tacit-knowledge-worker

A unified AI Engineering Operating System that orchestrates the full lifecycle of agent creation - extracting tacit knowledge, structuring the Agent OS, and...

Security Scan

The skill's files, templates, and runtime instructions are coherent with its stated purpose (building an Agent OS and verifying agent actions), but there are a few practical inconsistencies and a small operational risk to be aware of before use.

Purpose & Capability

The skill's declared purpose (tacit knowledge extraction, building an Agent OS, pre-deployment audits) matches the provided templates, references, and the Verify Action script. However, the runtime instructions call for running a Python script (verify_action.py) but the skill declares no required binaries (e.g., python) and the manifest contains scripts/verify_action.md (the script embedded in a markdown file) rather than an explicit executable .py file—this is an operational inconsistency (the skill expects a runnable script but doesn't declare or install the runtime).

Instruction Scope

The SKILL.md stays within the stated scope: it prescribes a structured interview, template-based file generation, and a pre-deployment verification step. The Verify Action script reads files given by the agent (checks existence, content substring, and modification time). That behavior is coherent with the Proof-of-Action goal, but it means the verification step will read arbitrary file paths the agent claims — if misused or run without human oversight it could expose sensitive file contents. The SKILL.md correctly mandates pausing for user confirmation before proceeding in Phase 1, which reduces risk.

Install Mechanism

This is an instruction-only skill with no install spec and no network downloads. No install-related risks are present in the metadata. The only executable content is a Python script included as text inside the repo (embedded in scripts/verify_action.md).

Credentials

The skill does not request environment variables, credentials, config paths, or external services. The templates and checklists reference local files and policies only, which is proportionate to its purpose.

Persistence & Privilege

The skill is not marked always:true and uses default autonomous invocation settings. Nothing in the skill attempts to modify other skills or request persistent system-wide privileges.

Assessment

This skill appears to be what it claims — a structured authoring + governance toolkit for building agent 'OS' artifacts. Before installing/using it: 1) Note that the workflow expects you to run a Python verification script (verify_action.py) but the skill doesn't declare Python as a required binary and the manifest contains the script as a .md file; ensure a trusted copy of the .py file exists and that you have Python available. 2) The verification step requires supplying absolute file paths and will read file contents to verify claims — do not allow the agent to verify or be asked to prove actions on sensitive system files or secrets. 3) Keep the mandatory human confirmation steps (Phase 1 pause) in place; do not auto-approve syntheses or proofs without manual review. 4) If you plan to run this in an automated environment, create explicit guards that restrict which file-paths the agent may claim and verify, and ensure logging/audit trails are protected. If you want me to, I can: (a) produce a runnable verify_action.py file extracted from the embedded code, (b) suggest a minimal runtime/permission policy for safe use, or (c) produce checklist items to harden the verification step against accidental exposure.

AI Engineering Operating System (The Unified Architecture)

This skill represents a paradigm shift from "Prompt Engineering" to "Knowledge Engineering." It combines three foundational capabilities—Tacit Knowledge Extraction, Agent OS Architecture, and Anti-Micromanagement Governance—into a single, self-improving cognitive architecture.

The Six Paradigm Shifts

1. From Prompt Engineering to Knowledge Engineering: The prompt is the last step. The real work is upstream extraction and structuring.
2. From Agent as Tool to Agent as Apprentice: The agent interviews the master (SECI model), learns the craft, and operates under supervision.
3. From Trust by Default to Trust by Proof: Trust is an engineering artifact earned through the Mandatory Proof of Action Protocol.
4. From One-Shot to Living Configuration: The agent's OS is a living document that evolves through continuous feedback.
5. From Automation to Augmented Cognition: Human judgment and agent capability are structurally interleaved.
6. From Scaling Agents to Scaling Intent: You are not scaling compute; you are scaling the human's extracted judgment.

The Unified Workflow

When tasked with building or deploying a new AI agent, execute this three-phase pipeline:

Phase 1: The Extraction Interview (Tacit Knowledge Extractor)

Do not accept vague prompts. Ask the user for a concrete past example of the task. Conduct a structured interview using the references/extraction_framework.md to map workflows, decision rules, and edge cases. Synthesize the answers and generate the templates/tacit_profile_template.md. Crucial Step: You must pause and ask the user to confirm the synthesis before proceeding.

Phase 2: The OS Build (Agent OS Builder)

Convert the confirmed Tacit Profile into a structured, version-controllable file system. Generate the core OS files using the templates in templates/os_files/:

• SOUL.md: Personality and boundaries.
• AGENTS.md: Step-by-step workflows and IF/THEN decision rules.
• USER.md: User preferences and quality standards.
• HEARTBEAT.md: Periodic task checklist.
• TOOLS.md: Authorized tools and constraints.

Phase 3: The Pre-Deployment Audit (Anti-Micromanagement Guard)

Before the agent is allowed to execute tasks, enforce the governance framework using references/governance_checklist.md. Ensure the agent is configured to follow the Mandatory Proof of Action Protocol: every completion claim must include an exact file path, actual content confirmation, and a timestamp. Run the scripts/verify_action.py script to validate the agent's output.

The Self-Improving Feedback Loop

This unified system learns from its own deployments. After every full cycle:

1. Extraction Loop: Did the user have to correct the synthesis in Phase 1? If yes, update the extraction_framework.md with better probing questions.
2. Architecture Loop: Were any OS files missing necessary context in Phase 2? If yes, update the OS templates.
3. Governance Loop: Did the agent attempt to hallucinate execution in Phase 3? If yes, strengthen the governance_checklist.md.

Resources

• References: extraction_framework.md, os_architecture_guide.md, governance_checklist.md
• Templates: tacit_profile_template.md, audit_report_template.md, and the os_files/ directory.
• Scripts: verify_action.py (The Proof of Action validator).