@rhize/skill-forge 0.20.0 → 0.20.1

package/README.md

@@ -2,9 +2,9 @@
 
 **The supply-chain gate for agent skills.**
 
-Source version: `@rhize/skill-forge@0.20.0` (2026-09-14), 0.x beta (Pro features free until 1.0).
-Npm publication is a separate tag-driven step; `npm view @rhize/skill-forge version` reports the
-latest published version.
+Published version: `@rhize/skill-forge@0.20.0` (2026-09-14), 0.x beta (Pro features free until 1.0).
+Released through the tag/OIDC workflow; `npm view @rhize/skill-forge version` reports the
+current published version.
 
 > This project is unrelated to the [`skillforge`](https://www.npmjs.com/package/skillforge)
 > package on npm, which is a Claude Skills *evaluation* framework. `skill-forge` (this package,
@@ -128,7 +128,10 @@ per-feature implementation status.
   outright; a lower-severity finding produces `warn`; a clean scan is `pass`.
 - **npm-sourced MCP candidates:** fetched with `--ignore-scripts`, and every tarball member path is
   validated before extraction (a path-traversal guard).
-- **SkillSpector, when installed,** is purely additive — its absence never blocks the gate.
+- **SkillSpector, when installed,** adds its individual findings, including modern `issues`
+  reports. Its absence preserves the built-in-only gate. A failed, malformed or incomplete
+  installed scan is an explicit HIGH `skillspector-unavailable` finding, which blocks under
+  default strictness. A LOW aggregate score cannot hide a HIGH individual issue.
 
 See [docs/security-model.md](docs/security-model.md) for the full rule table and current status of
 each check.

package/dist/cli.js

@@ -1515,10 +1515,68 @@ function which(cmd) {
   }
   return void 0;
 }
-function normalizeSeverity(sev) {
-  const s = (sev ?? "").toUpperCase();
-  if (s === "LOW" || s === "MEDIUM" || s === "HIGH" || s === "CRITICAL") return s;
-  return "MEDIUM";
+function scannerUnavailable(targetPath) {
+  return {
+    severity: "HIGH",
+    rule: "skillspector-unavailable",
+    file: targetPath,
+    detail: "Installed SkillSpector failed or returned an unsupported/incomplete report; external safety evidence is unavailable."
+  };
+}
+function reportRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Invalid report record");
+  return value;
+}
+function reportSeverity(value) {
+  if (typeof value !== "string") throw new Error("Missing severity");
+  const severity = value.toUpperCase();
+  if (severity === "LOW" || severity === "MEDIUM" || severity === "HIGH" || severity === "CRITICAL") return severity;
+  throw new Error("Unknown severity");
+}
+function parseSkillSpectorReport(value, targetPath) {
+  try {
+    const report = reportRecord(value);
+    const modern = "issues" in report;
+    const raw = modern ? report.issues : report.filtered_findings ?? report.findings;
+    if (!Array.isArray(raw)) throw new Error("Missing findings");
+    const findings = raw.map((entry) => {
+      const issue = reportRecord(entry);
+      const rule = modern ? issue.id : issue.rule_id;
+      const detail = modern ? issue.finding ?? issue.explanation : issue.message;
+      if (typeof rule !== "string" || !rule || typeof detail !== "string") throw new Error("Invalid finding");
+      const location = modern ? reportRecord(issue.location) : void 0;
+      if (location && typeof location.file !== "string") throw new Error("Invalid location");
+      const line = location?.start_line;
+      return {
+        severity: reportSeverity(issue.severity),
+        rule,
+        file: location?.file ?? targetPath,
+        detail: typeof line === "number" && Number.isInteger(line) && line > 0 ? `${line}: ${detail}` : detail
+      };
+    });
+    const assessment = modern ? reportRecord(report.risk_assessment) : void 0;
+    const summary = assessment?.severity ?? report.risk_severity;
+    if (modern || summary !== void 0) {
+      const severity = reportSeverity(summary);
+      if (severity !== "LOW") findings.push({
+        severity,
+        rule: "skillspector-summary",
+        file: targetPath,
+        detail: `SkillSpector aggregate risk: ${severity}.`
+      });
+    }
+    if (modern) {
+      const completeness = reportRecord(report.analysis_completeness);
+      if (report.execution_successful !== true || completeness.is_complete !== true || completeness.execution_successful === false) {
+        findings.push(scannerUnavailable(targetPath));
+      }
+    } else if (report.execution_successful === false) {
+      findings.push(scannerUnavailable(targetPath));
+    }
+    return findings;
+  } catch {
+    return [scannerUnavailable(targetPath)];
+  }
 }
 async function scanWithSkillSpector(targetPath) {
   const bin = which("skillspector");
@@ -1528,16 +1586,15 @@ async function scanWithSkillSpector(targetPath) {
       timeout: 6e4,
       maxBuffer: 10 * 1024 * 1024
     });
-    const parsed = JSON.parse(stdout);
-    const raw = parsed.filtered_findings ?? parsed.findings ?? [];
-    return raw.map((f) => ({
-      severity: normalizeSeverity(f.severity),
-      rule: f.rule_id ?? "skillspector",
-      file: targetPath,
-      detail: f.message ?? ""
-    }));
-  } catch {
-    return [];
+    return parseSkillSpectorReport(JSON.parse(stdout), targetPath);
+  } catch (error) {
+    const failed = scannerUnavailable(targetPath);
+    try {
+      const stdout = error.stdout;
+      return stdout ? [...parseSkillSpectorReport(JSON.parse(stdout), targetPath), failed] : [failed];
+    } catch {
+      return [failed];
+    }
   }
 }
 async function scanSafety(targetPath, strictness = DEFAULT_STRICTNESS, capturedFiles) {