Agent skill · Audited from source

Maintain Cross Platform

skill · avifenesh/awesome-slashMIT licenceAudited 18 Oct 2026 · source b69fa8f0f708

★ 1,004pushed today
✓SAFEGrade B · 89/100 · 18 Oct 2026 · b69fa8f
1,004repo stars · whole avifenesh/awesome-slash

Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit b69fa8f0f708 and found no filesystem, network or shell access and no hard-coded secrets. What it does: Use when preparing an AgentSys release, checking cross-platform compatibility, or changing the installer, transforms, adapters or marketplace pins. Maintainer skill for this repo only.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “Maintain Cross Platform (avifenesh/awesome-slash)”. Retrieved 18 Oct 2026. https://modelsatlas.com/skills/avifenesh/maintain-cross-platform

2 skills are called “Maintain Cross Platform”. You are viewing avifenesh/awesome-slash.

Trust audit

Audit 0.4.1 · source read 18 Oct 2026

Trust score89/100✓SAFE B
0 critical0 high0 medium0 low0 info

SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 13,985 of 14,816 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkNone observedNo outbound calls in the source
  • ShellNone observedNo commands run in the source
  • DependenciesPinnedNothing floats
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS0
L1 Static sourceSecrets, path traversal, supply chain, hidden codeNA0
L2 InstructionsPrompt injection, authority framing, hidden directivesPASS0
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (0)

No findings at any severity. We re-audit when the source changes.

Audit 0.4.1 · source sha b69fa8f0f708 · 18 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publisheravifenesh GitHub organizationOwner of the repository this skill is read from
  • Source folderavifenesh/awesome-slash/meta/skills/maintain-cross-platformThe exact folder we audited
  • LicenceMITAs the repository states it
  • Commit pinned for this verdictb69fa8f0f708A new audit runs when the source changes
  • Repository statusNot archivedPushed today
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Use when preparing an AgentSys release, checking cross-platform compatibility, or changing the installer, transforms, adapters or marketplace pins. Maintainer skill for this repo only.

---
name: maintain-cross-platform
description: "Use when preparing an AgentSys release, checking cross-platform compatibility, or changing the installer, transforms, adapters or marketplace pins. Maintainer skill for this repo only."
metadata:
  short-description: "Maintain AgentSys across its five platforms"
  scope: local
  audience: repo-maintainers
---

# Maintain cross-platform AgentSys

AgentSys installs the agent-sh plugins on Claude Code, OpenCode, Codex CLI, Cursor and Kiro. The plugins live in their own repos; this repo owns the marketplace, the installer, the transforms and the docs. Use this skill to find where a cross-platform concern lives and what to run.

Platform details (config formats, frontmatter, env vars, label limits) are in `checklists/cross-platform-compatibility.md` and `docs/CROSS_PLATFORM.md`; release steps are in `checklists/release.md` and `agent-docs/release.md`. Read them for the current facts instead of relying on memory.

## Where things live

| Concern | Location |
|---------|----------|
| Marketplace, one entry per plugin pinned by tag and commit | `.claude-plugin/marketplace.json`; re-pin with `node scripts/pin-marketplace.js [--dry-run]` (needs `gh`) |
| Installer | `bin/cli.js`: `installForClaude`, `installForOpenCode`, `installForCodex`, `installForCursor`, `installForKiro`. Claude Code installs from the marketplace; the others fetch plugin sources into `~/.agentsys/plugins/<name>` and transform them. |
| Transforms (frontmatter, tools to permissions, plugin-root paths, namespaces) | `lib/adapter-transforms.js`. `lib/` is synced from agent-sh/agent-core, so make the change there; an edit here is overwritten by the next sync. |
| Platform adapters | `adapters/opencode-plugin/` (native OpenCode plugin), `adapters/opencode/`, `adapters/codex/`; `scripts/gen-adapters.js` keeps generated files fresh |
| Dev installs | `node bin/dev-cli.js dev-install [tool]` (`scripts/dev-install.js`) |
| Versions | `package.json` is the source; `npx agentsys-dev bump X.Y.Z` stamps `package-lock.json`, `.claude-plugin/plugin.json`, `marketplace.json` and `site/content.json`. Plugin repos version independently. |
| Generated doc sections | `<!-- GEN:START:... -->` blocks, rewritten by `npx agentsys-dev gen-docs` |

## Platform differences behind most bugs

- Plugin root: `${CLAUDE_PLUGIN_ROOT}` in Claude Code, `${PLUGIN_ROOT}` in OpenCode and Codex; Cursor and Kiro get the install path inlined. Normalize backslashes in `require()` paths (`.replace(/\\/g, '/')`), because a Windows path such as `C:\Users\...` turns into escape sequences.
- State directory: use `AI_STATE_DIR` (`.opencode`, `.codex`, `.cursor`, `.kiro`; unset means `.claude`) instead of a hardcoded `.claude/`. `validate paths` catches hardcoded ones.
- OpenCode: model fields are stripped by default (`--no-strip` keeps them), tools become `permission:` entries, and AskUserQuestion labels longer than 30 characters fail.
- Codex has no commands or agents: commands become skills invoked as `$name`, so every skill description needs trigger phrases ("Use when ...").
- Kiro: commands become prompts in `~/.kiro/prompts/`, agents become JSON in `~/.kiro/agents/`, and two combined reviewer agents fit its 4-subagent limit. Each skill directory is copied whole to `~/.kiro/skills/<name>/`, away from its plugin, so the installer and the Kiro transforms point plugin-root wording ("two directories up from this skill"), relative links that leave the skill directory, and versioned-cache globs (`**/<plugin>/*/`) at `~/.agentsys/plugins/<plugin>`.

## Checks

| Command | Covers |
|---------|--------|
| `npm run validate` | plugins, cross-platform, consistency, paths, counts, platform-docs, agent-skill-compliance |
| `npm test` | Jest suite |
| `npm run gen-docs:check`, `node scripts/expand-templates.js --check`, `node scripts/gen-adapters.js --check` | Generated content is fresh (CI runs all three) |
| `npx agentsys-dev preflight [--all\|--release]` | Change-aware checklist checks. The pre-push hook runs it, asks for the `/enhance` confirmation, and runs `--release` when a `v*` tag is pushed. |
| `node bin/dev-cli.js validate opencode-install` | A real OpenCode install (not part of `validate`) |
| `npm pack --dry-run` | The package builds |

Before a release, smoke-test the installer: `npm pack`, `npm install -g ./agentsys-*.tgz`, run `agentsys`, and check each platform's install directory as `checklists/release.md` lists.

If this skill or a checklist no longer matches the code, fix it in the same change.

## Output

```markdown
## Cross-Platform Compatibility Check

### Validations run
- [OK|ERROR] <validator>: <one line>

### Issues
- <file:line>: <problem> - <fix>

### Docs out of date
- <file>: <what no longer matches>

### Actions taken
- <files changed>

### Next steps
- <remaining work, or "none">
```

Excerpt, first 4,859 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit b69fa8f

Download folder ↗
git clone https://github.com/avifenesh/awesome-slash
git -C awesome-slash checkout b69fa8f0f708

The author documents no install command, so this uses the repository directly. Our verdict covers commit b69fa8f0f708 only.

Works in which agents?

What its own text says, not a test

AgentStatusMore
Claude CodeMentioned in its text, not testedSkills for Claude Code · About Claude Code
CodexMentioned in its text, not testedSkills for Codex · About Codex
CursorMentioned in its text, not testedSkills for Cursor · About Cursor
“Mentioned” means the skill’s text names the agent. We have not run it there.

Audit history

Every audit, every source change

  1. ✓SAFE B 89 / 100

    first audit · source b69fa8f0f708

README badge

For maintainers · shows the latest audit

ModelsAtlas: SAFE BMODELSATLASSAFE · B
[![ModelsAtlas: SAFE B](https://modelsatlas.com/skills/avifenesh/maintain-cross-platform/badge.svg)](https://modelsatlas.com/skills/avifenesh/maintain-cross-platform/)

The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.

Add this badge to your README

[![ModelsAtlas: SAFE B](https://modelsatlas.com/skills/avifenesh/maintain-cross-platform/badge.svg)](https://modelsatlas.com/skills/avifenesh/maintain-cross-platform/)

Questions about Maintain Cross Platform

What does the Maintain Cross Platform skill do?
AI writes code. This automates everything else · 24 plugins · 49 agents · 44 skills · for Claude Code, OpenCode, Codex, Cursor, Kiro.
Is Maintain Cross Platform safe to install?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.
What can Maintain Cross Platform access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
What do I need installed to use Maintain Cross Platform?
Its own instructions reference gh. Dependencies are pinned to exact versions.
Which assistants does Maintain Cross Platform work with?
Its documentation mentions claude-code, codex and cursor. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (b69fa8f0f708), read on 2026-10-18. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.