installation, native discovery, and measured execution claims distinct. For [OpenRouter documentation](../../../README.md#working-with-openrouter), recheck primary API/cache/usage docs; distinguish shipped context manifests from proposed request assembly/runtime, prompt caching from response reuse, and observed usage from assumed savings. Root README and Docker Hub Overview have no size quota; retain scoped instruction budgets and normal link/language checks.
For [PyPI releases](../../../docs/PYPI.md), verify metadata, VERSION, licenses, description, resources and private/path exclusions; build the wheel from sdist and smoke-install offline. Quote Twine globs; report OS gaps. A JSON 404 does not prove name eligibility. Test release/manual identity guards without uploads; preserve CI names and old tags. Published stable releases prepare PyPI artifacts; manual runs default to validation. Require exact version/tag/repository gates, owner approval and future tag coverage; agents must not approve deployments. OIDC belongs only in upload jobs consuming validated same-run artifacts. Keep setup, upload and live MCP activation separate.
For repository administration or changes to existing required CI names, consult [repository maintenance](../../../CONTRIBUTING.md#repository-maintenance), verify live protection and emitted names, and keep required checks aligned. New local jobs establish no hosted result or required-check update. Remote changes need explicit authorization; Core governs commits/pushes.
For every task assess [Docker image impact](../../../docs/DOCKER.md#change-impact-and-image-refresh), including packaged instructions and defaults. Follow canonical [image freshness](../../../template/ai-kit/CONTAINERS.md#image-freshness); rebuild/test affected final sources as ai-kit:dev or record why no rebuild is needed. For the image, verify actual client/daemon, pinned build inputs, VERSION/label identity, closed context, wheel resources, non-root bind permissions, read-only/offline preview and apply, preservation, conflicts, rerun and SIGTERM. Validate the Job schema; distinguish cluster/runtime coverage. Record test cache/volume ownership and size; follow canonical cleanup without shared-builder pruning. Keep image publication separate.
For [dialogue memory](../../../docs/DIALOGUE_MEMORY.md), test all supported imports, selected ChatGPT branches, omissions, untrusted roles, pending prose, explicit keyed conflicts/resolutions, source-bound review, immutable reruns, both exports and byte limits. Exercise linked/blocked paths, private/team upgrade preservation, Git/build/package exclusions and installed CLI execution. Do not infer semantic agreement from no keyed conflicts or claim live sync/upload from local export. Preserve raw sources and default project context.
For optional upstream skills, follow [security-audit](../../../docs/SECURITY_AUDIT.md) and [Strix integration](../../../docs/STRIX.md): preserve pinned bytes/license and newline attributes, verify bounded tree coverage/digests and nested-path aliases, explicit-only metadata, absent default/preset payloads, independent persistent choices, local adaptations/conflicts, links, visibility and wheel resources. Exempt only verified external examples from authored model/language/budget checks. Keep installation separate from audits/runtime setup; report unsupported validators. For Strix, check writable copy isolation, explicit full/diff scope, budget/data destination and no implicit cloud fallback; integration tests must start no scan, model or container.
For [Context7](../../../docs/CONTEXT7.md), check opt-in skill/registry selection, independent persistence, source/native copies, local conflicts and unchanged native MCP configuration. Keep normal skill discovery, version-aware sanitized queries and remote activation separate. Recheck client schemas/authentication against primary docs; a source revision does not pin the hosted service.
For [Web Design](../../../docs/WEB_DESIGN.md), check whole-module default absence, multi-entry skill selection, independent persistence, created-once project documents, native copies/retirement, local conflicts and linked/blocked paths. Exercise workflow context scope, required design memory above budgets, plain HTML without assumed stack facts, private raw output/team visibility and offline wheel resources. Keep TypeUI/SkillUI setup and real browser/Laravel acceptance separate from installer evidence; adopt external guidance only within the selected stack/visual system.
For a requested release, synchronize VERSION, root changelog, README, WIKI and maintainer context; keep kit history out of templates. Recheck CLI/version, kit, isolated archives, offline installation and prior-version upgrade preservation. Distinguish checks before/after labeling. Follow [the owner-approved release path](../../../docs/V1_4_3.md): preserve tags, wait for hosted build checks and report pending human approval; never approve PyPI for the owner. Git authorization follows Core. Release notes must distinguish installed guidance from external tools, live client/model setup and generated-site acceptance; verify security examples against pinned contracts.
For every Docker image release, follow the [Docker Hub checklist](../../../CONTRIBUTING.md#docker-hub-releases) and update the complete [Overview](../../../docs/DOCKER_HUB_OVERVIEW.md); synchronize version/features/examples before building and verified publication identity afterward.
For the current Docker/privacy release, follow [v1.4.1 preparation](../../../docs/V1_4_1.md); keep local image identity distinct from a registry digest and source-bound human review distinct from automatic conversation synchronization. After explicitly authorized publication, read back the registry digest, platform and version/configuration; preserve the prepared image and record later publication-only documentation separately. Do not assign additional tags implicitly.
Do not bootstrap the reference repository as an application or imply native/runtime checks passed from static validation.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.