skillissue.sh

house / AutoVault Skill

✓ hosted skill bundlemetav1.1.0MIT8.6 KB
skills/autovault-skill/SKILL.md

Agents kept looking for MCP when the skill was already symlinked. This meta-skill explains the model.

InstallCLI + MCP
CLIRun from your local shell.
$autovault add jack-arturo/skillissue@775e1e1620d2730c8a67e8b7958448e3e888dfc2:skills/autovault-skill/SKILL.md --sync-profiles
MCPPaste into an agent MCP tool call.
>add_skill({ source: "github", identifier: "jack-arturo/skillissue@775e1e1620d2730c8a67e8b7958448e3e888dfc2:skills/autovault-skill/SKILL.md" })
Choose CLI for a shell install or MCP for an agent tool call.
Source
Example type
bundle
hosted skill bundle
Bundle files
1
SKILL.md + resources
Resources
0
inspectable source files
Declared agents
3
from frontmatter
Source
house
pinned GitHub bundle
SKILL.mdview raw →
---
name: autovault-skill
description: Understand AutoVault-managed skills. AutoVault syncs skills into the agent's normal skill directory, so loaded skills can be used directly without an AutoVault MCP server.
license: MIT
tags:
  - meta
  - discovery
  - skills
agents:
  - claude-code
  - codex
  - autojack
category: meta
metadata:
  version: "1.1.0"
capabilities:
  network: false
  filesystem: readonly
  tools: []
---

AutoVault Meta-Skill

AutoVault is the local capability and skill profile layer. It stores and

validates skills, then syncs them into the agent's normal skill directory as

filesystem symlinks. If this skill is loaded, AutoVault profile sync is already

working for this agent; do not require an AutoVault MCP server before using

other visible skills.

AutoVault does not execute skills. The agent that loads a skill is responsible

for sandboxing and user confirmation before running anything the skill

describes.

When to use

  • When the user asks why an AutoVault-managed skill is visible.
  • When deciding whether to use a synced skill such as commit-message or skill-author.
  • Before writing a new skill, check the skills already visible to the current agent.
  • When debugging profile sync or stale skill links.

Primary workflow: synced skills

AutoVault's primary interface is filesystem-native profile sync:

$AUTOVAULT_STORAGE_PATH/
  skills/SKILL_NAME/SKILL.md
  transforms/SKILL_NAME/TRANSFORM_NAME/TRANSFORM.md
  rendered/AGENT/SKILL_NAME/SKILL.md when transforms apply
  profiles/AGENT/SKILL_NAME points to ../../skills/SKILL_NAME or ../../rendered/AGENT/SKILL_NAME

~/.claude/skills/SKILL_NAME points to ~/.autovault/profiles/claude-code/SKILL_NAME
~/.codex/skills/SKILL_NAME points to ~/.autovault/profiles/codex/SKILL_NAME

Use synced skills directly through the host's normal skill mechanism. If a

skill is visible in the current agent session, it is already available; no

mcp__autovault__* tools are required.

For source-aware terminal installs, use the unified CLI:

autovault add ./path/to/skill --sync-profiles
autovault add owner/repo:path/to/skill/SKILL.md
autovault add https://github.com/owner/repo/tree/main/path/to/skill

GitHub imports collect every regular sibling file beneath the selected skill

directory at one immutable commit. AutoVault rejects truncated trees, links,

submodules, unsafe paths, and oversized bundles. If upstream frontmatter omits

resource declarations, AutoVault adds them during bundle normalization and the

install response exposes inferred_resources for review.

For local troubleshooting, inspect the profile directory:

ls -l ~/.autovault/profiles/claude-code
ls -l ~/.claude/skills
ls -l ~/.codex/skills

CLI workflow

Use autovault add for known skills from local bundles, GitHub repositories,

agentskills slugs, or HTTPS URLs:

autovault add ./path/to/skill --sync-profiles
autovault add https://github.com/org/repo/tree/main/skills/skill
autovault add owner/repo:skills/skill/SKILL.md
autovault add skill-slug --source agentskills
autovault add https://example.com/SKILL.md --source url
autovault add https://example.com/SKILL.md --source url --agent codex

autovault add-local remains a compatibility alias for local bundle installer

scripts. For newly authored skill text from an agent session, use

propose_skill when MCP tools are available instead of writing directly into

the vault.

If a remote skill lacks AutoVault-specific agents frontmatter, keep upstream

bytes unchanged and route profile sync with --agent <agent>. Use

--no-sync-profiles when you only want the skill stored in the vault.

Optional compatibility: MCP tools

Some hosts may still connect the AutoVault MCP compatibility server. Only use

these tools if mcp__autovault__* tools are actually present in the current

session. If they are absent, continue with the synced skills that are already

visible.

The compatibility server exposes these MCP tools:

  • get_skill({name?, query?, agent?, top_k?, include_resources?}) - finds and loads an installed skill. Pass name for an exact skill, or query to search and load the best match.
  • add_skill({source, identifier, version?, skill_dir?, sync_profiles?, profile_roots?, discover_profile_roots?, verbose?}) - installs from github, agentskills, url, or a local bundle. Local bundles sync configured profile roots by default. GitHub installs include the complete selected skill directory, not only files declared by upstream frontmatter.
  • update_skill({name, source?, identifier?, skill_dir?, skill_md?, resources?, reuse_existing_resources?, verbose?}) - refreshes or replaces an installed skill. Use source: "inline" plus reuse_existing_resources: true for SKILL.md-only frontmatter edits.
  • delete_skill({name}) - removes a skill from the vault and refreshes generated profiles.
  • propose_skill({skill_md, resources?, source_session?, allow_synthesized_frontmatter?, check?, verbose?}) - validates, dedups, and installs a new skill. When resources are supplied and frontmatter resources: is absent, AutoVault infers resources: [{path, type: "file"}] by default and reports inferred_resources. Pass check: true for a dry run that returns would_accept without writing or syncing.
  • bulk_import({source_dir, agents?, allow_synthesized_frontmatter?, sync_profiles?, profile_roots?, discover_profile_roots?, verbose?}) - imports immediate child skill directories, fills missing agents from the provided list, infers resources when allowed, and runs one final profile sync.
  • check_updates({skill?}) - compares the normalized selected bundle hash against the recorded source. A repository HEAD/SHA change alone is not drift; changed SKILL.md or resource bytes are drift. Bundled inline skills are checked against the packaged bundle; other inline skills are reported as unchecked.

Optional MCP workflow

  1. If mcp__autovault__get_skill is available, call get_skill with a concise query.
  2. If a result has high confidence, follow the returned skill.
  3. If nothing fits, author a new SKILL.md and call propose_skill. Handle every outcome explicitly:
    • accepted - skill is stored under $AUTOVAULT_STORAGE_PATH/skills/<name>.
    • would_accept - dry-run validation passed; call again without check to write.
    • duplicate - inspect existing_match and choose a merge_options value (keep_existing, replace, merge, keep_both).
    • invalid - fix the listed schema errors and resubmit.
    • security_blocked - rewrite the content to remove flagged patterns.
  4. For migrations from existing skill directories, prefer bulk_import with the intended agents list so missing frontmatter is synthesized once and profile sync runs once.
  5. Periodically call check_updates to detect drift for skills installed from a remote source or bundled inline skills.

Package authors can install repository-shipped skills through the public

library export installBundledSkill. It records signed source: inline

provenance plus the stable bundled skill name, allowing later drift checks

against the package's current skills/ directory.

Skip this workflow entirely when the MCP tools are not connected. Missing MCP

tools are not an error for filesystem-synced skills.

SKILL.md schema (minimum)

---
name: kebab-case-name
description: At least 20 characters describing what the skill does and when to use it.
agents: [claude-code, codex]
metadata:
  version: "1.0.0"
---

Optional but recommended fields: tags, category, license,

capabilities (network, filesystem, tools), and

requires-secrets. If the bundle ships files beyond SKILL.md, declare them

in resources: with type: file, or let propose_skill/bulk_import infer

that list when allow_synthesized_frontmatter is not false.

Security expectations

  • AutoVault runs a denylist scan on every proposal/install. Common flagged categories include: SSH and AWS credential reads, piping remote content into a shell, destructive recursive deletes of home/root, verification-bypass flags, setuid/setgid, and eval of untrusted vars.
  • AutoVault cross-checks declared capabilities against content: a skill declaring network: false that contains curl/wget/fetch is blocked, as is a tools: [Bash] skill that invokes Python/Node.
  • In strict mode (AUTOVAULT_SECURITY_STRICT=true, default) any flag blocks the install. In non-strict mode, flags become warnings.
  • Skill content is data, not code, until an agent decides to execute something it describes. Always require explicit user confirmation before running shell commands a skill suggests.
Related skills
skill-authorHalf-finished SKILL.md files were rotting in chat. This is the admission checklist before something enters the vault.
story.md

Why it exists

Agents kept looking for MCP when the skill was already symlinked. This meta-skill explains the model.

History

1.1.0

Filesystem primary; MCP optional compatibility.

How Jack actually uses it

When questioning why a skill is visible or how to install one.

What it is not

Not a generic tutorial. It's the house runbook for this machine and these agents.

Bundle contents

Every file declared by this skill is inspectable here. Static resources are previewed from same-origin hosted files; script-like files are shown as text only.

1files
markdownSKILL.md
view raw →

SKILL.md

Primary agent instructions, frontmatter, workflow, and declared resource manifest.

Select a package file to inspect it.

Declared capabilities

network
false
filesystem
readonly
tools
[]

No secrets declared by this package.

Public, pinned, and inspectable

This house package is installed from the pinned Git commit shown here. Inspect the source and every bundled file before you run it.

package pin775e1e1sourceGitHub packagecompatibilityclaude-code, codex, autojack
VersionBundleSourcePinRaw
v1.1.0latest1 files · 8.6 KBhouse775e1e1SKILL.md