Vellum Self Knowledge

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

assistant/CLAUDE.md

assistant/src/approvals/CLAUDE.md

assistant/src/notifications/CLAUDE.md

assistant/src/runtime/CLAUDE.md

gateway/CLAUDE.md

Audit 0.4.1 · source sha 19bc86343b63 · 14 Oct 2026Report an issue or request a re-scan

• Publishervellum-ai GitHub organizationOwner of the repository this skill is read from
• Source foldervellum-ai/vellum-assistant/skills/vellum-self-knowledgeThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdict19bc86343b63A new audit runs when the source changes
• Repository statusNot archivedLast push 1 day ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Answer questions about Vellum, its config, billing, and hosting from live sources of truth

---
name: vellum-self-knowledge
description: Answer questions about Vellum, its config, billing, and hosting from live sources of truth
compatibility: "Designed for Vellum personal assistants"
metadata:
  emoji: "🪞"
  vellum:
    category: "system"
    display-name: "Vellum Self-Knowledge"
    activation-hints:
      - "what model it runs on"
      - "how Vellum works or its architecture"
      - "its current config or settings"
      - "what it can do or which skills/tools exist"
      - "whether a service is connected, and in which sense"
      - "its credits, plan allowance, spend, or daily limit"
      - "how to self-host or use your own model API key"
    avoid-when:
      - "changing configuration"
---

## Critical Rule

**Never answer from memory or general knowledge about Vellum.** Always go to a source of truth.

Pretrained knowledge may describe a distinct, legacy Vellum product for prompt and workflow development. That product is not this assistant. Never use it to answer questions about this Vellum.

This skill contains zero static information — only pointers to where the truth lives.

## Sources of Truth

### 1. The `assistant` CLI — Live Runtime State

The CLI is the single source of truth for anything about the running assistant's current state.

| Question type                                                     | Command                                                                    |
| ----------------------------------------------------------------- | -------------------------------------------------------------------------- |
| Current model, provider, config                                   | `assistant config get llm`                                                 |
| Full config                                                       | `assistant config list`                                                    |
| Config schema (what's configurable)                               | `assistant config schema [path]`                                           |
| Available/installed skills                                        | `assistant skills list --json`                                             |
| Platform connection                                               | `assistant platform status --json`                                         |
| Balance, plan credit left/used, extra credit, expiry, daily limit | `assistant platform credits --json`                                        |
| Plan, subscription status, billing cycle boundary                 | `assistant platform subscription --json`                                   |
| Plan catalog and pricing                                          | `assistant platform plans --json`                                          |
| Invoices                                                          | `assistant platform invoices list --json`                                  |
| Auth/identity                                                     | `assistant auth info --json`                                               |
| Which providers exist, and in which sense                         | `assistant oauth providers list --json`                                    |
| Whether one is actually connected                                 | `assistant oauth status <provider>`                                        |
| Channel delivery health                                           | `assistant channels list`                                                  |
| Connected clients                                                 | `assistant clients list --json`                                            |
| Trust rules                                                       | `assistant trust list`                                                     |
| Stored credentials                                                | `assistant credentials list`                                               |
| API keys                                                          | `assistant keys list`                                                      |
| MCP servers                                                       | `assistant mcp list`                                                       |
| Watchers                                                          | `assistant watchers list`                                                  |
| Token usage/costs                                                 | `assistant usage totals` / `assistant usage breakdown --group-by provider` |
| Version                                                           | `assistant --version`                                                      |

Run `assistant --help` or `assistant <command> --help` to discover more.

"Is X connected?" has two answers and a service can have either, both, or
neither. It takes both commands: the providers list is a catalog and says
nothing about whether anything is connected, so use it to find which provider
keys belong to X, then check each with `oauth status`.

Each provider in that list carries its sense: `actsAs` in the CLI's JSON,
`acts_as` over HTTP. `user` means the assistant can act as the person who
authorized it, `assistant` means a bot people reach the assistant through.
Report the sense found rather than a bare yes.

Do not infer the sense from the provider key. `slack` and `discord` name the
user integration while their bots are `slack_channel` and `discord_channel`,
yet `telegram` is itself the bot. Some services offer both from one authorize
URL, so having done one is not evidence of the other, and people often cannot
recall which they did.

`channels list` reports delivery health for channels that have a readiness
probe, which is not all of them. It answers whether a channel is working, not
whether something is connected.

Credit balance, plan credit, and today's spend come from the platform's
billing ledger through `platform credits` and `platform subscription`, never
from an estimate. "How much of my allowa

Excerpt, first 6,001 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/vellum-ai/vellum-assistant
git -C vellum-assistant checkout 19bc86343b63

Works in

1. 2026-10-14
   ✓SAFE B 89 / 100

   first audit · source 19bc86343b63

Questions about Vellum Self Knowledge

• github.com/vellum-ai/vellum-assistant/tree/main/skills/vellum-se — the audited source at commit 19bc86343b63 and every finding aboveObserved · 14 Oct 2026

Spotted something wrong? Report a correction · Methodology