v1.1.1

publishedstablecli-upload

What the registry recorded: review: First-party built-in (agentry-cli#470, DR-50), published for reading from the bytes the CLI embeds. The one finding, S5 C3 (capability described but not declared, medium), is by design: the application grants this package tools its manifest does not declare (DR-43, DR-39), and the README published with it names them. Known judge pattern, agentry#731. Finding left open on the report.

No security report is shown for a built-in QuickAgent: the application runs its own copy of this package, not this release.

Capabilities

data: files

Declared capabilities are a contract from the author: what this release says it needs, and what scanning and policy check against. The registry cannot enforce them while your QuickAgent runs.

Provenance

Archive digest: sha256:1a4f58329dfb5ff26e15bd55e32959fb695563a876b1ec8fdc5ae2621b7e982b
Attestation: signed (DSSE)
Signing key: -_Ea_eEb6AVt8DSP

agentry verify agentry/knowledge-creator@1.1.1

Check the key id against the registry's published set at /.well-known/agentry/signing-keys.json. A signature proves who built this release, not that its contents are safe.

Manifest

The manifest as the registry validated and stored it, in canonical JSON.

{
  "name": "knowledge-creator",
  "modes": [
    "autonomous"
  ],
  "authors": [
    {
      "name": "Agentry"
    }
  ],
  "license": "MIT",
  "publish": {
    "include": [
      "agent.yaml",
      "INSTRUCTION.md",
      "README.md",
      "LICENSE"
    ]
  },
  "summary": "Builds and extends a knowledge pack: compiles the documents it is given into an LLM wiki of cited pages, section by section.",
  "version": "1.1.1",
  "namespace": "agentry",
  "entrypoints": {
    "instruction": "INSTRUCTION.md"
  },
  "capabilities": {
    "exec": "none",
    "network": {
      "egress": "none"
    },
    "dataAccess": [
      "files"
    ],
    "filesystem": {
      "read": "none",
      "write": "none"
    }
  },
  "schemaVersion": "2"
}