Skulto Release Cert

• Before tagging a new skulto release or updating the Homebrew tap, to confirm all quality gates are green.
• When you need a deterministic, step-by-step agent-runnable process to verify CLI behavior across warm state, clean-slate, migration, and reconciliation scenarios.
• When you want automated security scanning (hardcoded secrets, SQL injection, command injection, credential files) combined with a manual review checklist before shipping.
• When onboarding a new certifier (human or agent) who needs a canonical, self-contained reference for what "release-ready" means for skulto.

• If you are not working on the skulto project — this skill is tightly coupled to skulto's codebase, CLI commands, and database schema.
• If you only need a quick smoke test; this is a full certification run and is intentionally thorough and time-consuming.
• If the skulto binary has not been built yet — Pass 1 must succeed before the later passes are meaningful.

Certification is divided into three sequential passes: unit tests, lint, and cross-compile (Pass 1); a comprehensive CLI walkthrough (Pass 2); and a security audit (Pass 3). All three must be green before a CERTIFIED FOR RELEASE verdict is issued.

Pass 1 cross-compiles the skulto binary for four targets — linux/amd64, linux/arm64, darwin/amd64, and darwin/arm64 — with CGO_ENABLED=0. All four must succeed before proceeding.

Pass 2 covers warm state, clean-slate lifecycle, migration, reconciliation, stale skill cleanup, security scan flows, MCP metadata, emoji-free output, and "remember install locations" logic. A state snapshot is taken before any tests and verified against a diff after all tests, ensuring the cert process is non-destructive.

Multiple Pass 2 sub-sections test that skulto's built-in security scanner behaves correctly: clean skills install silently, quarantined skills block or warn, and scan results appear during add, pull, ingest, URL install, sync, and save flows.

Pass 3 runs grep-based scans for hardcoded secrets, SQL string interpolation, command injection patterns, and committed credential files, supplemented by a manual review checklist covering parameterized queries, exec.Command usage, os.RemoveAll scope, and PostHog key injection via ldflags.

After all three passes, the skill produces a formatted certification table listing every check with PASS/FAIL/SKIPPED/CLEAN/FOUND status, the version, date, and certifier, culminating in a clear CERTIFIED FOR RELEASE or BLOCKED verdict.

An AI agent executes all three passes against a built skulto binary, working through each numbered step and table row, and produces the final certification summary without human intervention (except the explicitly flagged MANUAL-only interactive terminal steps).

Before updating the Homebrew tap formula to point at a new release, a developer or agent runs this skill from the skulto repo root to confirm the build is clean, all CLI paths behave as expected, and no security regressions exist.

After significant changes to skulto's install, scan, or reconciliation logic, the CLI walkthrough passes (2a–2t) surface regressions across the full command surface, including edge cases like stale DB records, quarantined skill blocking, and remembered install location behavior.

A new team member or agent unfamiliar with skulto's release criteria uses this skill as the single authoritative reference for what constitutes a shippable build, including pre-existing known issues that are tracked but not blocking.