install

One folder. Just Python.

Python 3.9 or later on Linux and macOS. Standard library only: nothing else to install, no service, no telemetry.

Get it

git clone https://github.com/cloudbustinguk/jankhunt42.git ~/.config/opencode/skills/jankhunt42
alias jankhunt42="python3 ~/.config/opencode/skills/jankhunt42/scripts/jankhunt42"
jankhunt42 --version

Any folder works. Or download the source tarball from the latest release, verify it (below) and run python3 scripts/jankhunt42. The opt-in sandbox also needs podman or docker.

As an agent skill

Tool	Put the folder in
Claude Code	`.claude/skills/jankhunt42/`
Cursor	`.cursor/skills/jankhunt42/`
Codex CLI	`.codex/skills/jankhunt42/`
OpenCode	`.opencode/skills/jankhunt42/`

Then ask in your own words: “is my app safe to share?” The skill never runs your code without permission. User-wide folders are in the README.

Verify a release

gh attestation verify jankhunt42-<version>.tar.gz -R cloudbustinguk/jankhunt42

Each release tarball carries a GitHub Artifact Attestation (keyless Sigstore). It proves the tarball came from the repository’s CI at the tagged commit, nothing more.

Gate CI

python3 .opencode/skills/jankhunt42/scripts/jankhunt42 passport . --profile citizen --fail-on block

Everything is advisory until you add --fail-on. A full GitHub Actions workflow, configuration and exit codes are in the README. Questions go to GitHub issues.