@seojin08/skill-finder 0.3.2 → 0.3.3

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 새 버전의 항목은 `npm run package`가 내려받기 페이지의 meta.json에 서명과 함께 넣고, 앱의 "새 버전" 표시를 누르면 보입니다. 한 줄이 한 항목입니다.
 
+## 0.3.3 (2026-11-03)
+
+- 스킬 설치에 쓰는 skills CLI를 1.7.6으로 올렸습니다. 저장소 안의 바로가기(symlink)를 통해 스킬 폴더 밖의 파일이 함께 복사될 수 있던 보안 문제가 막혔습니다.
+- 이제 Node.js 22.20 이상이 필요합니다. 더 낮은 버전이면 실행할 때 업데이트 안내가 나옵니다.
+
 ## 0.3.2 (2026-11-02)
 
 - 영어·일본어 화면에서 숫자·이름·명령이 끼는 문장이 그 언어의 어순으로 자연스럽게 나옵니다.

package/README.md

@@ -23,7 +23,7 @@ Claude Code 스킬을 한곳에서 찾아 점수·위험 신호와 함께 보고
 
 ### macOS·Linux·Windows (npx)
 
-Node.js 22.18 이상이 있으면 설치 없이 실행합니다. 데이터는 사용자 폴더(macOS `~/Library/Application Support/Skill Finder`, Linux `~/.local/share/skill-finder`, Windows `%LOCALAPPDATA%\SkillFinder\npx-data`)에 남습니다.
+Node.js 22.20 이상이 있으면 설치 없이 실행합니다. 데이터는 사용자 폴더(macOS `~/Library/Application Support/Skill Finder`, Linux `~/.local/share/skill-finder`, Windows `%LOCALAPPDATA%\SkillFinder\npx-data`)에 남습니다.
 
 ```bash
 npx @seojin08/skill-finder
@@ -45,7 +45,7 @@ npx @seojin08/skill-finder stop               # 백그라운드로 켠 앱 끄
 
 ### 소스에서
 
-필요한 것: Node.js 22.18 이상(24 권장), git, Claude Code(`claude` 명령).
+필요한 것: Node.js 22.20 이상(24 권장), git, Claude Code(`claude` 명령).
 
 ```bash
 npm install

package/bin/skill-finder.mjs

@@ -34,7 +34,7 @@ const T = {
 
 공통: --json(기계가 읽는 출력), --port N, --no-open, --lang ko|en|ja
 설치·삭제는 앱 화면의 확인 창에서만 합니다.`,
-    node: (v) => `Node.js ${v}는 너무 오래됐습니다. 22.18 이상이 필요합니다: https://nodejs.org`,
+    node: (v) => `Node.js ${v}는 너무 오래됐습니다. 22.20 이상이 필요합니다: https://nodejs.org`,
     noWeb: '웹 화면이 빌드되지 않았습니다. 먼저 npm run build를 실행하세요.',
     starting: (p) => `Skill Finder를 켜는 중입니다 (127.0.0.1:${p})…`,
     background: (p) => `Skill Finder를 백그라운드로 켰습니다 (127.0.0.1:${p}). 끄려면: skill-finder stop`,
@@ -70,7 +70,7 @@ Usage:
 
 Common: --json (machine-readable), --port N, --no-open, --lang ko|en|ja
 Installing and removing happen only in the app's confirm dialog.`,
-    node: (v) => `Node.js ${v} is too old. 22.18 or later is needed: https://nodejs.org`,
+    node: (v) => `Node.js ${v} is too old. 22.20 or later is needed: https://nodejs.org`,
     noWeb: 'The web app is not built. Run npm run build first.',
     starting: (p) => `Starting Skill Finder (127.0.0.1:${p})…`,
     background: (p) => `Started Skill Finder in the background (127.0.0.1:${p}). To stop it: skill-finder stop`,
@@ -106,7 +106,7 @@ Installing and removing happen only in the app's confirm dialog.`,
 
 共通: --json(機械向け出力), --port N, --no-open, --lang ko|en|ja
 インストールと削除はアプリの確認画面でのみ行います。`,
-    node: (v) => `Node.js ${v} は古すぎます。22.18 以上が必要です: https://nodejs.org`,
+    node: (v) => `Node.js ${v} は古すぎます。22.20 以上が必要です: https://nodejs.org`,
     noWeb: 'Web 画面がビルドされていません。先に npm run build を実行してください。',
     starting: (p) => `Skill Finder を起動しています (127.0.0.1:${p})…`,
     background: (p) => `Skill Finder をバックグラウンドで起動しました (127.0.0.1:${p})。止めるには: skill-finder stop`,
@@ -204,7 +204,7 @@ function readPid() {
 /** Starts the server: in this terminal (`start`), or detached for the read commands. Resolves its port. */
 async function startServer(background) {
   const [major, minor] = process.versions.node.split('.').map(Number);
-  if (major < 22 || (major === 22 && minor < 18)) throw new Error(t.node(process.versions.node));
+  if (major < 22 || (major === 22 && minor < 20)) throw new Error(t.node(process.versions.node));
   if (!existsSync(join(ROOT, 'web', 'dist', 'index.html'))) throw new Error(t.noWeb);
   let port = Number(portArg) || Number(process.env.PORT) || DEFAULT_PORT;
   if (!(await portFree(port))) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seojin08/skill-finder",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Find Claude Code skills across marketplaces, skills.sh and GitHub, see their risk signals, and install them after checking what comes along. Local web app and read-only CLI.",
   "license": "MIT",
   "type": "module",
@@ -8,11 +8,11 @@
     "skill-finder": "bin/skill-finder.mjs"
   },
   "engines": {
-    "node": ">=22.18"
+    "node": ">=22.20"
   },
   "dependencies": {
     "express": "5.3.0",
-    "skills": "1.7.4",
+    "skills": "1.7.6",
     "yaml": "2.9.1",
     "zod": "4.6.7"
   },

package/server/src/config.js

@@ -7,19 +7,31 @@ export const SERVER_DIR = join(ROOT_DIR, 'server');
 export const WEB_DIST_DIR = join(ROOT_DIR, 'web', 'dist');
 /** The release launcher keeps the token outside the app folder (UI debate D-6); from the environment only. */
 export const ENV_PATH = process.env.SKILL_FINDER_ENV_PATH ? resolve(process.env.SKILL_FINDER_ENV_PATH) : join(ROOT_DIR, '.env');
-export const SKILLS_CLI_VERSION = '1.7.4';
 /** The bundled skills CLI: under the app, or wherever npm put it when installed as a package (npx hoists it). */
-export const SKILLS_CLI_PATH = (() => {
-    const local = join(ROOT_DIR, 'node_modules', 'skills', 'bin', 'cli.mjs');
+const SKILLS_DIR = (() => {
+    const local = join(ROOT_DIR, 'node_modules', 'skills');
     if (existsSync(local))
         return local;
     try {
-        return join(dirname(createRequire(import.meta.url).resolve('skills/package.json')), 'bin', 'cli.mjs');
+        return dirname(createRequire(import.meta.url).resolve('skills/package.json'));
     }
     catch {
         return local;
     }
 })();
+export const SKILLS_CLI_PATH = join(SKILLS_DIR, 'bin', 'cli.mjs');
+/**
+ * The version the app runs, read from the bundled package so the commands it shows for running by hand name the same
+ * one (it was written here by hand and could fall behind the package, review 2026-11-03).
+ */
+export const SKILLS_CLI_VERSION = (() => {
+    try {
+        return String(JSON.parse(readFileSync(join(SKILLS_DIR, 'package.json'), 'utf8')).version);
+    }
+    catch {
+        return 'latest'; // no bundled CLI: installing fails anyway, and the shown command still runs
+    }
+})();
 /** Vite dev server port (web/vite.config.ts); allowed as a Host/Origin in --dev mode only. */
 export const DEV_VITE_PORT = 5174;
 function parseEnvFile(text) {

package/server/src/discovery/genericRules.js

@@ -1,5 +1,7 @@
 import { basename, joinPath, skillMdPath } from "./tree.js";
-// Mirrors skills CLI 1.7.4 src/skills.ts (discoverSkills) so that what we list is what `skills add --skill` can install.
+// Mirrors skills CLI 1.7.6 src/skills.ts (discoverSkills) so that what we list is what `skills add --skill` can install.
+// Unchanged since 1.7.4 except two things not mirrored: extra search dirs a repo can list in skills.sh.json (`paths`),
+// and skipping a skill whose name or description is empty once control characters are removed.
 export const SKIP_DIRS = ['node_modules', '.git', 'dist', 'build', '__pycache__'];
 export const AGENT_PROJECT_SKILL_DIRS = [
     '.agents/skills',

package/server/src/install/installed.js

@@ -56,7 +56,7 @@ function readLock(file) {
     }
     return byFolder;
 }
-/** The folder the skills CLI installs a skill into (its `sanitizeName`, skills@1.7.4). */
+/** The folder the skills CLI installs a skill into (its `sanitizeName`, the same in skills@1.7.4 and 1.7.6). */
 export function skillFolderName(name) {
     return name.toLowerCase().replace(/[^a-z0-9._]+/g, '-').replace(/^[.\-]+|[.\-]+$/g, '').slice(0, 255) || 'unnamed-skill';
 }

package/server/src/search/pipeline.js

@@ -1,5 +1,6 @@
 import { createHash } from 'node:crypto';
 import { RISK_ORDER, RISK_RULES_VERSION } from "../analyze/risk.js";
+import { SKILLS_CLI_VERSION } from "../config.js";
 import { basename } from "../discovery/tree.js";
 import { normalizeSkillName, PluginUnavailableError, skillId } from "../indexer.js";
 import { installSummary } from "../install/summary.js";
@@ -132,7 +133,8 @@ export async function runSearch(deps, query, filters, emit) {
     const sources = new Set(filters.sources?.length ? filters.sources : ['marketplace', 'skillssh', 'github']);
     const maxRisk = filters.maxRisk ?? 'medium';
     // `r` is the result-item shape; bump it when items gain fields so cached searches are rebuilt.
-    const key = cacheKey(query, filters, { w: settings.weights, t: !!ctx.config.githubToken, s: minStars, r: RESULTS_VERSION, k: RISK_RULES_VERSION });
+    // c: cached results carry install commands naming the skills CLI version (`npx skills@x.y.z …`)
+    const key = cacheKey(query, filters, { w: settings.weights, t: !!ctx.config.githubToken, s: minStars, r: RESULTS_VERSION, k: RISK_RULES_VERSION, c: SKILLS_CLI_VERSION });
     // The English query for a Korean one goes out first, cached search or not: it comes from the query alone,
     // and the button helps most exactly when there is little else to show.
     const suggestion = koreanSuggestion(query);