Skip to content

v2.1.0: adopt official Splunk agent-skill conventions - #2

Merged
dd-Splunk merged 1 commit into
mainfrom
feat/skill-v2.1-official-patterns
Oct 28, 2026
Merged

dd-Splunk merged 1 commit into
mainfrom
feat/skill-v2.1-official-patterns

Conversation

@dd-Splunk

Copy link
Copy Markdown
Owner

Summary

Compared with splunk/splunk-agent-skills and adopted the patterns that fit a small, script-backed skill:

  • SKILL.md structure: metadata.splunk block (domain, products, entities, triggers, not-for, outcomes), Prerequisites, When to Use with explicit routing to lifecycle/product skills, Boundaries, Examples, Troubleshooting.
  • Multi-agent: agents/openai.yaml interface file; install via npx skills add dd-Splunk/splunkbase-skill (verified it discovers the skill).
  • Evals: evals.json in the official format (4 positive and 3 negative trigger evals, 5 behaviour evals incl. no-URLs-from-memory, no credentials in chat, unknown compatibility, scope).
  • Docs/policy: references/sources.md (URLs checked), SECURITY.md, SUPPORT.md (unofficial project).
  • Security hardening (from their "retrieved content is untrusted" stance): titles, slugs and release names from the API are stripped of control characters/newlines and capped at 120 chars in both scripts, so a hostile listing cannot inject lines or escape codes into output. Contract tests cover both implementations and fail when the sanitizer is removed.

Not adopted: license/allowed-tools frontmatter (no LICENSE chosen yet; allowed-tools names are agent-specific), a skills/ subfolder layout (root layout already works with the installer), and their long advisory-answer protocol (this skill is a lookup, not an advisor).

Test plan

  • 95 offline tests pass (86 before); live API tests pass
  • shellcheck, actionlint, ruff clean; mutation check on the sanitizer
  • .skill archive contains agents/openai.yaml, excludes evals.json, SECURITY/SUPPORT
  • CI green; evals need an eval runner (only structure-checked)
  • After merge: tag v2.1.0

🤖 Generated with Claude Code

- SKILL.md: metadata.splunk block, Prerequisites/When to Use/routing,
  Boundaries, Examples, Troubleshooting; agents/openai.yaml for other agents
- evals.json (trigger + behaviour evals), references/sources.md,
  SECURITY.md, SUPPORT.md
- Sanitize API-supplied titles, slugs and release names in both scripts
  (control characters, newlines, length) so listings cannot inject output
- Tests for the new metadata, interface file, evals and sanitization

Co-Authored-By: Claude Code <noreply@anthropic.com>
@dd-Splunk
dd-Splunk merged commit 4382cd1 into main Oct 28, 2026
6 checks passed
@dd-Splunk
dd-Splunk deleted the feat/skill-v2.1-official-patterns branch October 28, 2026 13:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant