npm - @shanmukhdheekonda/skillporter - Versions diffs - 2.0.3 → 3.0.0 - Mend

@shanmukhdheekonda/skillporter 2.0.3 → 3.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/README.md CHANGED Viewed

@@ -1,158 +1,117 @@
-# SKILLPORTER
+# Skillporter 3.0
-## ONE SKILL. EVERY AGENT.
-**Install, manage, validate, security-scan, and synchronize AI-agent skills across the entire agent ecosystem.**
+**The package manager, dependency resolver, and supply-chain security layer for AI agent skills.**
 [![Python 3.9+](https://img.shields.io/badge/python-3.9%2B-blue)](https://www.python.org/)
-[![Harnesses: 19 Verified](https://img.shields.io/badge/harnesses-19%20supported-00b4d8)](docs/harnesses/README.md)
-[![Tests: 115 Passing](https://img.shields.io/badge/tests-115%20passing-brightgreen)](tests/)
-[![Zero Dependencies](https://img.shields.io/badge/dependencies-0-success)](pyproject.toml)
+[![Harnesses: 19 Supported](https://img.shields.io/badge/harnesses-19%20supported-00b4d8)](docs/harnesses/README.md)
+[![Zero Runtime Dependencies](https://img.shields.io/badge/dependencies-0-success)](pyproject.toml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
-<p align="center">
-  <img src="docs/assets/demo.svg" alt="Skillporter Terminal Demonstration" width="860" />
-</p>
-Every AI coding and autonomous agent harness reads skills from a **different directory**:
-| Harness | Project Path | Personal / Global Path | Support |
-|---|---|---|---|
-| **Claude Code** | `.claude/skills/` | `~/.claude/skills/` | `NATIVE` |
-| **OpenAI Codex** | `.agents/skills/` | `~/.agents/skills/` | `NATIVE` |
-| **Cursor** | `.agents/skills/`, `.cursor/skills/` (+2 compat) | `~/.agents/skills/`, `~/.cursor/skills/` | `NATIVE` |
-| **GitHub Copilot** | `.github/skills/`, `.agents/skills/` (+1 compat) | `~/.copilot/skills/`, `~/.agents/skills/` | `NATIVE` |
-| **Gemini CLI** | `.agents/skills/`, `.gemini/skills/` | `~/.agents/skills/`, `~/.gemini/skills/` | `NATIVE` |
-| **Google Antigravity** | `.agents/skills/` (+1 compat) | `~/.gemini/config/skills/` | `NATIVE` |
-| **Windsurf** | `.windsurf/skills/` | `~/.codeium/windsurf/skills/` | `NATIVE` |
-| **Cline** | `.cline/skills/`, `.clinerules/skills/` (+2 compat) | `~/.cline/skills/` | `NATIVE` |
-| **Roo Code** | `.roo/skills/`, `.agents/skills/` | `~/.roo/skills/`, `~/.agents/skills/` | `NATIVE` |
-| **OpenCode** | `.opencode/skills/`, `.agents/skills/` (+1 compat) | `~/.config/opencode/skills/` (+2 compat) | `NATIVE` |
-| **Zed** | `.agents/skills/` | `~/.agents/skills/` | `NATIVE` |
-| **Replit Agent** | `.agents/skills/`, `.claude/skills/` | `~/.config/agents/skills/` | `NATIVE` |
-| **JetBrains Junie** | `.junie/skills/`, `.agents/skills/` | `~/.junie/skills/`, `~/.agents/skills/` | `NATIVE` |
-| **Hermes Agent** | `.hermes/skills/` | `$HERMES_HOME/skills/<category>/<name>` | `NATIVE` |
-| **OpenClaw** | `.openclaw/skills/`, `skills/`, `.agents/skills/` | `~/.openclaw/skills/`, `~/.agents/skills/` | `NATIVE` |
-| **OpenHands** | `.agents/skills/`, `.openhands/skills/` | `~/.agents/skills/`, `~/.openhands/skills/` | `NATIVE` |
-| **Goose** | `.agents/skills/`, `.goose/skills/` | `~/.agents/skills/`, `~/.config/goose/skills/` | `NATIVE` |
-| **Continue** | `.continue/skills/` (`.continue/rules/` adapted) | `~/.continue/skills/` | `COMPATIBLE` |
-| **Aider / AiderDesk** | `.aider-desk/skills/` (`CONVENTIONS.md` adapted) | `~/.aider-desk/skills/` | `ADAPTED` |
-A skill authored for Claude Code in `.claude/skills/` is silently invisible to OpenAI Codex, Gemini CLI, Zed, and Windsurf. Hand-rolled symlinks break in Docker build contexts, `git worktree`, and Windows checkouts — while manual copies silently drift out of sync.
-**Skillporter solves the entire lifecycle:** one command resolves skills from GitHub or local paths, runs a static security and supply-chain scan, deduplicates shared destinations (`.agents/skills`), tracks ownership and SHA-256 content hashes, detects content drift across copies, and supports deterministic lockfiles (`skillporter.lock`) and transactional rollback.
 ---
-## One-Command Installation & Zero-Install Execution
+## 1. What Is Skillporter?
-```bash
-# 1. Run immediately via uvx from PyPI (zero install)
-uvx skillporter diagnose .
+Skillporter is a lightweight, zero-runtime-dependency CLI and Model Context Protocol (MCP) server that installs, synchronizes, pins, audits, and rolls back `SKILL.md` packages across 19 AI coding and autonomous agent harnesses.
-# 2. Install globally via uv tool or pipx from PyPI
-uv tool install skillporter
-pipx install skillporter
+## 2. Why Do I Need It?
-# 3. Run via npx from npm (or directly from GitHub)
-npx @shanmukhdheekonda/skillporter diagnose .
-npx github:Shanmukh-l33t/skillporter diagnose .
+Every AI agent harness reads skills from a different directory (`.claude/skills/`, `.agents/skills/`, `.github/skills/`, `.windsurf/skills/`, `$HERMES_HOME/skills/`, `~/.openclaw/skills/`).
-# 4. Install globally via curl (Linux/macOS — bypasses PEP 668 externally-managed-environment)
-curl -fsSL https://raw.githubusercontent.com/Shanmukh-l33t/skillporter/main/install.sh | sh
-```
+- A skill placed in `.claude/skills/` is invisible to OpenAI Codex, Gemini CLI, Zed, and Windsurf.
+- Hand-rolled symlinks break inside Docker builds, CI checkouts, `git worktree`, and Windows checkouts.
+- Manual copies across directories silently drift out of sync across teammates, while naive removals from shared `.agents/skills/` directories break other agents.
+## 3. What Does It Protect Me From?
+Agent skills are untrusted supply-chain packages: agents load `SKILL.md` directly into system context and execute bundled scripts. Skillporter helps defend against:
-### Native Agent Integration (MCP Server)
+- **Silent skill drift and unpinned upstream changes**: `skillporter.lock` pins resolved Git commits, SHA-256 tree digests, and per-file hashes, blocking unexpected upstream mutations during `sync`.
+- **Known static supply-chain hazards**: Inspects Python ASTs, JavaScript/TypeScript scripts, Markdown instructions, and bounded Base64/Hex/PowerShell payloads for embedded credentials, prompt-injection override patterns, hidden Unicode/comments, shell-pipe RCE, unsafe deserialization, symlink escapes, and multi-file staged execution before installation.
+- **Unsafe archive & filesystem operations**: Blocks Zip-Slip/Tar-Slip (`../`, `..\`, drive paths, Windows reserved device names, Unicode NFC/NFD collisions, symlinks, special files, decompression bombs) and stages installs transactionally with crash-recovery journals.
+- **Unscoped agent filesystem writes**: Constrains `skillporter mcp` to the workspace root with default-deny write permissions (`SKILLPORTER_MCP_ALLOW_WRITES=1` opt-in) and separates conflict overrides (`--force`) from security risk overrides (`--allow-risky`).
-Register Skillporter directly inside Claude Code, Codex, Cursor, Windsurf, or Hermes so your agent can diagnose, scan, and synchronize skills on command:
+> **Important Security Note**: Static scanning (`STATIC_SECURITY_ASSESSMENT`) inspects files for known dangerous patterns and structural anomalies. **A clean static scan does not prove or guarantee that a skill is safe at runtime.** Novel natural-language prompt injections or dynamically fetched payloads can still steer an agent at runtime.
+## 4. How Do I Install It?
 ```bash
-claude mcp add skillporter -- uvx skillporter mcp
-codex mcp add skillporter -- uvx skillporter mcp
-```
+# Option A: Run immediately without global installation via uvx or npx
+uvx skillporter diagnose .
+npx @shanmukhdheekonda/skillporter diagnose .
----
+# Option B: Install from PyPI with uv or pipx (PEP 668 safe)
+uv tool install skillporter
+pipx install skillporter
+# Option C: Standalone verified release installer (Linux & macOS)
+# Verifies SHA256SUMS.txt + GitHub OIDC provenance attestation (`gh attestation verify`)
+# or an out-of-band pinned digest (`SKILLPORTER_SHA256=<64-hex>`). Never falls back to mutable `main`.
+curl -fsSL https://github.com/Shanmukh-l33t/skillporter/releases/download/v3.0.0/install.sh -o install.sh
+SKILLPORTER_VERSION=v3.0.0 sh install.sh
+```
-## 60-Second Quick Start
+## 5. How Do I Use It? (60-Second Quick Start)
 ```bash
-# 1. Detect which AI agent harnesses are installed or active in your repo
-skillporter detect .
+# 1. Run the zero-residue interactive demo (heals broken symlinks & SHA-256 drift in a temp dir)
+skillporter demo
-# 2. Install a skill from GitHub across all detected harnesses (validates + security-scans first)
+# 2. Install a skill across harnesses (validates spec, runs static security scan, deduplicates .agents/skills)
 skillporter add anthropics/skills --skill pdf --harness all
-# 3. Diagnose reachability, broken symlinks, duplicate loading, and SHA-256 content drift
-skillporter diagnose .
-# 4. Run a static supply-chain security scan on any skill directory
+# 3. Inspect & security-scan skills (text, JSON, or SARIF 2.1.0 for GitHub Code Scanning)
 skillporter scan .
+skillporter scan . --format sarif > skillporter.sarif
-# 5. Initialize skillporter.yaml, synchronize teammates, and pin skillporter.lock
+# 4. Initialize manifest, synchronize transitive dependencies, and verify reproducible lockfile in CI
 skillporter init
 skillporter sync
-skillporter lock
+skillporter lock --check
+# 5. Diagnose reachability, audit provenance/override logs, or roll back to a verified snapshot
+skillporter diagnose .
+skillporter audit .
+skillporter rollback pdf
 ```
 ---
-## Real-World Evidence: Why Skillporter Exists
-Built after auditing the exact failure modes reported across upstream agent ecosystems:
+## Core Differentiators
-- **[agentskills/agentskills#15](https://github.com/agentskills/agentskills/issues/15)** (130+ comments) — *"Claude is looking at `.claude/skills/` and GitHub Copilot is looking at `.github/skills/`… create symlinks that match the specific folder of each harness"*
-- **[thn-inc/claude-tweaks#3000](https://github.com/thn-inc/claude-tweaks/issues/3000)** — skill resolution misses `.agents/skills` when the symlink is absent or inside a **git worktree**
-- **[openclaw/openclaw#14593](https://github.com/openclaw/openclaw/issues/14593)** — symlinked skill installs fail inside Docker build contexts
-- **[squne121/loop-protocol](https://github.com/squne121/loop-protocol/issues)** — replacing broken Codex skill symlinks with a fail-closed `.agents/skills` bridge
+- **Multi-Harness Management**: Writes shared `.agents/skills/` once across 8 primary harnesses while preserving shared directories when individual harnesses are removed.
+- **Deterministic Lockfiles (`skillporter.lock`)**: Pins `resolved_commit`, `tree_hash`, per-file SHA-256 `file_hashes`, `pin_state` (`PINNED_COMMIT` / `PINNED_CONTENT` / `UNPINNED_MUTABLE`), dependencies, and adapter version.
+- **Reproducible Synchronization**: `skillporter sync` honors locked Git commit SHAs even when upstream branches move, and rejects unexpected upstream content changes without `--force`.
+- **Multi-Layer Static Security Assessment**: Combines Python AST analysis, JS/TS checks, Markdown prompt/delegation inspection, bounded Base64/Hex/PowerShell decoding, cross-file chain detection, completeness tracking (`INCOMPLETE_ASSESSMENT` on truncated/unreadable files), and optional NVIDIA SkillSpector integration.
+- **SHA-256 Drift & Duplicate Detection**: `diagnose`, `status`, and `doctor` detect diverging copies across harnesses and duplicate loading within the same harness.
+- **Transactional Rollback & Crash Recovery**: Stages replacements in `.skillporter/tmp/txn-*` with a write-ahead `journal.json` and snapshots prior versions in `.skillporter/backups/` for atomic `skillporter rollback`.
 ---
-## Key Features
-### 1. Universal Source Resolution (`skillporter add`)
-Install skills from:
-- **GitHub shorthand**: `skillporter add owner/repo` or `skillporter add owner/repo/skills/my-skill@v1.2.0`
-- **GitHub tree URLs**: `skillporter add https://github.com/owner/repo/tree/main/skills/my-skill`
-- **Git URLs & commit SHAs**: `skillporter add https://example.com/skills.git --ref ceb64c6`
-- **ZIP & tar.gz archives**: `skillporter add ./bundle.zip` (hardened against Zip-Slip and symlink escapes)
-- **Registry slugs**: `skillporter add registry:anthropics/skills`
-- **Local directories**: `skillporter add ./authoring/my-skill --harness claude-code --harness codex`
-### 2. SHA-256 Content-Drift & Duplicate Detection (`skillporter diagnose`)
-Competing tools copy files once and report success forever. Skillporter hashes every file inside every installed skill copy (`SHA-256`).
-- **Drift**: If you edit `.claude/skills/my-skill/SKILL.md` and forget to update `.agents/skills/my-skill/SKILL.md`, `skillporter diagnose` flags `DRIFT` with the exact diverging hashes and exits `1`.
-- **Duplicate loading**: If a skill is installed in both `.agents/skills` and `.cursor/skills`, `diagnose` flags `DUPLICATE` so Cursor does not load the same skill twice.
-### 3. Static Security & Supply-Chain Protection (`skillporter scan`)
-Agent skills contain natural-language instructions and executable scripts. Before installing any skill, Skillporter inspects all Markdown and script files for:
-- **Embedded secrets & private keys** (`sec-private-key`, `sec-aws-key`, `sec-github-token`, `sec-api-key`)
-- **Prompt injection & covert overrides** (`sec-prompt-override`, `sec-hidden-unicode`, `sec-html-comment-instruction`)
-- **Dangerous execution patterns** (`sec-curl-pipe-sh`, `sec-reverse-shell`, `sec-credential-harvest`, `sec-dynamic-eval`)
-- **Filesystem escapes** (`sec-symlink-escape`, `sec-path-traversal`, `sec-binary-artifact`)
-*Transparency note: Static scanning inspects files for known dangerous patterns and structural escapes; it does not guarantee runtime safety.*
-### 4. Manifest (`skillporter.yaml`), Lockfile (`skillporter.lock`) & Rollback
-Declare your project's skills in `skillporter.yaml`:
-```yaml
-schema_version: 1
-project: acme-platform
-scope: project
-strategy: copy
-security_policy: HIGH
-harnesses:
-  - claude-code
-  - codex
-  - cursor
-  - github-copilot
-skills:
-  - name: skillporter
-    source: Shanmukh-l33t/skillporter/skills/skillporter
-    ref: main
-```
-Run `skillporter sync` to reconcile the workspace, `skillporter lock` to pin exact git commits and SHA-256 tree hashes in `skillporter.lock`, and `skillporter rollback <skill>` to restore the previous snapshot from `.skillporter/backups/` if an update introduces a regression.
+## Harness Compatibility & Verification Matrix (19 Harnesses)
+Skillporter distinguishes **support status** (`NATIVE`, `COMPATIBLE`, `ADAPTED`) from **verification evidence** (`RUNTIME_VERIFIED`, `INTEGRATION_TESTED`, `FIXTURE_TESTED`, `DOCUMENTATION_VERIFIED`). An adapter is never marked `RUNTIME_VERIFIED` unless tested against a live harness runtime.
+| Harness | Project Path | User / Global Path | Support | Verification Evidence |
+|---|---|---|---|---|
+| **Hermes Agent** | `.hermes/skills/` | `$HERMES_HOME/skills/<cat>/<name>` | `NATIVE` | `RUNTIME_VERIFIED` |
+| **Claude Code** | `.claude/skills/` | `~/.claude/skills/` | `NATIVE` | `INTEGRATION_TESTED` |
+| **OpenAI Codex** | `.agents/skills/` | `~/.agents/skills/` | `NATIVE` | `INTEGRATION_TESTED` |
+| **Cursor** | `.agents/skills/`, `.cursor/skills/` (+2 compat) | `~/.agents/skills/`, `~/.cursor/skills/` | `NATIVE` | `INTEGRATION_TESTED` |
+| **GitHub Copilot** | `.github/skills/` (+2 compat) | `~/.copilot/skills/` (+1 compat) | `NATIVE` | `FIXTURE_TESTED` |
+| **Gemini CLI** | `.agents/skills/`, `.gemini/skills/` | `~/.agents/skills/`, `~/.gemini/skills/` | `NATIVE` | `FIXTURE_TESTED` |
+| **Google Antigravity** | `.agents/skills/` (+1 compat) | `~/.gemini/config/skills/` | `NATIVE` | `FIXTURE_TESTED` |
+| **Windsurf** | `.windsurf/skills/` | `~/.codeium/windsurf/skills/` | `NATIVE` | `FIXTURE_TESTED` |
+| **Cline** | `.cline/skills/` (+3 compat) | `~/.cline/skills/` | `NATIVE` | `FIXTURE_TESTED` |
+| **Roo Code** | `.roo/skills/` (+1 compat) | `~/.roo/skills/` (+1 compat) | `NATIVE` | `FIXTURE_TESTED` |
+| **OpenCode** | `.opencode/skills/` (+2 compat) | `~/.config/opencode/skills/` (+2 compat) | `NATIVE` | `FIXTURE_TESTED` |
+| **Zed** | `.agents/skills/` | `~/.agents/skills/` | `NATIVE` | `FIXTURE_TESTED` |
+| **Replit Agent** | `.agents/skills/` (+1 compat) | `~/.config/agents/skills/` | `NATIVE` | `FIXTURE_TESTED` |
+| **JetBrains Junie** | `.junie/skills/` (+1 compat) | `~/.junie/skills/` (+1 compat) | `NATIVE` | `FIXTURE_TESTED` |
+| **OpenClaw** | `.openclaw/skills/` (+2 compat) | `~/.openclaw/skills/` (+1 compat) | `NATIVE` | `FIXTURE_TESTED` |
+| **OpenHands** | `.agents/skills/` (+2 compat) | `~/.agents/skills/` (+1 compat) | `NATIVE` | `FIXTURE_TESTED` |
+| **Goose** | `.agents/skills/` (+1 compat) | `~/.agents/skills/` (+1 compat) | `NATIVE` | `FIXTURE_TESTED` |
+| **Continue** | `.continue/skills/` (`.continue/rules/` adapted) | `~/.continue/skills/` | `COMPATIBLE` | `FIXTURE_TESTED` |
+| **Aider / AiderDesk** | `.aider-desk/skills/` (`CONVENTIONS.md` adapted) | `~/.aider-desk/skills/` | `ADAPTED` | `FIXTURE_TESTED` |
 ---
@@ -160,72 +119,28 @@ Run `skillporter sync` to reconcile the workspace, `skillporter lock` to pin exa
 | Command | Description |
 |---|---|
-| `skillporter add <source>` | Resolve, validate, security-scan, and install skills from GitHub, Git, archive, or local path |
+| `skillporter add <source>` | Resolve, validate, security-scan, and install skills (`--dry-run`, `--allow-risky`, `--force`, `--json`) |
+| `skillporter install <dir>` | Security-scan and install a local skill directory (`--dry-run`, `--allow-risky`, `--force`, `--json`) |
+| `skillporter remove <skill>` | Safely remove a skill while preserving shared `.agents/skills/` still owned by other harnesses (`--dry-run`, `--json`) |
+| `skillporter sync [path]` | Resolve pinned/transitive dependencies, verify lockfile hashes, and synchronize harnesses (`--dry-run`, `--json`) |
+| `skillporter lock [path] [--check]` | Write or CI-verify (`--check`) deterministic `skillporter.lock` |
+| `skillporter scan [path]` | Run static security & supply-chain assessment (`--format text\|json\|sarif`, `--max-risk-score`) |
+| `skillporter audit [path]` | Inspect installed skill origins, security posture, lockfile drift, and `.skillporter/audit.jsonl` events |
 | `skillporter diagnose [path]` | Check reachability, broken symlinks, SHA-256 content drift, duplicates, and spec compliance |
-| `skillporter doctor [path] [--fix]` | Run full workspace health check and optionally auto-repair missing/drifted installs |
-| `skillporter scan [path]` | Run static supply-chain and prompt-injection security assessment |
-| `skillporter validate [path]` | Validate `SKILL.md` frontmatter and body against the [Agent Skills spec](https://agentskills.io/specification) |
-| `skillporter inspect <source>` | Inspect a local or remote skill package (files, scripts, security, adapted previews) before installing |
-| `skillporter detect [path]` | Detect which AI agent harnesses are installed on the machine or active in the project |
-| `skillporter matrix` | Print the 19-harness compatibility and verification matrix (`--json` supported) |
-| `skillporter init [path]` | Generate `skillporter.yaml` from discovered skills and active harnesses |
-| `skillporter sync [path]` | Reconcile workspace skills across target harnesses and update `skillporter.lock` |
-| `skillporter lock [path]` | Write deterministic `skillporter.lock` with SHA-256 content tree hashes |
-| `skillporter list [path]` | List managed and discovered skills with ownership, hashes, and active harnesses |
-| `skillporter update [skill]` | Update tracked skills from their recorded upstream source |
-| `skillporter rollback <skill>` | Restore a skill to its previous backup snapshot in `.skillporter/backups/` |
-| `skillporter install <path>` | Low-level local directory installer (`--strategy copy\|symlink`, `--adapt`, `--force`) |
-| `skillporter remove <skill>` | Remove a skill from target harnesses (`uninstall` alias supported) |
-| `skillporter search [query]` | Search the seed and configured skill registry catalog |
-| `skillporter info <target>` | Show detailed metadata for a harness adapter or registry package |
-| `skillporter pack [path]` | Build an immutable `.tar.gz` release archive and `provenance.json` checksum manifest |
-| `skillporter mcp` | Start the zero-dependency stdio JSON-RPC 2.0 MCP server |
-### Exit Codes (CI Contract)
-- `0` — Clean / all checks passed
-- `1` — Findings detected (missing reachability, content drift, broken symlink, spec error, or security policy block)
-- `2` — Usage or runtime error (invalid path, unknown harness, unsafe overwrite refusal)
----
-## GitHub Action Integration
-Validate `SKILL.md` compliance, scan for security risks, and verify harness reachability automatically on every pull request:
-```yaml
-name: Skillporter Check
-on: [push, pull_request]
-jobs:
-  skills:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: Shanmukh-l33t/skillporter@v2
-        with:
-          command: validate
-          path: .
-          run-security-scan: "true"
-```
----
-## Documentation
-- [Getting Started](docs/getting-started/README.md)
-- [Installation & Distribution (uvx, npx, binaries, MCP)](docs/installation/README.md)
-- [Supported Harnesses & Evidence Directory (19 Harnesses)](docs/harnesses/README.md)
-- [CLI Command Reference](docs/commands/README.md)
-- [Configuration (`skillporter.yaml` & `skillporter.lock`)](docs/configuration/README.md)
-- [Security & Supply-Chain Model](docs/security/README.md)
-- [System Architecture](ARCHITECTURE.md)
-- [Adapter Development SDK](docs/adapters/README.md)
-- [Registry & Immutable Packaging](docs/registry/README.md)
-- [Troubleshooting](docs/troubleshooting/README.md)
-- [Contributing Guide](CONTRIBUTING.md)
-- [Product Roadmap](ROADMAP.md)
----
-## License
-MIT — see [LICENSE](LICENSE).
+| `skillporter doctor [path] [--fix]` | Comprehensive workspace health check and tamper-safe repair (`--dry-run`, `--json`) |
+| `skillporter status [path]` | Unified workspace manifest, lockfile, per-harness installed/locked state, and drift summary |
+| `skillporter update [skill]` | Fetch, security-gate, backup, and update tracked skills (`--dry-run`, `--allow-risky`, `--json`) |
+| `skillporter rollback <skill>` | Atomically restore a skill (and dependency graph) from SHA-256-verified `.skillporter/backups/` (`--dry-run`, `--json`) |
+| `skillporter validate [path]` | Validate `SKILL.md` against the Agent Skills specification (`--format text\|json\|sarif`) |
+| `skillporter inspect <source>` | Inspect local/remote package structure, security posture, and adapted rule previews |
+| `skillporter graph [path]` | Render or export (`--json`) topological skill dependency graph |
+| `skillporter sandbox run <skill>` | **[Experimental]** Opt-in non-mutating dry-run behavioral trace |
+| `skillporter explain <finding>` | Explain any diagnostic, lockfile, validation, or `sec-*` finding code with remediation commands |
+| `skillporter search / info / pack / publish` | Search catalog, inspect metadata, build deterministic `.tar.gz` + `provenance.json`, or publish |
+| `skillporter detect / matrix / demo` | Detect installed harnesses, print 19-harness matrix, or run zero-residue demo |
+| `skillporter mcp` | Run hardened JSON-RPC 2.0 MCP server (read-only by default; `--allow-writes` opt-in) |
+### Exit Codes
+- `0`: Clean / operation succeeded
+- `1`: Policy or diagnostic finding (drift, broken symlink, spec error, security block, lockfile mismatch, cycle/conflict)
+- `2`: Usage or runtime error (invalid argument, unknown harness, missing path)

package/npm/bin/skillporter.pyz CHANGED Viewed

Binary file

package/package.json CHANGED Viewed

@@ -1,8 +1,12 @@
 {
   "name": "@shanmukhdheekonda/skillporter",
-  "version": "2.0.3",
-  "description": "ONE SKILL. EVERY AGENT. Universal package manager, validator, security scanner, and synchronizer for AI-agent skills.",
+  "version": "3.0.0",
+  "description": "AI agent skill manager for multi-agent skill synchronization, skill lifecycle management, and deterministic skill lockfile security across 19+ harnesses.",
   "keywords": [
+    "ai-agent-skill-manager",
+    "multi-agent-skill-synchronization",
+    "skill-lifecycle-management",
+    "skill-lockfile",
     "agent-skills",
     "ai-agents",
     "claude-code",