@shanmukhdheekonda/skillporter 3.0.0 → 3.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/README.md +156 -63
  2. package/npm/bin/skillporter.pyz +0 -0
  3. package/package.json +2 -1
package/README.md CHANGED
@@ -1,95 +1,151 @@
1
- # Skillporter 3.0
1
+ <div align="center">
2
+ <br />
3
+ <a href="https://www.skillporter.dev">
4
+ <picture>
5
+ <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/Shanmukh-l33t/skillporter/main/website/public/brand/skillporter-lockup.png" />
6
+ <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/Shanmukh-l33t/skillporter/main/website/public/brand/skillporter-lockup-light.png" />
7
+ <img alt="Skillporter" src="https://raw.githubusercontent.com/Shanmukh-l33t/skillporter/main/website/public/brand/skillporter-lockup-light.png" width="380" />
8
+ </picture>
9
+ </a>
10
+ <br /><br />
11
+ <p><strong>ONE SKILL. EVERY AGENT.</strong></p>
12
+ <p>The package manager, dependency resolver, and supply-chain security layer for AI agent skills.</p>
13
+
14
+ <p>
15
+ <a href="https://pypi.org/project/skillporter/"><img src="https://img.shields.io/pypi/v/skillporter?style=flat-square&label=PyPI&color=155BE8" alt="PyPI v3.0.0" /></a>
16
+ <a href="https://www.npmjs.com/package/@shanmukhdheekonda/skillporter"><img src="https://img.shields.io/npm/v/%40shanmukhdheekonda%2Fskillporter?style=flat-square&label=npm&color=1461ED" alt="npm v3.0.0" /></a>
17
+ <a href="https://github.com/Shanmukh-l33t/skillporter/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/Shanmukh-l33t/skillporter/ci.yml?branch=main&style=flat-square&label=CI" alt="CI status" /></a>
18
+ <a href="https://github.com/Shanmukh-l33t/skillporter/blob/main/docs/harnesses/README.md"><img src="https://img.shields.io/badge/harnesses-19%20supported-F18A50?style=flat-square" alt="19 harnesses supported" /></a>
19
+ <a href="https://github.com/Shanmukh-l33t/skillporter/blob/main/pyproject.toml"><img src="https://img.shields.io/badge/runtime%20deps-0-155BE8?style=flat-square" alt="Zero runtime dependencies" /></a>
20
+ <a href="https://github.com/Shanmukh-l33t/skillporter/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-MIT-263249?style=flat-square" alt="MIT License" /></a>
21
+ </p>
22
+
23
+ <p>
24
+ <a href="https://www.skillporter.dev"><strong>Website</strong></a> ·
25
+ <a href="https://www.skillporter.dev/docs"><strong>Documentation</strong></a> ·
26
+ <a href="https://www.skillporter.dev/install"><strong>Install</strong></a> ·
27
+ <a href="#harness-support-matrix-19-harnesses"><strong>19 Harnesses</strong></a> ·
28
+ <a href="https://www.skillporter.dev/docs/security"><strong>Security</strong></a> ·
29
+ <a href="#mcp-server"><strong>MCP Server</strong></a> ·
30
+ <a href="https://www.skillporter.dev/faq"><strong>FAQ</strong></a> ·
31
+ <a href="https://www.skillporter.dev/blog"><strong>Blog</strong></a>
32
+ </p>
33
+ </div>
2
34
 
3
- **The package manager, dependency resolver, and supply-chain security layer for AI agent skills.**
35
+ ---
4
36
 
5
- [![Python 3.9+](https://img.shields.io/badge/python-3.9%2B-blue)](https://www.python.org/)
6
- [![Harnesses: 19 Supported](https://img.shields.io/badge/harnesses-19%20supported-00b4d8)](docs/harnesses/README.md)
7
- [![Zero Runtime Dependencies](https://img.shields.io/badge/dependencies-0-success)](pyproject.toml)
8
- [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
37
+ # Skillporter
9
38
 
10
- ---
39
+ **Skillporter, is the package manager for AI agent skills.** It is a zero runtime dependency CLI and MCP server that installs, pins, audits, synchronizes and rolls back `SKILL.md` packages across 19 AI coding and autonomous agent harnesses, including Claude Code, OpenAI Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, Hermes Agent, OpenHands and Goose.
11
40
 
12
- ## 1. What Is Skillporter?
41
+ ```bash
42
+ uvx skillporter diagnose . # run the CLI without installing it (uv)
43
+ pipx install skillporter # install the CLI globally (PEP 668 safe)
44
+ npx @shanmukhdheekonda/skillporter diagnose . # run the CLI without installing it (npm)
45
+ ```
13
46
 
14
- Skillporter is a lightweight, zero-runtime-dependency CLI and Model Context Protocol (MCP) server that installs, synchronizes, pins, audits, and rolls back `SKILL.md` packages across 19 AI coding and autonomous agent harnesses.
47
+ <p align="center">
48
+ <a href="https://www.skillporter.dev">
49
+ <img src="https://raw.githubusercontent.com/Shanmukh-l33t/skillporter/main/docs/assets/demo.svg" alt="Skillporter 3.0 CLI and multi-harness bridge fan-out" width="100%" />
50
+ </a>
51
+ </p>
15
52
 
16
- ## 2. Why Do I Need It?
53
+ ---
17
54
 
18
- Every AI agent harness reads skills from a different directory (`.claude/skills/`, `.agents/skills/`, `.github/skills/`, `.windsurf/skills/`, `$HERMES_HOME/skills/`, `~/.openclaw/skills/`).
55
+ ## Why skills need a package manager
56
+
57
+ Every AI agent harness reads skills from a different directory (`.claude/skills/`, `.agents/skills/`, `.github/skills/`, `.windsurf/skills/`, `$HERMES_HOME/skills/`, `~/.openclaw/skills/`), and each one resolves them differently.
19
58
 
20
59
  - A skill placed in `.claude/skills/` is invisible to OpenAI Codex, Gemini CLI, Zed, and Windsurf.
21
60
  - Hand-rolled symlinks break inside Docker builds, CI checkouts, `git worktree`, and Windows checkouts.
22
61
  - Manual copies across directories silently drift out of sync across teammates, while naive removals from shared `.agents/skills/` directories break other agents.
62
+ - An upstream skill can change under you between two `sync` runs, and an agent loads whatever it finds into its system context.
23
63
 
24
- ## 3. What Does It Protect Me From?
25
-
26
- Agent skills are untrusted supply-chain packages: agents load `SKILL.md` directly into system context and execute bundled scripts. Skillporter helps defend against:
64
+ Skillporter treats skills the way a package manager treats dependencies: one manifest, one lockfile, one resolution step, and one install path that every harness can read.
27
65
 
28
- - **Silent skill drift and unpinned upstream changes**: `skillporter.lock` pins resolved Git commits, SHA-256 tree digests, and per-file hashes, blocking unexpected upstream mutations during `sync`.
29
- - **Known static supply-chain hazards**: Inspects Python ASTs, JavaScript/TypeScript scripts, Markdown instructions, and bounded Base64/Hex/PowerShell payloads for embedded credentials, prompt-injection override patterns, hidden Unicode/comments, shell-pipe RCE, unsafe deserialization, symlink escapes, and multi-file staged execution before installation.
30
- - **Unsafe archive & filesystem operations**: Blocks Zip-Slip/Tar-Slip (`../`, `..\`, drive paths, Windows reserved device names, Unicode NFC/NFD collisions, symlinks, special files, decompression bombs) and stages installs transactionally with crash-recovery journals.
31
- - **Unscoped agent filesystem writes**: Constrains `skillporter mcp` to the workspace root with default-deny write permissions (`SKILLPORTER_MCP_ALLOW_WRITES=1` opt-in) and separates conflict overrides (`--force`) from security risk overrides (`--allow-risky`).
66
+ ## What Skillporter does
32
67
 
33
- > **Important Security Note**: Static scanning (`STATIC_SECURITY_ASSESSMENT`) inspects files for known dangerous patterns and structural anomalies. **A clean static scan does not prove or guarantee that a skill is safe at runtime.** Novel natural-language prompt injections or dynamically fetched payloads can still steer an agent at runtime.
68
+ | Capability | How it works |
69
+ |---|---|
70
+ | **Universal source resolution** | Fetches from GitHub shorthand (`owner/repo`), Git URLs, local paths, or archives without executing bundled scripts. |
71
+ | **Shared-path deduplication** | Writes `.agents/skills/<skill>` once across 8 primary harnesses and preserves it during single-harness `remove`. |
72
+ | **Static supply-chain assessment** | Inspects Python ASTs, JS/TS, Markdown instructions, and bounded Base64/Hex/PowerShell payloads before any file is written. |
73
+ | **Deterministic lockfiles** | Pins `resolved_commit`, `tree_hash`, per-file SHA-256 `file_hashes`, and `pin_state` in `skillporter.lock`. |
74
+ | **Crash-safe transactions** | Stages multi-harness installs behind a write-ahead `journal.json` and snapshots replaced copies into `.skillporter/backups/`. |
75
+ | **Hardened MCP server** | Exposes read-only workspace inspection over JSON-RPC 2.0 stdio (`--allow-writes` required for mutations). |
34
76
 
35
- ## 4. How Do I Install It?
77
+ ## Installation
36
78
 
37
79
  ```bash
38
- # Option A: Run immediately without global installation via uvx or npx
80
+ # Option A: run immediately without a global install, via uvx or npx
39
81
  uvx skillporter diagnose .
40
82
  npx @shanmukhdheekonda/skillporter diagnose .
41
83
 
42
- # Option B: Install from PyPI with uv or pipx (PEP 668 safe)
84
+ # Option B: install from PyPI with uv or pipx (PEP 668 safe)
43
85
  uv tool install skillporter
44
86
  pipx install skillporter
45
87
 
46
- # Option C: Standalone verified release installer (Linux & macOS)
47
- # Verifies SHA256SUMS.txt + GitHub OIDC provenance attestation (`gh attestation verify`)
48
- # or an out-of-band pinned digest (`SKILLPORTER_SHA256=<64-hex>`). Never falls back to mutable `main`.
88
+ # Option C: standalone verified release installer (Linux and macOS)
89
+ # Verifies SHA256SUMS.txt and the GitHub OIDC provenance attestation
90
+ # (`gh attestation verify`) or an out-of-band pinned digest
91
+ # (`SKILLPORTER_SHA256=<64-hex>`). Never falls back to mutable `main`.
49
92
  curl -fsSL https://github.com/Shanmukh-l33t/skillporter/releases/download/v3.0.0/install.sh -o install.sh
50
93
  SKILLPORTER_VERSION=v3.0.0 sh install.sh
51
94
  ```
52
95
 
53
- ## 5. How Do I Use It? (60-Second Quick Start)
96
+ Python 3.9 or newer is required, and the standalone installer checks for it before unpacking anything. The package ships with no runtime dependencies, so there is nothing else to audit or pin.
97
+
98
+ ## Quick start (60 seconds)
54
99
 
55
100
  ```bash
56
- # 1. Run the zero-residue interactive demo (heals broken symlinks & SHA-256 drift in a temp dir)
101
+ # 1. Run the zero residue interactive demo (heals broken symlinks and SHA-256 drift in a temp dir)
57
102
  skillporter demo
58
103
 
59
104
  # 2. Install a skill across harnesses (validates spec, runs static security scan, deduplicates .agents/skills)
60
105
  skillporter add anthropics/skills --skill pdf --harness all
61
106
 
62
- # 3. Inspect & security-scan skills (text, JSON, or SARIF 2.1.0 for GitHub Code Scanning)
107
+ # 3. Inspect and security scan skills (text, JSON, or SARIF 2.1.0 for GitHub Code Scanning)
63
108
  skillporter scan .
64
109
  skillporter scan . --format sarif > skillporter.sarif
65
110
 
66
- # 4. Initialize manifest, synchronize transitive dependencies, and verify reproducible lockfile in CI
111
+ # 4. Initialize manifest, synchronize transitive dependencies, and verify the reproducible lockfile in CI
67
112
  skillporter init
68
113
  skillporter sync
69
114
  skillporter lock --check
70
115
 
71
- # 5. Diagnose reachability, audit provenance/override logs, or roll back to a verified snapshot
116
+ # 5. Diagnose reachability, audit provenance and override logs, or roll back to a verified snapshot
72
117
  skillporter diagnose .
73
118
  skillporter audit .
74
119
  skillporter rollback pdf
75
120
  ```
76
121
 
77
- ---
122
+ ## Supply chain security
78
123
 
79
- ## Core Differentiators
124
+ Agent skills are untrusted supply chain packages: an agent loads `SKILL.md` directly into its system context and executes bundled scripts. Skillporter is built around that assumption rather than around convenience.
80
125
 
81
- - **Multi-Harness Management**: Writes shared `.agents/skills/` once across 8 primary harnesses while preserving shared directories when individual harnesses are removed.
82
- - **Deterministic Lockfiles (`skillporter.lock`)**: Pins `resolved_commit`, `tree_hash`, per-file SHA-256 `file_hashes`, `pin_state` (`PINNED_COMMIT` / `PINNED_CONTENT` / `UNPINNED_MUTABLE`), dependencies, and adapter version.
83
- - **Reproducible Synchronization**: `skillporter sync` honors locked Git commit SHAs even when upstream branches move, and rejects unexpected upstream content changes without `--force`.
84
- - **Multi-Layer Static Security Assessment**: Combines Python AST analysis, JS/TS checks, Markdown prompt/delegation inspection, bounded Base64/Hex/PowerShell decoding, cross-file chain detection, completeness tracking (`INCOMPLETE_ASSESSMENT` on truncated/unreadable files), and optional NVIDIA SkillSpector integration.
85
- - **SHA-256 Drift & Duplicate Detection**: `diagnose`, `status`, and `doctor` detect diverging copies across harnesses and duplicate loading within the same harness.
86
- - **Transactional Rollback & Crash Recovery**: Stages replacements in `.skillporter/tmp/txn-*` with a write-ahead `journal.json` and snapshots prior versions in `.skillporter/backups/` for atomic `skillporter rollback`.
126
+ - **Silent skill drift and unpinned upstream changes**: `skillporter.lock` pins resolved Git commits, SHA-256 tree digests, and per-file hashes, blocking unexpected upstream mutations during `sync`.
127
+ - **Known static supply chain hazards**: inspects Python ASTs, JavaScript and TypeScript scripts, Markdown instructions, and bounded Base64, Hex and PowerShell payloads for embedded credentials, prompt injection override patterns, hidden Unicode and comments, shell pipe RCE, unsafe deserialization, symlink escapes, and multi-file staged execution before installation.
128
+ - **Unsafe archive and filesystem operations**: blocks Zip-Slip and Tar-Slip inputs (`../`, `..\`, drive paths, Windows reserved device names, Unicode NFC/NFD collisions, symlinks, special files, decompression bombs) and stages installs transactionally with crash recovery journals.
129
+ - **Unscoped agent filesystem writes**: constrains `skillporter mcp` to the workspace root with default-deny write permissions (`SKILLPORTER_MCP_ALLOW_WRITES=1` opt-in) and separates conflict overrides (`--force`) from security risk overrides (`--allow-risky`).
87
130
 
88
- ---
131
+ > **Important security note**: static scanning (`STATIC_SECURITY_ASSESSMENT`) inspects files for known dangerous patterns and structural anomalies. **A clean static scan is not proof that a skill is safe at runtime.** Novel natural-language prompt injections or dynamically fetched payloads can still steer an agent at runtime.
132
+
133
+ How the scan is graded and where its limits are is documented in [SECURITY.md](https://github.com/Shanmukh-l33t/skillporter/blob/main/SECURITY.md).
134
+
135
+ ## Lockfile, sync and rollback
136
+
137
+ `skillporter.lock` is the reproducible record of what is installed:
138
+
139
+ - Pins `resolved_commit`, `tree_hash`, per-file SHA-256 `file_hashes`, `pin_state` (`PINNED_COMMIT`, `PINNED_CONTENT` or `UNPINNED_MUTABLE`), dependencies, and adapter version.
140
+ - `skillporter sync` honors locked Git commit SHAs even when upstream branches move, and rejects unexpected upstream content changes without `--force`.
141
+ - `skillporter lock --check` verifies the lockfile in CI and fails on mismatch.
142
+ - `skillporter audit` reports installed origins, lockfile drift, and `.skillporter/audit.jsonl` events, so any risk override is visible after the fact.
143
+
144
+ Rollback is transactional rather than a re-download. Replacements are staged in `.skillporter/tmp/txn-*` behind a write-ahead `journal.json`, prior versions are snapshotted into `.skillporter/backups/`, and `skillporter rollback` restores a skill together with its dependency graph from SHA-256 verified backups.
89
145
 
90
- ## Harness Compatibility & Verification Matrix (19 Harnesses)
146
+ ## Harness support matrix (19 harnesses)
91
147
 
92
- Skillporter distinguishes **support status** (`NATIVE`, `COMPATIBLE`, `ADAPTED`) from **verification evidence** (`RUNTIME_VERIFIED`, `INTEGRATION_TESTED`, `FIXTURE_TESTED`, `DOCUMENTATION_VERIFIED`). An adapter is never marked `RUNTIME_VERIFIED` unless tested against a live harness runtime.
148
+ Skillporter distinguishes **support status** (`NATIVE`, `COMPATIBLE`, `ADAPTED`) from **verification evidence** (`RUNTIME_VERIFIED`, `INTEGRATION_TESTED`, `FIXTURE_TESTED`, `DOCUMENTATION_VERIFIED`). An adapter is never marked `RUNTIME_VERIFIED` unless it has been tested against a live harness runtime.
93
149
 
94
150
  | Harness | Project Path | User / Global Path | Support | Verification Evidence |
95
151
  |---|---|---|---|---|
@@ -113,34 +169,71 @@ Skillporter distinguishes **support status** (`NATIVE`, `COMPATIBLE`, `ADAPTED`)
113
169
  | **Continue** | `.continue/skills/` (`.continue/rules/` adapted) | `~/.continue/skills/` | `COMPATIBLE` | `FIXTURE_TESTED` |
114
170
  | **Aider / AiderDesk** | `.aider-desk/skills/` (`CONVENTIONS.md` adapted) | `~/.aider-desk/skills/` | `ADAPTED` | `FIXTURE_TESTED` |
115
171
 
116
- ---
172
+ Each harness record ships its detection rules, path precedence, and vendor documentation reference. `skillporter matrix` prints the same matrix from the installed CLI, and `skillporter detect` reports which harnesses exist on the current machine.
173
+
174
+ ## MCP server
175
+
176
+ `skillporter mcp` runs a hardened JSON-RPC 2.0 Model Context Protocol server so an agent can query a workspace instead of shelling out. It exposes nine tools (`diagnose`, `detect`, `scan`, `inspect`, `matrix`, `add`, `install`, `sync`, `remove`), is read-only by default, refuses paths outside the workspace root, and requires an explicit opt-in before any write tool becomes available:
117
177
 
118
- ## CLI Reference
178
+ ```bash
179
+ skillporter mcp # read-only
180
+ skillporter mcp --allow-writes # enable write tools
181
+ SKILLPORTER_MCP_ALLOW_WRITES=1 skillporter mcp # same, via the environment
182
+ ```
183
+
184
+ Client setup for Claude Code and other MCP clients is covered in the [MCP guide](https://www.skillporter.dev/docs/mcp).
185
+
186
+ ## CLI reference
119
187
 
120
188
  | Command | Description |
121
189
  |---|---|
122
- | `skillporter add <source>` | Resolve, validate, security-scan, and install skills (`--dry-run`, `--allow-risky`, `--force`, `--json`) |
123
- | `skillporter install <dir>` | Security-scan and install a local skill directory (`--dry-run`, `--allow-risky`, `--force`, `--json`) |
190
+ | `skillporter add <source>` | Resolve, validate, security scan, and install skills (`--dry-run`, `--allow-risky`, `--force`, `--json`) |
191
+ | `skillporter install <dir>` | Security scan and install a local skill directory (`--dry-run`, `--allow-risky`, `--force`, `--json`) |
124
192
  | `skillporter remove <skill>` | Safely remove a skill while preserving shared `.agents/skills/` still owned by other harnesses (`--dry-run`, `--json`) |
125
- | `skillporter sync [path]` | Resolve pinned/transitive dependencies, verify lockfile hashes, and synchronize harnesses (`--dry-run`, `--json`) |
126
- | `skillporter lock [path] [--check]` | Write or CI-verify (`--check`) deterministic `skillporter.lock` |
127
- | `skillporter scan [path]` | Run static security & supply-chain assessment (`--format text\|json\|sarif`, `--max-risk-score`) |
193
+ | `skillporter sync [path]` | Resolve pinned and transitive dependencies, verify lockfile hashes, and synchronize harnesses (`--dry-run`, `--json`) |
194
+ | `skillporter lock [path] [--check]` | Write or CI verify (`--check`) the deterministic `skillporter.lock` |
195
+ | `skillporter scan [path]` | Run static security and supply chain assessment (`--format text\|json\|sarif`, `--max-risk-score`) |
128
196
  | `skillporter audit [path]` | Inspect installed skill origins, security posture, lockfile drift, and `.skillporter/audit.jsonl` events |
129
197
  | `skillporter diagnose [path]` | Check reachability, broken symlinks, SHA-256 content drift, duplicates, and spec compliance |
130
- | `skillporter doctor [path] [--fix]` | Comprehensive workspace health check and tamper-safe repair (`--dry-run`, `--json`) |
131
- | `skillporter status [path]` | Unified workspace manifest, lockfile, per-harness installed/locked state, and drift summary |
132
- | `skillporter update [skill]` | Fetch, security-gate, backup, and update tracked skills (`--dry-run`, `--allow-risky`, `--json`) |
133
- | `skillporter rollback <skill>` | Atomically restore a skill (and dependency graph) from SHA-256-verified `.skillporter/backups/` (`--dry-run`, `--json`) |
198
+ | `skillporter doctor [path] [--fix]` | Comprehensive workspace health check and tamper safe repair (`--dry-run`, `--json`) |
199
+ | `skillporter status [path]` | Unified workspace manifest, lockfile, per harness installed and locked state, and drift summary |
200
+ | `skillporter update [skill]` | Fetch, security gate, back up, and update tracked skills (`--dry-run`, `--allow-risky`, `--json`) |
201
+ | `skillporter rollback <skill>` | Atomically restore a skill and its dependency graph from SHA-256 verified `.skillporter/backups/` (`--dry-run`, `--json`) |
134
202
  | `skillporter validate [path]` | Validate `SKILL.md` against the Agent Skills specification (`--format text\|json\|sarif`) |
135
- | `skillporter inspect <source>` | Inspect local/remote package structure, security posture, and adapted rule previews |
136
- | `skillporter graph [path]` | Render or export (`--json`) topological skill dependency graph |
137
- | `skillporter sandbox run <skill>` | **[Experimental]** Opt-in non-mutating dry-run behavioral trace |
203
+ | `skillporter inspect <source>` | Inspect local or remote package structure, security posture, and adapted rule previews |
204
+ | `skillporter graph [path]` | Render or export (`--json`) the topological skill dependency graph |
205
+ | `skillporter sandbox run <skill>` | **[Experimental]** Opt in, non-mutating dry run behavioral trace |
138
206
  | `skillporter explain <finding>` | Explain any diagnostic, lockfile, validation, or `sec-*` finding code with remediation commands |
139
- | `skillporter search / info / pack / publish` | Search catalog, inspect metadata, build deterministic `.tar.gz` + `provenance.json`, or publish |
140
- | `skillporter detect / matrix / demo` | Detect installed harnesses, print 19-harness matrix, or run zero-residue demo |
141
- | `skillporter mcp` | Run hardened JSON-RPC 2.0 MCP server (read-only by default; `--allow-writes` opt-in) |
142
-
143
- ### Exit Codes
144
- - `0`: Clean / operation succeeded
145
- - `1`: Policy or diagnostic finding (drift, broken symlink, spec error, security block, lockfile mismatch, cycle/conflict)
146
- - `2`: Usage or runtime error (invalid argument, unknown harness, missing path)
207
+ | `skillporter search / info / pack / publish` | Search the catalog, inspect metadata, build a deterministic `.tar.gz` with `provenance.json`, or publish |
208
+ | `skillporter detect / matrix / demo` | Detect installed harnesses, print the 19 harness matrix, or run the zero residue demo |
209
+ | `skillporter mcp` | Run the hardened JSON-RPC 2.0 MCP server (read-only by default; `--allow-writes` opt in) |
210
+
211
+ ### Exit codes
212
+
213
+ - `0`: clean, or the operation succeeded
214
+ - `1`: policy or diagnostic finding (drift, broken symlink, spec error, security block, lockfile mismatch, cycle or conflict)
215
+ - `2`: usage or runtime error (invalid argument, unknown harness, missing path)
216
+
217
+ ## Documentation
218
+
219
+ - [Website](https://www.skillporter.dev): overview, interactive terminal demo, and live 19-harness matrix.
220
+ - [Documentation home](https://www.skillporter.dev/docs): the full guide set, from installation through lockfiles, scanning, and CI.
221
+ - [Install](https://www.skillporter.dev/install): installation channels and provenance verification options.
222
+ - [FAQ](https://www.skillporter.dev/faq): frequently asked questions.
223
+ - [Blog](https://www.skillporter.dev/blog): engineering articles and release write-ups.
224
+
225
+ The same guides are versioned in the repository under [`docs/`](https://github.com/Shanmukh-l33t/skillporter/tree/main/docs) if you prefer to read them on GitHub.
226
+
227
+ ## Contributing
228
+
229
+ Issues and pull requests are welcome. The short version:
230
+
231
+ - Open an issue before starting a large architectural change.
232
+ - New harness adapters must link the vendor documentation that proves the skill discovery path, and must not claim a verification level that has not been tested.
233
+ - The core library stays on the Python standard library, with zero runtime dependencies.
234
+
235
+ Full setup instructions, the required local quality gates, and the adapter checklist are in [CONTRIBUTING.md](https://github.com/Shanmukh-l33t/skillporter/blob/main/CONTRIBUTING.md). To report a vulnerability, follow [SECURITY.md](https://github.com/Shanmukh-l33t/skillporter/blob/main/SECURITY.md) instead of opening a public issue.
236
+
237
+ ## License
238
+
239
+ MIT. See [LICENSE](https://github.com/Shanmukh-l33t/skillporter/blob/main/LICENSE).
package/npm/bin/skillporter.pyz CHANGED
Binary file
package/package.json CHANGED
@@ -1,6 +1,7 @@
1
1
  {
2
2
  "name": "@shanmukhdheekonda/skillporter",
3
- "version": "3.0.0",
3
+ "version": "3.0.1",
4
+ "mcpName": "io.github.Shanmukh-l33t/skillporter",
4
5
  "description": "AI agent skill manager for multi-agent skill synchronization, skill lifecycle management, and deterministic skill lockfile security across 19+ harnesses.",
5
6
  "keywords": [
6
7
  "ai-agent-skill-manager",