Skip to main content

TraceMantle

TraceMantle checks SKILL.md files for developers who write or maintain agent skills, finding invalid frontmatter, missing files, and portability problems before commit or CI. Optional evidence tracking helps you check whether earlier results still apply after a skill or its helpers change.

Quick start

Requires Python 3.10 or later. Create an isolated environment and install the published release:

python -m venv .venv
source .venv/bin/activate
python -m pip install tracemantle==1.8.0
tracemantle hello/SKILL.md

Use the path to your own skill in the last command. On Windows PowerShell, activate with .venv\Scripts\Activate.ps1. Need a first file? Copy the small getting-started example.

Basic validation runs locally with no account, evaluator, signing key, or evidence policy. The default token estimate is offline.

Read the result

The getting-started example produces:

✔ PASS  hello/SKILL.md
            · info              description.quality-score  Description quality score: 95/100.

Checked 1 file: 1 passed, 0 failed

This file has no validation errors. The score is heuristic advice. For failures, fix the reported rule at the named file and line, then rerun. Passing file validation does not prove that a skill behaves correctly in a live agent.

Scan a directory with tracemantle skills/. Errors return a nonzero exit code; add --strict to fail on warnings too. Use --format json for structured results or --help for options.

Optional evidence checks

Use evidence checks when a release needs approved results or you need to detect helper changes that invalidate earlier results. The evidence workflow distinguishes manual approval from protected automation and neutral JSON imports.

Per-check maintenance reuse remains experimental. In the maintainer SARIF study, TraceMantle and a simple cache made the same justified skips, but both were slower than fresh execution.

Task guides

Contribute · Report an issue · Changelog · MIT license

Metadata

Release files for tracemantle 1.8.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for tracemantle 1.8.0
File Size Uploaded Provenance Actions
tracemantle-1.8.0.tar.gz 11.2 MB With provenance Details for tracemantle-1.8.0.tar.gz

Built distribution (wheel)

Table of built distributions (wheels) for tracemantle 1.8.0
File Interpreter ABI Platform Actions
tracemantle-1.8.0-py3-none-any.whl Python 3 none any Details for tracemantle-1.8.0-py3-none-any.whl

Total release size: 11.4 MB

Release files / tracemantle-1.8.0.tar.gz

Download URL tracemantle-1.8.0.tar.gz
Size 11.2 MB
Tags Source
SHA-256 checksum
How to use checksums
8ac3ccd2228f1b9e53bd9f804371f12a771a067d39e9bd895ec8753de9099823
BLAKE2b-256 checksum
How to use checksums
03198c24a25cfff873bc18fb38678c1205ef10f1379e55c4247e78aaeec3818d
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.14

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Nov 11, 2026.

Transparency log

Release files / tracemantle-1.8.0-py3-none-any.whl

Download URL tracemantle-1.8.0-py3-none-any.whl
Size 170.6 kB
Tags Python 3
SHA-256 checksum
How to use checksums
ce6b992171f16495fb1a41284df5474a0a87be921c92efe9264a474e3fc0aa44
BLAKE2b-256 checksum
How to use checksums
1e1712f9be72c458220c1df00b11d1f3b399b1d6a26715e7930d47c12165c0eb
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.14

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Nov 11, 2026.

Transparency log

Security for tracemantle 1.8.0

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Full provenance

Both files in this release have been uploaded with provenance metadata.

Select from 2 files

Attestation for tracemantle-1.8.0.tar.gz

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Nov 11, 2026.

Transparency log

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page