@skillsmith/core 0.12.2 → 0.12.3

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to `@skillsmith/core` are documented here.
 
 ## [Unreleased]
 
+## v0.12.3
+
+- **Add**: `SecurityScanner.weak-passwords.ts` — a generated, versioned list of common weak passwords (vendored from SecLists, hash-pinned, capped to the top 5,000 by frequency rank), built by the new `scripts/gen-weak-password-lexicon.mjs` generator and mirrored byte-identically into the Node and Deno/Supabase edge scanner twins. This wave ships the data pipeline only — no scanner behavior changes; the `sensitive_path` detection change that consumes this data is a separate, follow-on change (SMI-6441 Wave 1)
+- **Added**: SMI-6472 -- new `./utils/skill-name` subpath export (`VALID_SKILL_NAME_RE`, `validateSkillName`), matching the existing narrow-subpath convention (`./services/skill-installation-io`, etc.) rather than requiring consumers to import the full package barrel for a small, dependency-free utility.
+- **Fix**: `scripts/skill-scanner/index.ts` no longer runs its CLI `main()` unconditionally at module-load time — the invocation is guarded by the standard `import.meta.url === \`file://${process.argv[1]}\`` check, so importing the barrel for its exports (types, categorizer, trust-scorer, file-scanner, logger, reporter, scanner) no longer hijacks `process.argv`, runs a scan, or exits the importing process. `main` is now exported, and the `scripts/scan-imported-skills.ts` backwards-compat shim (the `weekly-security-scan.yml` entry point) invokes it explicitly under its own identical guard — direct `npx tsx` execution of either file is unchanged (SMI-6464)
+- **Fix**: `sensitive_path` scanner findings now require nearby action evidence (a verb, shell operator, or imperative framing) before scoring HIGH — a bare mention of a sensitive path in prose or a defensive/documentation context downgrades to MEDIUM instead of triggering the weekly security scan's allowlist-triage cycle (SMI-5207). Adds `SecurityScanner.action-context.ts` (the action-context gate) and `SecurityScanner.value-gate.ts`/`SecurityScanner.prose-lexicon.ts` (per-assignment-segmented value classification), with `patterns.sensitive-path.ts` split out of `patterns.ts` for the pattern family itself. `scanSensitivePaths()`'s severity-message construction now embeds up to 60 chars of the matched content — see `skill-scanner/allowlist.ts`'s updated design-invariant note if authoring a new allowlist entry against a `sensitive_path` message.
+- **Fix**: `multilineTruncated` (set when a scan hits its per-pattern iteration ceiling, so `riskScore` is a known under-count) was computed but never consumed at the quarantine decision — `trust-scorer.ts`'s `shouldQuarantine()` could clear or never apply a quarantine hold based on an incomplete scan. A truncated scan now forces `quarantine: true` before allowlist filtering runs, so an allowlist can no longer clear a scan-integrity hold (SMI-5879, SMI-6020)
+
 ## v0.12.2
 
 - **Feature**: SMI-6343 Wave 4 -- apply_manifest_reconcile tool (#2715)
@@ -380,6 +388,7 @@ All notable changes to `@skillsmith/core` are documented here.
 ## v0.11.6
 
 - **Fix**: Harden manifest concurrency (uninstall lock, temp-file races) (#2331)
+- **Fix**: `scanPatternsWithMultilineSupport` (`security/scanner/SecurityScanner.helpers.ts`) tested each `content`/`both`-scope pattern with a non-global regex `.match()`, returning only the *first* match in the whole document — a real jailbreak/prompt-injection attack repeated later in a long skill could undercount and slip past the quarantine threshold. Rewritten as a per-pattern global-exec loop bounded by `MAX_MULTILINE_LINES_PER_PATTERN` (64, score-neutral) and `MAX_MULTILINE_ITERATIONS_PER_PATTERN` (10,000, wall-clock liveness only, sets `ScanReport.multilineTruncated`); also fixes an off-by-one where a match capturing a leading `(?:^|\n)` anchor reported `.index` at the *previous* line's newline instead of the matched line's own start. `MAX_CONTENT_LENGTH_FOR_REGEX` (pass-1 full-content cap) raised from 10,000 to 1,000,000 chars, closing a truncation blind spot on real-sized SKILL.md files (re-benchmarked: ~56ms worst case at 1MB, linear to 4MB). `multilineTruncated` is now enforced at every quarantine write path (Node + Deno indexer runtimes, and this package's own `trust-scorer.ts`) — a truncated scan can only raise a verdict, never lower one (SMI-5879, SMI-6020)
 - **Fix**: code-review follow-up on the Antigravity `directory-package` companion-agent path (two BLOCKING findings). (1) `resolveCompanionAgentPath()` gains an explicit 3rd `baseDir` param (default `process.cwd()`) instead of letting Antigravity's relative `dir` resolve implicitly against whatever `process.cwd()` happens to be at the exact `fs` call that consumes the path — wrong for the long-running MCP server, whose cwd is fixed at launch and does not track the calling editor/agent's real project. `writeInstallFiles()` gains a matching optional `companionBaseDir` param, threaded through both its callers (`SkillInstallationService.install()` via a new `companionBaseDir` constructor param, and `installFromContent()`); the MCP `install_skill` tool gains an optional `cwd` input field passed through as `companionBaseDir` so a caller can supply its real project root. (2) `resolveCompanionAgentPath()`'s `directory-package` branch now rejects an unsafe `skillName` (`''`, `'.'`, `'..'`, or containing `/`/`\`) before building the path — `skillName` becomes its own path segment in this mode, so `'..'` would otherwise `path.join`-normalize outside the intended companion-agent directory. Not exploitable through either current caller (both already sanitize `skillName` upstream), but the function is exported/reusable with no validation of its own, so it now enforces the same "last line of defense" standard already applied to `skillNameFromSkillId()` (SMI-5982)
 - **Feature**: `antigravity` is now a real `ClientId` (`install/paths.ts`) — `CLIENT_NATIVE_PATHS['antigravity'] = ~/.gemini/config/skills`, un-deferred from `compatibility/slugs.ts`'s `BROWSE_ONLY_SLUGS` (which now only contains `gemini`), and given its own `CLIENT_TO_COMPATIBILITY_SLUG` entry. `CompanionAgentTarget.fileMode` gains a second value, `'directory-package'` (Antigravity only today) — a per-skill subdirectory `<dir>/<skillName>/agent.md`, instead of every other client's flat `<dir>/<name>-suffix.md`; `resolveCompanionAgentPath()` is now mode-aware. Antigravity's companion-agent output is project-scoped (`.agents/agents/<name>/agent.md`, relative to the invocation directory) — this CLI has no existing global-vs-project install-mode distinction to hook into, confirmed by grep, so global scope (`~/.gemini/config/agents/`) is a fast-follow, not implemented here (SMI-5982)
 - **Fix**: `writeInstallFiles()`'s rollback path could leave behind an orphaned, empty per-skill companion-agent directory when a new `directory-package`-mode install (Antigravity) failed partway through — every other client's agents dir is shared and pre-existing, so this hazard never applied to them. Cleanup uses a non-recursive `rmdir`, a safe no-op when the directory was never created or holds unexpected surviving content (SMI-5982)

package/README.md

@@ -6,13 +6,13 @@ Part of Skillsmith: a registry for sharing, scanning, and tracking agent skills
 
 ## Contents
 
-- [What's New](#whats-new-in-v0122)
+- [What's New](#whats-new-in-v0123)
 - [Installation](#installation)
 - [Quick Start](#quick-start)
 - [Features](#features)
 - [Exports](#exports)
 
-## What's New in v0.12.2
+## What's New in v0.12.3
 
 - **New `resolveSessionTier` client** (`sync/license-status-client.ts`): authenticates a stored `skillsmith login` session against `/license-status` so the MCP server can resolve a real subscription tier without a separately-configured `SKILLSMITH_API_KEY`, instead of silently falling back to `community`.
 - **Scanner: bundled-file scan expanded to operational code** (Gap 8 of the ClawHavoc remediation): the indexer now reads `scripts/`, `src/`, and `bin/` alongside `SKILL.md`, closing a blind spot where a backdoor buried mid-function in working operational code was structurally invisible.