菜单
Use this skill when changing agents-toolbelt release packaging, GoReleaser config, GitHub Actions release flow, `scripts/install.sh`, self-update downloads, checksum verification, cosign signing, provenance attestation, version injection, or installer security behavior.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use this skill when adding or fixing orgs-ai-harness tests, validation rules, generated artifact schema checks, or local quality commands for the Python unittest suite.
Use this skill when changing draft approval, protected artifact metadata, eval replay, verification thresholds, repo-local cache refresh, export policy, or explain output.
Use this skill when modifying GitHub repository discovery, `gh repo list` integration, explicit repo selection, fork/archive filters, clone behavior, or interactive checkbox selection.
Use this skill when changing orgs-ai-harness CLI commands, setup wizard flows, argparse subcommands, user-facing command output, or command error handling in `src/orgs_ai_harness/cli.py`.
Use this skill when editing `harness.yml` parsing, repo registry mutations, org pack initialization, repo coverage statuses, or config round-trip behavior in orgs-ai-harness.
Use this skill when adding or fixing orgs-ai-harness tests, validation rules, generated artifact schema checks, or local quality commands for the Python unittest suite.
| name | atb-release-installer-security |
| description | Use this skill when changing agents-toolbelt release packaging, GoReleaser config, GitHub Actions release flow, `scripts/install.sh`, self-update downloads, checksum verification, cosign signing, provenance attestation, version injection, or installer security behavior. |
Preserve secure installation and update behavior for released atb binaries.
Use for .goreleaser.yaml, .github/workflows/release.yml, .github/workflows/ci.yml, scripts/install.sh, internal/selfupdate, release docs, or checksum/signing changes.
scripts/install.shinternal/selfupdate/selfupdate.gointernal/selfupdate/selfupdate_test.go.goreleaser.yaml.github/workflows/release.yml.github/workflows/ci.ymlREADME.md installation sectionCHANGELOG.md./cmd/atb into atb for linux/darwin and amd64/arm64.-X main.version={{ .Version }}.atb_{{ .Os }}_{{ .Arch }}.tar.gz.checksums.txt is SHA256, cosign signs the checksum artifact, and GitHub Actions attests dist/*.tar.gz.scripts/install.sh downloads archive plus checksums and verifies before install.internal/selfupdate fetches GitHub Releases, verifies checksums, size-limits downloads, and replaces the current executable.~/.local/bin; root installs to /usr/local/bin; never invoke sudo automatically.bash -n scripts/install.shgo test ./internal/selfupdategoreleaser checkmake verifyscripts/install.sh; it downloads released binaries.atb update must reject development builds where version == "dev".If release tooling such as GoReleaser or cosign is unavailable locally, run the Go and shell validations that do not require those binaries and state the skipped release-tool check.