---
title: "artifact-customs"
description: "Clear, adopt, maintain, replace, and retire exact third-party software components under explicit policy."
canonical: https://agentpluginsdirectory.com/plugins/artifact-customs--nisavid
last-updated: 2026-10-21
---

# artifact-customs
Clear, adopt, maintain, replace, and retire exact third-party software components under explicit policy.
- Slug: artifact-customs--nisavid
- Publisher: Ivan D Vasin
- Repository: https://github.com/nisavid/provingkit
- Manifest: plugins/artifact-customs/plugin.json
- Version: 1.0.0
- License: MIT
- Category (editorial): security
- Skills: 3 (adopting-third-party-components, assessing-third-party-components, maintaining-third-party-components)
- MCP servers: 0
- Stars: 0
- Repository created: 2026-09-01
- Repository last pushed: 2026-10-21
- Publisher type: User
- Listing: https://agentpluginsdirectory.com/plugins/artifact-customs--nisavid
- Schema: https://agent-plugins.org/schemas/1.0.0/plugin.schema.json

## What artifact-customs does, in the publisher's words

Artifact Customs governs inbound third-party software components from first clearance through retirement. It treats every component as an exact external identity or byte sequence crossing a declared trust boundary.

The root plugin.json is the canonical Agent Plugins v1 package identity. Codex reads its com.openai interface extension and the standard skills; Claude Code uses the.claude-plugin/plugin.json identity projection and the same skills. Each skill carries ordinary local projections of the shared contracts it reads so standard clients do not depend on package-sibling access. Release validation requires every projection to match its single authored package-level source byte for byte.

The plugin has three public skills:

- assessing-third-party-components freezes and evaluates a candidate without mutation;

From the project README, punctuation lightly normalized. Full text: https://raw.githubusercontent.com/nisavid/provingkit/HEAD/plugins/artifact-customs/README.md

## Skills

- adopting-third-party-components: Use when explicitly authorized to add an exact third-party software component or materially revise its trust policy, including a first package, vendored artifact, Action, image, toolchain, CLI, or agent-plugin pin. Establishes the durable policy and first admitted identity; do not use for read-only…
- assessing-third-party-components: Use for a standalone ungoverned read-only clearance of an exact third-party software component or immutable artifact, including provenance, license, dependencies, and conformance checks before adoption or maintenance. Includes packages, vendored artifacts, Actions, images, toolchains, CLIs, and age…
- maintaining-third-party-components: Use when updating, investigating an advisory for a third-party software component governed by a named existing policy, replacing, sealing, retiring, or completing its dependency PR. Includes routine Dependabot work and scheduled or foreign-harness wake-ups; do not use to invent a new trust boundary…

Descriptions come from the frontmatter of each SKILL.md, punctuation lightly normalized.