@haolin-ai/skillman 1.0.2 → 1.0.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haolin-ai/skillman",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "A CLI tool to install AI agent skills across multiple platforms",
   "type": "module",
   "bin": {

package/src/cli.js

@@ -6,6 +6,7 @@ import fs from 'fs/promises';
 import path from 'path';
 import { fileURLToPath } from 'url';
 import { select, confirm, input, Separator, checkbox } from '@inquirer/prompts';
+import pkg from '../package.json' with { type: 'json' };
 import { scanSkills } from './scanner.js';
 import { installSkill } from './installer.js';
 import { loadAgents } from './config.js';
@@ -14,7 +15,7 @@ import { loadHistory, addWorkspace, saveLastUsed } from './history.js';
 import { downloadSkill, parseUrl, cleanupDownloads } from './downloader.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const VERSION = '1.0.0';
+const VERSION = pkg.version || '1.0.0';
 
 // ANSI colors
 const c = {

package/src/downloader.js

@@ -3,7 +3,7 @@
  * Supports GitHub shorthand, full URLs, and git URLs
  */
 
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 import fs from 'fs/promises';
 import path from 'path';
 import os from 'os';
@@ -73,10 +73,11 @@ export async function downloadSkill(inputUrl) {
   const downloadDir = path.join(TEMP_DIR, `${repoName}-${timestamp}`);
 
   try {
-    // Clone repository
-    execSync(`git clone --depth 1 "${parsed.url}" "${downloadDir}"`, {
+    // Clone repository using execFileSync for better security
+    execFileSync('git', ['clone', '--depth', '1', parsed.url, downloadDir], {
       stdio: 'pipe',
-      timeout: 60000
+      timeout: 60000,
+      windowsHide: true  // Hide console window on Windows
     });
 
     // If subPath specified, return that subdirectory

package/src/history.js

@@ -7,7 +7,17 @@ import fs from 'fs/promises';
 import path from 'path';
 import os from 'os';
 
-const HISTORY_FILE = path.join(os.homedir(), '.config', 'skillman', 'history.json');
+// Get config directory based on platform
+function getConfigDir() {
+  if (process.platform === 'win32') {
+    // Windows: %APPDATA%/skillman
+    return path.join(process.env.APPDATA || os.homedir(), 'skillman');
+  }
+  // macOS/Linux: ~/.config/skillman (XDG)
+  return path.join(os.homedir(), '.config', 'skillman');
+}
+
+const HISTORY_FILE = path.join(getConfigDir(), 'history.json');
 const MAX_HISTORY_SIZE = 10;
 
 async function ensureDir() {