@ssheleg/make-skill 0.13.1 → 0.14.0

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## v0.14.0
+
+### Fixed
+
+- **`LINK_ESCAPE` fired on every cross-skill link and called them all broken.** The
+  check rejected any `../` target on the stated grounds that "packagers ship that
+  directory alone, so it arrives broken on every agent." Measured against the packager:
+  `npx skills add ssheleg/task-pipeline --skills evidence-docs` installed the sibling
+  too, laid both under one `skills/` directory, and **all eleven** of `evidence-docs`'s
+  outbound links resolved. The rationale was false for the case it fired on most.
+
+  An escape that lands on a sibling in the same tree is a cross-skill link inside one
+  plugin, and `evidence-docs` is deliberately built that way — it says so in its own
+  body: *a navigator, not a second copy*. Twelve permanent findings nobody could ever
+  close is how an auditor teaches people to ignore it.
+
+  The check now fires only when the target resolves to **nothing**, which is the defect
+  it was always for. Probed both ways: a dangling `../nonexistent-skill/nope.md` is
+  still caught; the eleven real ones are not. Family-wide the count went 22 → 11 GAP,
+  and no repository gained a finding.
+
 ## v0.13.1
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ssheleg/make-skill",
-  "version": "0.13.1",
+  "version": "0.14.0",
   "description": "Create, retrofit, audit, and ship agent skills & Claude Code plugins the proven ssheleg way — conformance to the Agent Skills open standard AND Anthropic's platform rules (front-matter limits, disclosure budgets, per-surface runtime limits, the Skills API, evals) plus the Claude Code plugin reference (manifest schemas, component layout, claude plugin validate --strict), marketplace repo layout, version sync, validator + CI, multi-channel distribution (plugin, vercel skills CLI, npx, Cursor), npm gotchas, the review checklist for third-party skills, and MCP / A2A rules for protocol-connected skills. This package is the installer CLI.",
   "keywords": [
     "skill",

package/plugins/make-skill/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "make-skill",
   "displayName": "Make Skill",
   "description": "Create, retrofit, audit, and ship agent skills & Claude Code plugins the proven ssheleg way: conformance to the Agent Skills open standard, Anthropic's platform rules (surfaces, Skills API, evals) and the Claude Code plugin reference, marketplace repo layout, version sync, validator + CI, multi-channel distribution (plugin, vercel skills CLI, npx, Cursor), npm gotchas, end-to-end first publish, the review checklist for third-party skills, plus MCP / A2A references for protocol-connected skills.",
-  "version": "0.13.1",
+  "version": "0.14.0",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/make-skill/skills/make-skill/SKILL.md

@@ -5,7 +5,7 @@ license: MIT
 compatibility: Authoring works on any agent. The bundled scripts/ need python3. Publishing steps need git, gh, node and npm; the plugin gates need the claude CLI. Not usable on the Claude API surface, which has no network and no runtime package install.
 metadata:
   author: ssheleg
-  version: "0.13.1"
+  version: "0.14.0"
   homepage: https://github.com/ssheleg/make-skill
 ---
 

package/plugins/make-skill/skills/make-skill/scripts/audit_skill.py

@@ -377,8 +377,16 @@ def _check_links(a, skill_dir, skill_text, rel):
             if target.startswith(("http://", "https://", "mailto:", "#")):
                 continue
             if target.startswith("../") or "/../" in target:
-                a.gap("LINK_ESCAPE", "link %r escapes the skill directory — packagers "
-                      "ship that directory alone, so it arrives broken on every agent"
+                # An escape that lands on a sibling skill in the same tree is a
+                # cross-skill link inside one plugin, and every packager measured
+                # ships those siblings together — `npx skills add <repo> --skills
+                # <one>` installed the sibling too, and all eleven links resolved.
+                # An escape that lands nowhere is the defect this check is for.
+                out = os.path.normpath(os.path.join(skill_dir, target.split("#")[0]))
+                if os.path.exists(out):
+                    continue
+                a.gap("LINK_ESCAPE", "link %r leaves the skill directory and resolves "
+                      "to nothing — a sibling would ship alongside, this will not"
                       % target, rel, i)
                 bad = True
                 continue