@skilly-hand/skilly-hand 0.11.0 → 0.12.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +34 -0
- package/README.md +1 -0
- package/SECURITY.md +37 -0
- package/package.json +5 -3
package/CHANGELOG.md
CHANGED
|
@@ -16,6 +16,40 @@ All notable changes to this project are documented in this file.
|
|
|
16
16
|
### Removed
|
|
17
17
|
- _None._
|
|
18
18
|
|
|
19
|
+
## [0.12.0] - 2026-04-05
|
|
20
|
+
[View on npm](https://www.npmjs.com/package/@skilly-hand/skilly-hand/v/0.12.0)
|
|
21
|
+
|
|
22
|
+
### Added
|
|
23
|
+
- Added `SECURITY.md` policy for vulnerability reporting and response procedures.
|
|
24
|
+
- Added `security-check` script to scan source code for exposed secrets and API keys.
|
|
25
|
+
- Integrated security scanning into the `verify:publish` pipeline to catch credential leaks before release.
|
|
26
|
+
|
|
27
|
+
### Changed
|
|
28
|
+
- Updated `.gitignore` to include `.env*` pattern for environment variable files.
|
|
29
|
+
- Updated `verify-packlist.mjs` to whitelist `SECURITY.md` in npm package.
|
|
30
|
+
|
|
31
|
+
### Fixed
|
|
32
|
+
- _None._
|
|
33
|
+
|
|
34
|
+
### Removed
|
|
35
|
+
- _None._
|
|
36
|
+
|
|
37
|
+
## [0.11.1] - 2026-04-05
|
|
38
|
+
[View on npm](https://www.npmjs.com/package/@skilly-hand/skilly-hand/v/0.11.1)
|
|
39
|
+
|
|
40
|
+
### Added
|
|
41
|
+
- _None._
|
|
42
|
+
|
|
43
|
+
### Changed
|
|
44
|
+
- _None._
|
|
45
|
+
|
|
46
|
+
### Fixed
|
|
47
|
+
- Added `project-teacher` to the README catalog list (was missing from the 0.11.0 docs update).
|
|
48
|
+
- Synced test expectations to reflect 12-skill catalog and `project-teacher` install behavior.
|
|
49
|
+
|
|
50
|
+
### Removed
|
|
51
|
+
- _None._
|
|
52
|
+
|
|
19
53
|
## [0.10.5] - 2026-04-04
|
|
20
54
|
[View on npm](https://www.npmjs.com/package/@skilly-hand/skilly-hand/v/0.10.5)
|
|
21
55
|
|
package/README.md
CHANGED
package/SECURITY.md
ADDED
|
@@ -0,0 +1,37 @@
|
|
|
1
|
+
# Security Policy
|
|
2
|
+
|
|
3
|
+
## Supported Versions
|
|
4
|
+
|
|
5
|
+
Only the latest version published on npm is supported with security fixes. No backport patches are issued for older versions.
|
|
6
|
+
|
|
7
|
+
## Reporting a Vulnerability
|
|
8
|
+
|
|
9
|
+
If you discover a security vulnerability, please **do not open a public GitHub issue**. Instead, use [GitHub Security Advisories](https://github.com/Davecelot/skilly-hand/security/advisories/new) to report it privately.
|
|
10
|
+
|
|
11
|
+
Include as much detail as possible:
|
|
12
|
+
|
|
13
|
+
- A description of the vulnerability and its potential impact
|
|
14
|
+
- Steps to reproduce or a minimal proof-of-concept
|
|
15
|
+
- The version of `@skilly-hand/skilly-hand` you are using
|
|
16
|
+
- Your environment (OS, Node.js version)
|
|
17
|
+
|
|
18
|
+
## Response Timeline
|
|
19
|
+
|
|
20
|
+
This is a solo-maintained project. I will do my best to:
|
|
21
|
+
|
|
22
|
+
- Acknowledge the report within a few days
|
|
23
|
+
- Triage and provide an estimated fix timeline once reviewed
|
|
24
|
+
- Publish a patch and disclose the issue publicly after the fix ships
|
|
25
|
+
|
|
26
|
+
## Out of Scope
|
|
27
|
+
|
|
28
|
+
The following are not considered security vulnerabilities in this project:
|
|
29
|
+
|
|
30
|
+
- Content inside skill `.md` files — these are prose instructions for AI agents, not executable code
|
|
31
|
+
- Vulnerabilities in third-party dependencies — please report those directly to the upstream package maintainers
|
|
32
|
+
- Issues that require physical access to the machine running the CLI
|
|
33
|
+
|
|
34
|
+
## Please Do Not
|
|
35
|
+
|
|
36
|
+
- Disclose the vulnerability publicly before a fix has been released
|
|
37
|
+
- Open a public GitHub issue to report security concerns
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@skilly-hand/skilly-hand",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.12.0",
|
|
4
4
|
"license": "CC-BY-NC-4.0",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"publishConfig": {
|
|
@@ -14,7 +14,8 @@
|
|
|
14
14
|
"packages",
|
|
15
15
|
"README.md",
|
|
16
16
|
"CHANGELOG.md",
|
|
17
|
-
"LICENSE"
|
|
17
|
+
"LICENSE",
|
|
18
|
+
"SECURITY.md"
|
|
18
19
|
],
|
|
19
20
|
"workspaces": [
|
|
20
21
|
"packages/*"
|
|
@@ -28,8 +29,9 @@
|
|
|
28
29
|
"catalog:sync": "node ./scripts/sync-catalog-readme.mjs",
|
|
29
30
|
"agentic:self:sync": "node ./scripts/sync-self-agentic.mjs",
|
|
30
31
|
"test": "node --test tests/*.test.js",
|
|
32
|
+
"security:check": "node ./scripts/security-check.mjs",
|
|
31
33
|
"verify:packlist": "node ./scripts/verify-packlist.mjs",
|
|
32
|
-
"verify:publish": "npm run catalog:check && npm test && npm run verify:packlist",
|
|
34
|
+
"verify:publish": "npm run security:check && npm run catalog:check && npm test && npm run verify:packlist",
|
|
33
35
|
"publish:prepare": "npm run verify:publish && npm pack --dry-run --json",
|
|
34
36
|
"publish:otp": "node ./scripts/publish-with-otp.mjs",
|
|
35
37
|
"publish:next": "node ./scripts/publish-with-otp.mjs --tag next",
|