@rulemetric/skills-registry 0.1.1 → 0.2.0

package/dist/scoring.js

@@ -0,0 +1,104 @@
+/** Compute a quality score for a skill entry. */
+export function computeQualityScore(skill) {
+    const factors = {
+        popularity: scorePopularity(skill),
+        contentQuality: scoreContentQuality(skill),
+        completeness: scoreCompleteness(skill),
+        recency: scoreRecency(skill),
+    };
+    return {
+        overall: factors.popularity + factors.contentQuality + factors.completeness + factors.recency,
+        factors,
+    };
+}
+function scorePopularity(skill) {
+    const stars = skill.popularity?.stars ?? 0;
+    if (stars >= 10_000)
+        return 25;
+    if (stars >= 5_000)
+        return 20;
+    if (stars >= 1_000)
+        return 15;
+    if (stars >= 100)
+        return 10;
+    if (stars > 0)
+        return 5;
+    return 0;
+}
+function scoreContentQuality(skill) {
+    const content = skill.content;
+    let score = 0;
+    // Length: ideal 200-5000 chars
+    const len = content.length;
+    if (len >= 200 && len <= 5000)
+        score += 8;
+    else if (len >= 100 && len <= 10000)
+        score += 5;
+    else if (len >= 50)
+        score += 2;
+    // Has markdown sections (## headings)
+    const sectionCount = (content.match(/^##\s/gm) ?? []).length;
+    if (sectionCount >= 3)
+        score += 7;
+    else if (sectionCount >= 1)
+        score += 4;
+    // Has code blocks
+    const codeBlocks = (content.match(/```/g) ?? []).length / 2;
+    if (codeBlocks >= 2)
+        score += 5;
+    else if (codeBlocks >= 1)
+        score += 3;
+    // Has lists (actionable content)
+    const listItems = (content.match(/^[-*]\s/gm) ?? []).length;
+    if (listItems >= 5)
+        score += 5;
+    else if (listItems >= 2)
+        score += 3;
+    return Math.min(25, score);
+}
+function scoreCompleteness(skill) {
+    let score = 0;
+    // Has a meaningful description (not just "Imported from...")
+    if (skill.description.length > 20 && !skill.description.startsWith('Imported'))
+        score += 7;
+    else if (skill.description.length > 10)
+        score += 3;
+    // Has tags
+    if (skill.tags.length >= 3)
+        score += 6;
+    else if (skill.tags.length >= 1)
+        score += 3;
+    // Supports multiple tools
+    if (skill.tools.length >= 3)
+        score += 5;
+    else if (skill.tools.length >= 2)
+        score += 3;
+    else
+        score += 1;
+    // Has languages specified
+    if ((skill.languages?.length ?? 0) > 0)
+        score += 4;
+    // Has frameworks specified
+    if ((skill.frameworks?.length ?? 0) > 0)
+        score += 3;
+    return Math.min(25, score);
+}
+function scoreRecency(skill) {
+    if (!skill.updatedAt)
+        return 0;
+    const updated = new Date(skill.updatedAt);
+    const now = new Date();
+    const daysSince = (now.getTime() - updated.getTime()) / (1000 * 60 * 60 * 24);
+    if (daysSince <= 7)
+        return 25;
+    if (daysSince <= 30)
+        return 20;
+    if (daysSince <= 90)
+        return 15;
+    if (daysSince <= 180)
+        return 10;
+    if (daysSince <= 365)
+        return 5;
+    return 2;
+}
+//# sourceMappingURL=scoring.js.map

package/dist/scoring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoring.js","sourceRoot":"","sources":["../src/scoring.ts"],"names":[],"mappings":"AAkBA,iDAAiD;AACjD,MAAM,UAAU,mBAAmB,CAAC,KAAiB;IACnD,MAAM,OAAO,GAAG;QACd,UAAU,EAAE,eAAe,CAAC,KAAK,CAAC;QAClC,cAAc,EAAE,mBAAmB,CAAC,KAAK,CAAC;QAC1C,YAAY,EAAE,iBAAiB,CAAC,KAAK,CAAC;QACtC,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC;KAC7B,CAAC;IAEF,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,cAAc,GAAG,OAAO,CAAC,YAAY,GAAG,OAAO,CAAC,OAAO;QAC7F,OAAO;KACR,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAiB;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,KAAK,IAAI,CAAC,CAAC;IAC3C,IAAI,KAAK,IAAI,MAAM;QAAE,OAAO,EAAE,CAAC;IAC/B,IAAI,KAAK,IAAI,KAAK;QAAE,OAAO,EAAE,CAAC;IAC9B,IAAI,KAAK,IAAI,KAAK;QAAE,OAAO,EAAE,CAAC;IAC9B,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,EAAE,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACxB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAiB;IAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,+BAA+B;IAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3B,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,IAAI;QAAE,KAAK,IAAI,CAAC,CAAC;SACrC,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,KAAK;QAAE,KAAK,IAAI,CAAC,CAAC;SAC3C,IAAI,GAAG,IAAI,EAAE;QAAE,KAAK,IAAI,CAAC,CAAC;IAE/B,sCAAsC;IACtC,MAAM,YAAY,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAC7D,IAAI,YAAY,IAAI,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;SAC7B,IAAI,YAAY,IAAI,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;IAEvC,kBAAkB;IAClB,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5D,IAAI,UAAU,IAAI,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;SAC3B,IAAI,UAAU,IAAI,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;IAErC,iCAAiC;IACjC,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAC5D,IAAI,SAAS,IAAI,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;SAC1B,IAAI,SAAS,IAAI,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;IAEpC,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAiB;IAC1C,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,6DAA6D;IAC7D,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;SACtF,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,EAAE;QAAE,KAAK,IAAI,CAAC,CAAC;IAEnD,WAAW;IACX,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;SAClC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;IAE5C,0BAA0B;IAC1B,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;SACnC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;;QACxC,KAAK,IAAI,CAAC,CAAC;IAEhB,0BAA0B;IAC1B,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;IAEnD,2BAA2B;IAC3B,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;IAEpD,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,YAAY,CAAC,KAAiB;IACrC,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,CAAC,CAAC;IAE/B,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAE9E,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,IAAI,SAAS,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAC/B,IAAI,SAAS,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAC/B,IAAI,SAAS,IAAI,GAAG;QAAE,OAAO,EAAE,CAAC;IAChC,IAAI,SAAS,IAAI,GAAG;QAAE,OAAO,CAAC,CAAC;IAC/B,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/security-scanner.d.ts

@@ -0,0 +1,26 @@
+import type { SkillEntry } from './types.js';
+/** Severity levels for security findings. */
+export type Severity = 'critical' | 'high' | 'medium' | 'low';
+/** A single security finding in a skill. */
+export interface SecurityFinding {
+    rule: string;
+    severity: Severity;
+    message: string;
+    /** The matched text (truncated) */
+    match: string;
+    /** Line number (1-indexed) where the match was found */
+    line: number;
+}
+/** Result of scanning a single skill. */
+export interface ScanResult {
+    skillId: string;
+    passed: boolean;
+    findings: SecurityFinding[];
+}
+/** Scan a single skill's content for security issues. */
+export declare function scanSkill(skill: SkillEntry): ScanResult;
+/** Scan all skills in a registry. Returns results sorted by severity. */
+export declare function scanRegistry(skills: SkillEntry[]): ScanResult[];
+/** Format scan results for console output. */
+export declare function formatScanResults(results: ScanResult[]): string;
+//# sourceMappingURL=security-scanner.d.ts.map

package/dist/security-scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-scanner.d.ts","sourceRoot":"","sources":["../src/security-scanner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,6CAA6C;AAC7C,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE9D,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;CACd;AAED,yCAAyC;AACzC,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B;AA8MD,yDAAyD;AACzD,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CAmEvD;AAMD,yEAAyE;AACzE,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,UAAU,EAAE,CAU/D;AAED,8CAA8C;AAC9C,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,CA2B/D"}

package/dist/security-scanner.js

@@ -0,0 +1,290 @@
+const RULES = [
+    // ── Critical: Prompt Injection ──
+    {
+        id: 'prompt-injection-ignore',
+        severity: 'critical',
+        description: 'Prompt injection: instruction to ignore previous instructions',
+        patterns: [
+            /ignore\s+(all\s+)?(previous|prior|above|earlier)\s+(instructions?|rules?|prompts?|context)/i,
+            /disregard\s+(all\s+)?(previous|prior|above)\s+(instructions?|rules?)/i,
+            /forget\s+(everything|all)\s+(you|that)\s+(were|was|have)/i,
+        ],
+    },
+    {
+        id: 'prompt-injection-roleplay',
+        severity: 'critical',
+        description: 'Prompt injection: role override or jailbreak attempt',
+        patterns: [
+            /you\s+are\s+now\s+(DAN|evil|unrestricted|unfiltered|jailbroken)/i,
+            /entering?\s+(DAN|developer|god)\s+mode/i,
+            /act\s+as\s+(if|though)\s+you\s+(have\s+no|don.?t\s+have)\s+(restrictions|filters|limits)/i,
+            /from\s+now\s+on,?\s+you\s+(will|must|should)\s+(always|never)\s+(obey|follow|listen)/i,
+        ],
+    },
+    {
+        id: 'prompt-injection-system',
+        severity: 'critical',
+        description: 'Prompt injection: fake system message or hidden instruction',
+        patterns: [
+            /<\/?system[-_]?(message|prompt|instruction|reminder)>/i,
+            /\[SYSTEM\]\s*:/i,
+            /\[INST\]|\[\/INST\]/i,
+            /<<\s*SYS\s*>>|<<\s*\/SYS\s*>>/i,
+        ],
+    },
+    // ── High: Dangerous Commands ──
+    {
+        id: 'dangerous-command-rm',
+        severity: 'high',
+        description: 'Dangerous shell command: recursive delete',
+        patterns: [
+            /rm\s+-[a-z]*r[a-z]*f|rm\s+-[a-z]*f[a-z]*r/i,
+            /rm\s+-rf\s+[\/~]/i,
+            /rm\s+-rf\s+\*/i,
+        ],
+    },
+    {
+        id: 'dangerous-command-eval',
+        severity: 'high',
+        description: 'Dangerous command: eval/exec of remote content',
+        patterns: [
+            /curl\s+.*\|\s*(bash|sh|python|node|eval)/i,
+            /wget\s+.*\|\s*(bash|sh|python|node|eval)/i,
+            /\beval\s*\(\s*(fetch|require|import)\b/i,
+        ],
+    },
+    {
+        id: 'dangerous-command-env',
+        severity: 'high',
+        description: 'Command that accesses or exfiltrates environment variables',
+        patterns: [
+            /printenv\s*\|/i,
+            /env\s*\|\s*(curl|wget|nc|ncat)/i,
+            /\$\{?\w*(SECRET|TOKEN|KEY|PASSWORD|CREDENTIAL)\w*\}?\s*.*\b(curl|wget|nc|fetch)\b/i,
+        ],
+    },
+    {
+        id: 'dangerous-command-reverse-shell',
+        severity: 'critical',
+        description: 'Reverse shell or network backdoor pattern',
+        patterns: [
+            /\bnc\s+-[a-z]*e\s/i,
+            /\bncat\b.*\b-e\b/i,
+            /\/dev\/(tcp|udp)\//i,
+            /mkfifo\s+.*\bsh\b/i,
+            /bash\s+-i\s+>&?\s*\/dev\/(tcp|udp)/i,
+        ],
+    },
+    // ── High: Data Exfiltration ──
+    {
+        id: 'exfil-curl-post',
+        severity: 'high',
+        description: 'Potential data exfiltration via HTTP POST',
+        patterns: [
+            /curl\s+.*-X\s*POST\s+https?:\/\/(?!localhost|127\.0\.0\.1)/i,
+            /curl\s+.*--data.*https?:\/\/(?!localhost|127\.0\.0\.1)/i,
+            /fetch\s*\(\s*['"]https?:\/\/(?!localhost).*['"].*method:\s*['"]POST['"]/i,
+        ],
+    },
+    {
+        id: 'exfil-webhook',
+        severity: 'high',
+        description: 'Webhook or external callback URL',
+        patterns: [
+            /https?:\/\/[^\s]*webhook[^\s]*/i,
+            /https?:\/\/[^\s]*\.ngrok\.[^\s]*/i,
+            /https?:\/\/[^\s]*requestbin[^\s]*/i,
+            /https?:\/\/[^\s]*pipedream[^\s]*/i,
+            /https?:\/\/[^\s]*burpcollaborator[^\s]*/i,
+        ],
+    },
+    // ── Medium: Suspicious Patterns ──
+    {
+        id: 'base64-blob',
+        severity: 'medium',
+        description: 'Large base64-encoded blob (potential obfuscated payload)',
+        patterns: [
+            /[A-Za-z0-9+/]{100,}={0,2}/,
+        ],
+    },
+    {
+        id: 'obfuscated-code',
+        severity: 'medium',
+        description: 'Obfuscated or encoded script content',
+        patterns: [
+            /\\x[0-9a-f]{2}(\\x[0-9a-f]{2}){10,}/i,
+            /\\u[0-9a-f]{4}(\\u[0-9a-f]{4}){10,}/i,
+            /String\.fromCharCode\s*\(/i,
+            /atob\s*\(\s*['"][A-Za-z0-9+/]/i,
+        ],
+    },
+    {
+        id: 'hidden-text',
+        severity: 'medium',
+        description: 'Hidden content via HTML comments, zero-width chars, or invisible unicode',
+        patterns: [
+            /<!--[\s\S]{50,}?-->/,
+            /[\u200B\u200C\u200D\uFEFF]{3,}/,
+            /\u2060{3,}/,
+        ],
+        multiline: true,
+    },
+    {
+        id: 'suspicious-url',
+        severity: 'medium',
+        description: 'URL pointing to non-standard domain (potential phishing or C2)',
+        patterns: [
+            /https?:\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/,
+            /https?:\/\/[^\s]*\.(tk|ml|ga|cf|gq|top|xyz|pw|cc)\b/i,
+        ],
+    },
+    // ── Medium: Privilege Escalation ──
+    {
+        id: 'privilege-escalation',
+        severity: 'medium',
+        description: 'Instructions to bypass safety, skip verification, or escalate permissions',
+        patterns: [
+            /--no-verify/i,
+            /--force\s+(push|delete|remove)/i,
+            /chmod\s+777/i,
+            /sudo\s+/i,
+            /disable\s+(security|auth|verification|checking|linting)/i,
+        ],
+    },
+    // ── Low: Suspicious Instructions ──
+    {
+        id: 'credential-request',
+        severity: 'low',
+        description: 'Instruction requesting or handling credentials',
+        patterns: [
+            /\b(paste|enter|provide|share)\s+(your\s+)?(api[- ]?key|token|password|secret|credential)/i,
+            /hardcode\s+(the\s+)?(api[- ]?key|token|password|secret)/i,
+        ],
+    },
+    {
+        id: 'file-system-access',
+        severity: 'low',
+        description: 'Access to sensitive system paths',
+        patterns: [
+            /\/etc\/(passwd|shadow|hosts)/,
+            /~\/\.(ssh|gnupg|aws|config)/,
+            /\$HOME\/\.(ssh|gnupg|aws)/,
+        ],
+    },
+];
+// ── Allowlist ────────────────────────────────────────────────────────────────
+/** Patterns that are false positives in legitimate skill content. */
+const ALLOWLIST = [
+    // Security review checklists naturally mention these concepts
+    { rule: 'credential-request', pattern: /checklist|review|verify|never\s+hardcode/i },
+    // Git convention skills mention --no-verify in a "don't do this" context
+    { rule: 'privilege-escalation', pattern: /never|don.?t|avoid|anti.?pattern/i },
+];
+// ── Scanner ──────────────────────────────────────────────────────────────────
+/** Scan a single skill's content for security issues. */
+export function scanSkill(skill) {
+    const findings = [];
+    const content = skill.content;
+    const lines = content.split('\n');
+    for (const rule of RULES) {
+        if (rule.multiline) {
+            // Match against full content
+            for (const pattern of rule.patterns) {
+                const match = content.match(pattern);
+                if (match) {
+                    // Check allowlist
+                    const lineIdx = content.substring(0, match.index ?? 0).split('\n').length;
+                    const lineText = lines[lineIdx - 1] ?? '';
+                    if (isAllowlisted(rule.id, lineText))
+                        continue;
+                    findings.push({
+                        rule: rule.id,
+                        severity: rule.severity,
+                        message: rule.description,
+                        match: match[0].slice(0, 100),
+                        line: lineIdx,
+                    });
+                }
+            }
+        }
+        else {
+            // Match per-line
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                // Skip content inside code blocks that are clearly examples
+                // (but still flag dangerous commands even in code blocks)
+                for (const pattern of rule.patterns) {
+                    const match = line.match(pattern);
+                    if (match) {
+                        if (isAllowlisted(rule.id, line))
+                            continue;
+                        findings.push({
+                            rule: rule.id,
+                            severity: rule.severity,
+                            message: rule.description,
+                            match: match[0].slice(0, 100),
+                            line: i + 1,
+                        });
+                        break; // One finding per rule per line
+                    }
+                }
+            }
+        }
+    }
+    // Dedupe findings by rule+line
+    const seen = new Set();
+    const deduped = findings.filter(f => {
+        const key = `${f.rule}:${f.line}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+    const hasCritical = deduped.some(f => f.severity === 'critical');
+    const hasHigh = deduped.some(f => f.severity === 'high');
+    return {
+        skillId: skill.id,
+        passed: !hasCritical && !hasHigh,
+        findings: deduped,
+    };
+}
+function isAllowlisted(ruleId, lineText) {
+    return ALLOWLIST.some(a => a.rule === ruleId && a.pattern.test(lineText));
+}
+/** Scan all skills in a registry. Returns results sorted by severity. */
+export function scanRegistry(skills) {
+    const results = skills.map(scanSkill);
+    // Sort: failed first, then by finding count
+    results.sort((a, b) => {
+        if (a.passed !== b.passed)
+            return a.passed ? 1 : -1;
+        return b.findings.length - a.findings.length;
+    });
+    return results;
+}
+/** Format scan results for console output. */
+export function formatScanResults(results) {
+    const lines = [];
+    const passed = results.filter(r => r.passed).length;
+    const failed = results.filter(r => !r.passed).length;
+    const total = results.length;
+    lines.push(`\nSecurity Scan: ${total} skills scanned`);
+    lines.push(`  ${passed} passed, ${failed} failed\n`);
+    for (const result of results) {
+        if (result.findings.length === 0)
+            continue;
+        const icon = result.passed ? '⚠' : '✗';
+        lines.push(`${icon} ${result.skillId}:`);
+        for (const f of result.findings) {
+            const sevLabel = f.severity.toUpperCase().padEnd(8);
+            lines.push(`  [${sevLabel}] L${f.line}: ${f.message}`);
+            lines.push(`             match: "${f.match}"`);
+        }
+        lines.push('');
+    }
+    if (failed > 0) {
+        lines.push(`BLOCKED: ${failed} skill(s) have critical/high findings and will not be included.`);
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=security-scanner.js.map

package/dist/security-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-scanner.js","sourceRoot":"","sources":["../src/security-scanner.ts"],"names":[],"mappings":"AAmCA,MAAM,KAAK,GAAW;IACpB,mCAAmC;IACnC;QACE,EAAE,EAAE,yBAAyB;QAC7B,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,+DAA+D;QAC5E,QAAQ,EAAE;YACR,6FAA6F;YAC7F,uEAAuE;YACvE,2DAA2D;SAC5D;KACF;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,sDAAsD;QACnE,QAAQ,EAAE;YACR,kEAAkE;YAClE,yCAAyC;YACzC,2FAA2F;YAC3F,uFAAuF;SACxF;KACF;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,6DAA6D;QAC1E,QAAQ,EAAE;YACR,wDAAwD;YACxD,iBAAiB;YACjB,sBAAsB;YACtB,gCAAgC;SACjC;KACF;IAED,iCAAiC;IACjC;QACE,EAAE,EAAE,sBAAsB;QAC1B,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,2CAA2C;QACxD,QAAQ,EAAE;YACR,4CAA4C;YAC5C,mBAAmB;YACnB,gBAAgB;SACjB;KACF;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,gDAAgD;QAC7D,QAAQ,EAAE;YACR,2CAA2C;YAC3C,2CAA2C;YAC3C,yCAAyC;SAC1C;KACF;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,4DAA4D;QACzE,QAAQ,EAAE;YACR,gBAAgB;YAChB,iCAAiC;YACjC,oFAAoF;SACrF;KACF;IACD;QACE,EAAE,EAAE,iCAAiC;QACrC,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,2CAA2C;QACxD,QAAQ,EAAE;YACR,oBAAoB;YACpB,mBAAmB;YACnB,qBAAqB;YACrB,oBAAoB;YACpB,qCAAqC;SACtC;KACF;IAED,gCAAgC;IAChC;QACE,EAAE,EAAE,iBAAiB;QACrB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,2CAA2C;QACxD,QAAQ,EAAE;YACR,6DAA6D;YAC7D,yDAAyD;YACzD,0EAA0E;SAC3E;KACF;IACD;QACE,EAAE,EAAE,eAAe;QACnB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,kCAAkC;QAC/C,QAAQ,EAAE;YACR,iCAAiC;YACjC,mCAAmC;YACnC,oCAAoC;YACpC,mCAAmC;YACnC,0CAA0C;SAC3C;KACF;IAED,oCAAoC;IACpC;QACE,EAAE,EAAE,aAAa;QACjB,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,0DAA0D;QACvE,QAAQ,EAAE;YACR,2BAA2B;SAC5B;KACF;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,sCAAsC;QACnD,QAAQ,EAAE;YACR,sCAAsC;YACtC,sCAAsC;YACtC,4BAA4B;YAC5B,gCAAgC;SACjC;KACF;IACD;QACE,EAAE,EAAE,aAAa;QACjB,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,0EAA0E;QACvF,QAAQ,EAAE;YACR,qBAAqB;YACrB,gCAAgC;YAChC,YAAY;SACb;QACD,SAAS,EAAE,IAAI;KAChB;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,gEAAgE;QAC7E,QAAQ,EAAE;YACR,+CAA+C;YAC/C,sDAAsD;SACvD;KACF;IAED,qCAAqC;IACrC;QACE,EAAE,EAAE,sBAAsB;QAC1B,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,2EAA2E;QACxF,QAAQ,EAAE;YACR,cAAc;YACd,iCAAiC;YACjC,cAAc;YACd,UAAU;YACV,0DAA0D;SAC3D;KACF;IAED,qCAAqC;IACrC;QACE,EAAE,EAAE,oBAAoB;QACxB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,gDAAgD;QAC7D,QAAQ,EAAE;YACR,2FAA2F;YAC3F,0DAA0D;SAC3D;KACF;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,kCAAkC;QAC/C,QAAQ,EAAE;YACR,8BAA8B;YAC9B,6BAA6B;YAC7B,2BAA2B;SAC5B;KACF;CACF,CAAC;AAEF,gFAAgF;AAEhF,qEAAqE;AACrE,MAAM,SAAS,GAA6C;IAC1D,8DAA8D;IAC9D,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,2CAA2C,EAAE;IACpF,yEAAyE;IACzE,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,mCAAmC,EAAE;CAC/E,CAAC;AAEF,gFAAgF;AAEhF,yDAAyD;AACzD,MAAM,UAAU,SAAS,CAAC,KAAiB;IACzC,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,6BAA6B;YAC7B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACrC,IAAI,KAAK,EAAE,CAAC;oBACV,kBAAkB;oBAClB,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;oBAC1E,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;oBAC1C,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC;wBAAE,SAAS;oBAE/C,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,IAAI,CAAC,EAAE;wBACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,OAAO,EAAE,IAAI,CAAC,WAAW;wBACzB,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBAC7B,IAAI,EAAE,OAAO;qBACd,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,iBAAiB;YACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACtB,4DAA4D;gBAC5D,0DAA0D;gBAC1D,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBAClC,IAAI,KAAK,EAAE,CAAC;wBACV,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC;4BAAE,SAAS;wBAE3C,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI,EAAE,IAAI,CAAC,EAAE;4BACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;4BACvB,OAAO,EAAE,IAAI,CAAC,WAAW;4BACzB,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;4BAC7B,IAAI,EAAE,CAAC,GAAG,CAAC;yBACZ,CAAC,CAAC;wBACH,MAAM,CAAC,gCAAgC;oBACzC,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,+BAA+B;IAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QAClC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;IAEzD,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,MAAM,EAAE,CAAC,WAAW,IAAI,CAAC,OAAO;QAChC,QAAQ,EAAE,OAAO;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,QAAgB;IACrD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,YAAY,CAAC,MAAoB;IAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAEtC,4CAA4C;IAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACpB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,iBAAiB,CAAC,OAAqB;IACrD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC;IAE7B,KAAK,CAAC,IAAI,CAAC,oBAAoB,KAAK,iBAAiB,CAAC,CAAC;IACvD,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,YAAY,MAAM,WAAW,CAAC,CAAC;IAErD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAE3C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACpD,KAAK,CAAC,IAAI,CAAC,MAAM,QAAQ,MAAM,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACvD,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,YAAY,MAAM,iEAAiE,CAAC,CAAC;IAClG,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/types.d.ts

@@ -31,6 +31,13 @@ export interface SkillEntry {
     };
     /** When this entry was last updated */
     updatedAt: string;
+    /**
+     * Precomputed quality score (0-100, plus per-factor breakdown). Set during
+     * registry build by fetch-registry.ts. Optional so older registries / hand-
+     * written community submissions still validate; consumers should fall back
+     * to computing it on demand when this is absent.
+     */
+    qualityScore?: import('./scoring.js').QualityScore;
 }
 /** Provenance of a skill entry. */
 export interface SkillSource {

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,MAAM,MAAM,MAAM,GACd,aAAa,GACb,QAAQ,GACR,SAAS,GACT,UAAU,GACV,OAAO,GACP,OAAO,GACP,OAAO,GACP,QAAQ,GACR,UAAU,GACV,WAAW,CAAC;AAEhB,6CAA6C;AAC7C,MAAM,MAAM,aAAa,GACrB,UAAU,GACV,UAAU,GACV,WAAW,GACX,MAAM,GACN,UAAU,GACV,SAAS,GACT,cAAc,GACd,QAAQ,GACR,eAAe,GACf,aAAa,GACb,OAAO,CAAC;AAEZ,4CAA4C;AAC5C,MAAM,WAAW,UAAU;IACzB,8CAA8C;IAC9C,EAAE,EAAE,MAAM,CAAC;IACX,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,wBAAwB;IACxB,QAAQ,EAAE,aAAa,CAAC;IACxB,sBAAsB;IACtB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,wCAAwC;IACxC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,+CAA+C;IAC/C,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,wCAAwC;IACxC,MAAM,EAAE,WAAW,CAAC;IACpB,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,UAAU,CAAC,EAAE;QACX,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,mCAAmC;AACnC,MAAM,WAAW,WAAW;IAC1B,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,yBAAyB;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,+BAA+B;AAC/B,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,UAAU,EAAE,CAAC;CACtB;AAED,6BAA6B;AAC7B,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,4CAA4C;AAC5C,MAAM,WAAW,cAAc;IAC7B,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,uCAAuC;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB;IACvB,eAAe,EAAE,aAAa,CAAC;IAC/B,2CAA2C;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,MAAM,MAAM,MAAM,GACd,aAAa,GACb,QAAQ,GACR,SAAS,GACT,UAAU,GACV,OAAO,GACP,OAAO,GACP,OAAO,GACP,QAAQ,GACR,UAAU,GACV,WAAW,CAAC;AAEhB,6CAA6C;AAC7C,MAAM,MAAM,aAAa,GACrB,UAAU,GACV,UAAU,GACV,WAAW,GACX,MAAM,GACN,UAAU,GACV,SAAS,GACT,cAAc,GACd,QAAQ,GACR,eAAe,GACf,aAAa,GACb,OAAO,CAAC;AAEZ,4CAA4C;AAC5C,MAAM,WAAW,UAAU;IACzB,8CAA8C;IAC9C,EAAE,EAAE,MAAM,CAAC;IACX,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,wBAAwB;IACxB,QAAQ,EAAE,aAAa,CAAC;IACxB,sBAAsB;IACtB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,wCAAwC;IACxC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,+CAA+C;IAC/C,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,wCAAwC;IACxC,MAAM,EAAE,WAAW,CAAC;IACpB,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,UAAU,CAAC,EAAE;QACX,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,cAAc,EAAE,YAAY,CAAC;CACpD;AAED,mCAAmC;AACnC,MAAM,WAAW,WAAW;IAC1B,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,yBAAyB;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,+BAA+B;AAC/B,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,UAAU,EAAE,CAAC;CACtB;AAED,6BAA6B;AAC7B,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,4CAA4C;AAC5C,MAAM,WAAW,cAAc;IAC7B,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,uCAAuC;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB;IACvB,eAAe,EAAE,aAAa,CAAC;IAC/B,2CAA2C;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB"}

package/package.json

@@ -1,17 +1,36 @@
 {
   "name": "@rulemetric/skills-registry",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "publishConfig": {
     "access": "public"
   },
   "files": [
-    "dist"
+    "dist",
+    "discovered-sources.json"
   ],
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./scoring": {
+      "types": "./dist/scoring.d.ts",
+      "default": "./dist/scoring.js"
+    },
+    "./types": {
+      "types": "./dist/types.d.ts",
+      "default": "./dist/types.js"
+    }
+  },
   "dependencies": {
-    "gray-matter": "^4.0.3"
+    "@octokit/plugin-retry": "^8.1.0",
+    "@octokit/plugin-throttling": "^11.0.3",
+    "gray-matter": "^4.0.3",
+    "octokit": "^5.0.5",
+    "p-limit": "^7.3.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
@@ -23,6 +42,7 @@
   "scripts": {
     "build": "tsc",
     "type-check": "tsc --noEmit",
-    "fetch": "tsx src/fetch-registry.ts"
+    "fetch": "tsx src/fetch-registry.ts",
+    "discover": "tsx src/discover-sources.ts"
   }
 }