@haolin-ai/skillman 1.0.3 → 1.0.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haolin-ai/skillman",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "A CLI tool to install AI agent skills across multiple platforms",
   "type": "module",
   "bin": {

package/src/cli.js

@@ -6,6 +6,7 @@ import fs from 'fs/promises';
 import path from 'path';
 import { fileURLToPath } from 'url';
 import { select, confirm, input, Separator, checkbox } from '@inquirer/prompts';
+import pkg from '../package.json' with { type: 'json' };
 import { scanSkills } from './scanner.js';
 import { installSkill } from './installer.js';
 import { loadAgents } from './config.js';
@@ -14,17 +15,7 @@ import { loadHistory, addWorkspace, saveLastUsed } from './history.js';
 import { downloadSkill, parseUrl, cleanupDownloads } from './downloader.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
-
-// Read version from package.json
-let VERSION = '1.0.0';
-try {
-  const pkgPath = path.join(__dirname, '..', 'package.json');
-  const pkgContent = await fs.readFile(pkgPath, 'utf8');
-  const pkg = JSON.parse(pkgContent);
-  VERSION = pkg.version || '1.0.0';
-} catch {
-  // Fallback to default version
-}
+const VERSION = pkg.version || '1.0.0';
 
 // ANSI colors
 const c = {

package/src/downloader.js

@@ -3,7 +3,7 @@
  * Supports GitHub shorthand, full URLs, and git URLs
  */
 
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 import fs from 'fs/promises';
 import path from 'path';
 import os from 'os';
@@ -41,8 +41,8 @@ export function parseUrl(url) {
     };
   }
 
-  // Regular git URLs
-  if (url.startsWith('https://') || url.startsWith('git@') || url.startsWith('http://')) {
+  // Regular git URLs (https, http, git@, ssh://)
+  if (url.startsWith('https://') || url.startsWith('git@') || url.startsWith('http://') || url.startsWith('ssh://')) {
     // Remove .git suffix if present for consistency
     const cleanUrl = url.replace(/\.git$/, '');
     return { type: 'git', url: cleanUrl + '.git', subPath: null };
@@ -73,10 +73,11 @@ export async function downloadSkill(inputUrl) {
   const downloadDir = path.join(TEMP_DIR, `${repoName}-${timestamp}`);
 
   try {
-    // Clone repository
-    execSync(`git clone --depth 1 "${parsed.url}" "${downloadDir}"`, {
+    // Clone repository using execFileSync for better security
+    execFileSync('git', ['clone', '--depth', '1', parsed.url, downloadDir], {
       stdio: 'pipe',
-      timeout: 60000
+      timeout: 60000,
+      windowsHide: true  // Hide console window on Windows
     });
 
     // If subPath specified, return that subdirectory

package/src/history.js

@@ -7,7 +7,17 @@ import fs from 'fs/promises';
 import path from 'path';
 import os from 'os';
 
-const HISTORY_FILE = path.join(os.homedir(), '.config', 'skillman', 'history.json');
+// Get config directory based on platform
+function getConfigDir() {
+  if (process.platform === 'win32') {
+    // Windows: %APPDATA%/skillman
+    return path.join(process.env.APPDATA || os.homedir(), 'skillman');
+  }
+  // macOS/Linux: ~/.config/skillman (XDG)
+  return path.join(os.homedir(), '.config', 'skillman');
+}
+
+const HISTORY_FILE = path.join(getConfigDir(), 'history.json');
 const MAX_HISTORY_SIZE = 10;
 
 async function ensureDir() {