More screenshots

    Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIDeepSeekDeepSeekMuseMuse+22 more

    Repair GitHub Runner Artifact Attestation Gap

    1

    Trace missing provenance in a GitHub artifact release.

    $1

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    Repair GitHub Runner Artifact Attestation Gap

    Repair GitHub Runner Artifact Attestation Gap

    Example session with this skill installed

    A release ZIP was uploaded before its required artifact attestation completed.

    Available evidence: workflow run logs (partial). Additional evidence requested: reference policy or configuration, event and change timeline, owner review or test record. Review this case; identify evidence gaps; do not invent a live test or production action.

    • Read your context and instructions
    • Compiled the repair github runner

    Repair GitHub Runner Artifact Attestation Gap — EVIDENCE-LIMITED REVIEW

    Scenario received

    A release ZIP was uploaded before its required artifact attestation completed.

    Source register

    • S1: workflow run logs — PARTIAL SOURCE PROVIDED.
    • S2: reference policy or configuration — NOT PROVIDED; REQUIRED TO VERIFY.
    • S3: event and change timeline — NOT PROVIDED; REQUIRED TO VERIFY.
    • S4: owner review or test record — NOT PROVIDED; REQUIRED TO VERIFY.

    Concrete checks

    1. Correlate workflow run logs with the authorized baseline — AWAITING CORROBORATING EVIDENCE.
    2. Isolate missing signed provenance for released artifact using matching identifiers — AWAITING CORROBORATING EVIDENCE.
    3. Cross-check timestamps, versions and source ownership — AWAITING CORROBORATING EVIDENCE.
    4. Prepare reversible checks for verified release provenance chain — AWAITING CORROBORATING EVIDENCE.

    Deliverables / acceptance gates

    • workflow run logs traceability map: DRAFT / INCOMPLETE until evidence is validated.
    • missing signed provenance for released artifact exception register: DRAFT / INCOMPLETE until evidence is validated.
    • verified release provenance chain validation plan: DRAFT / INCOMPLETE until evidence is validated.

    Decision

    INCOMPLETE — HUMAN REVIEW REQUIRED. Confirm dates, IDs, affected scope, owners and acceptance evidence. Do not claim authorization or execution that did not occur.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Repair GitHub Runner Artifact Attestation Gap is a ToolForge Labs Cursor Skill workflow. Trace missing provenance in a GitHub artifact release.

    What this skill checks

    1. Correlate workflow run logs with the authorized baseline.
    2. Isolate missing signed provenance for released artifact using matching identifiers.
    3. Cross-check timestamps, versions and source ownership.
    4. Prepare reversible checks for verified release provenance chain.

    What to provide

    • workflow run logs.
    • reference policy or configuration.
    • event and change timeline.
    • owner review or test record.

    Deliverables

    • workflow run logs traceability map.
    • missing signed provenance for released artifact exception register.
    • verified release provenance chain validation plan.

    Evidence policy Only supplied, authorized evidence is used. The skill distinguishes facts from assumptions and missing inputs; no unperformed live tests, external changes, or approvals are claimed.

    Find more skills like this on the Claude Skills Marketplace, the Codex Skills Marketplace and the Gemini Skills Marketplace, or browse Claude Skills for Code Quality & Review.

    Cannot verify inaccessible environments or data not supplied. Missing or contradictory evidence must be marked INCOMPLETE or UNVERIFIED. Owner approval is required for operational or compliance decisions.

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before buying a skill.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill goes through the trust checks below.

    Security scanned

    Checked by our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scan

    Security scan passed 19 days ago

    Permissions

    Read Files

    Provide only evidence you are authorized to share. Treat examples as untrusted case data. Operational changes and external messages require explicit owner approval.

    Listed19 days ago
    Updated9 days ago

    What's inside

    Frequently Asked Questions

    This skill automates the tedious process of correlating workflow timestamps and source identifiers to identify exactly where the attestation chain broke, typically due to race conditions during the artifact upload process.

    The skill is optimized for Cursor and other AI-powered IDEs, requiring you to provide the workflow logs and the relevant security policy or reference configuration for analysis.

    No, this skill functions as a diagnostic and planning tool; it analyzes logs to map security gaps and generates a validation plan without requiring direct access to your GitHub environment.

    You receive the specialized skill logic for log correlation, an evidence classification framework (VERIFIED, CONTRADICTED, UNVERIFIED), and structured templates for exception registration and rollback planning.

    It is designed to identify missing signatures and race conditions in lines using 'actions/attest-build-provenance' and aligns its findings with SLSA (Supply-chain Levels for Software Artifacts) provenance requirements.

    New in Code Quality & Review