@ssheleg/make-skill 0.14.0 → 0.16.0

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 # Changelog
 
+## v0.16.0
+
+### Changed
+
+- **The installer now offers the family's routing block** (closing B-06 in the
+  umbrella). Until now only `super-ux` delegated: install this skill on its own
+  and no router was written at all, so an agent had the skill and no rule saying
+  when to reach for it. The bundle installer wrote all eight, which is why
+  nothing looked broken — the gap only opened for someone installing one member.
+
+  Delegated to `npx sshlg-skills routers --member make-skill` rather than
+  reimplemented, for three reasons:
+
+  - The block describes what the machine actually has. A lone member rendering
+    the whole thing would print a table for routers nobody installed.
+  - `--member` scopes the write to this skill's own section. Verified by damaging
+    two sections of a real block and running this installer: its own was
+    repaired, the other left exactly as it was.
+  - The launcher is the only writer that copies the operator's global instruction
+    file before touching it. That file has no version control behind it.
+
+  `--no-install` keeps it from silently downloading a package nobody asked for.
+  When the launcher is absent the command is printed instead of failing: ending
+  an install in an error over an optional follow-up reads as a failed install.
+  Both paths were exercised.
+
+## v0.15.0
+
+### Fixed
+
+- **Reachability counted links and missed the files a skill leans on hardest.** After
+  v0.13.0 taught the check to follow links transitively, it still only followed *links* —
+  so four bundled scripts in `seo-aeo-audit` were reported as dead weight while `SKILL.md`
+  names them in the sentence that tells the agent what ships and the references name them
+  in the commands that run them: `` `gsc_pull.py` ``, `scripts/psi_pull.py`. A file the
+  body tells you to execute is the opposite of unopened.
+
+  Reachability is now by link, by path, or by bare filename, followed transitively.
+  Probed: a reference nobody mentions anywhere is still flagged. `seo-aeo-audit` 4 → 0,
+  family 11 → 7, nothing gained elsewhere.
+
+**Third false-positive class in three releases, all one shape**: the check asserted how
+a skill refers to its own files instead of measuring how these skills actually do it.
+Between them the three fired on 45 correct files — more than half of every finding this
+auditor reported across the family.
+
 ## v0.14.0
 
 ### Fixed

package/bin/make-skill.js

@@ -63,6 +63,38 @@ function installOne(label, src, dest, isDir, force) {
   console.log(`Installed ${label} -> ${dest}`);
 }
 
+/**
+ * Ask the family launcher to write the routing block, for this member only.
+ *
+ * Delegated rather than reimplemented, for three reasons. The block describes
+ * what the machine actually has, so a lone member rendering the whole thing
+ * would produce a table for routers nobody installed. `--member` limits the
+ * write to the `make-skill` section and leaves everyone else's alone, which is
+ * what lets the bundle and a single installer both write. And the launcher is
+ * the only writer that copies the operator's global instruction file before
+ * touching it — that file has no version control behind it.
+ *
+ * `--no-install` keeps this from silently downloading a package nobody asked
+ * for. When the launcher is absent, print the command rather than fail: ending
+ * an install in an error because an OPTIONAL follow-up is missing reads as a
+ * failed install.
+ */
+function offerRouters() {
+  const { spawnSync } = require('child_process');
+  const r = spawnSync(
+    'npx',
+    ['--no-install', 'sshlg-skills', 'routers', '--member', 'make-skill'],
+    { stdio: 'inherit', shell: process.platform === 'win32' }
+  );
+  if (r.status !== 0) {
+    console.log(
+      '\nTo have this skill apply by default in every project, add the\n' +
+      "family's routing block to your agent's global instructions:\n\n" +
+      '  npx --yes sshlg-skills routers --member make-skill\n'
+    );
+  }
+}
+
 function main(argv) {
   const args = argv.slice(2);
   if (args.includes('--help') || args.includes('-h')) {
@@ -103,6 +135,11 @@ function main(argv) {
       '         claude plugin update make-skill@make-skill\n' +
       '       Pass --force if you really want both.'
     );
+    // Offered here too. The skill IS present on this machine — as the plugin —
+    // so the routing block is exactly as wanted as on the install path. Two
+    // doors into one install that behave differently is how a feature comes to
+    // exist for half its users.
+    offerRouters();
     return 0;
   }
 
@@ -113,6 +150,7 @@ function main(argv) {
     true,
     force
   );
+  offerRouters();
   return 0;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ssheleg/make-skill",
-  "version": "0.14.0",
+  "version": "0.16.0",
   "description": "Create, retrofit, audit, and ship agent skills & Claude Code plugins the proven ssheleg way — conformance to the Agent Skills open standard AND Anthropic's platform rules (front-matter limits, disclosure budgets, per-surface runtime limits, the Skills API, evals) plus the Claude Code plugin reference (manifest schemas, component layout, claude plugin validate --strict), marketplace repo layout, version sync, validator + CI, multi-channel distribution (plugin, vercel skills CLI, npx, Cursor), npm gotchas, the review checklist for third-party skills, and MCP / A2A rules for protocol-connected skills. This package is the installer CLI.",
   "keywords": [
     "skill",

package/plugins/make-skill/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "make-skill",
   "displayName": "Make Skill",
   "description": "Create, retrofit, audit, and ship agent skills & Claude Code plugins the proven ssheleg way: conformance to the Agent Skills open standard, Anthropic's platform rules (surfaces, Skills API, evals) and the Claude Code plugin reference, marketplace repo layout, version sync, validator + CI, multi-channel distribution (plugin, vercel skills CLI, npx, Cursor), npm gotchas, end-to-end first publish, the review checklist for third-party skills, plus MCP / A2A references for protocol-connected skills.",
-  "version": "0.14.0",
+  "version": "0.16.0",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/make-skill/skills/make-skill/SKILL.md

@@ -5,7 +5,7 @@ license: MIT
 compatibility: Authoring works on any agent. The bundled scripts/ need python3. Publishing steps need git, gh, node and npm; the plugin gates need the claude CLI. Not usable on the Claude API surface, which has no network and no runtime package install.
 metadata:
   author: ssheleg
-  version: "0.14.0"
+  version: "0.16.0"
   homepage: https://github.com/ssheleg/make-skill
 ---
 

package/plugins/make-skill/skills/make-skill/scripts/audit_skill.py

@@ -309,8 +309,30 @@ def _bundle_closure(skill_dir, skill_text):
             if os.path.isfile(os.path.join(d, entry)):
                 available["%s/%s" % (sub, entry)] = os.path.join(d, entry)
 
+    def named_in(text):
+        """Keys this text reaches: by link, by path, or by bare filename.
+
+        A script the body tells the agent to run is named in prose and a command —
+        `python3 scripts/gsc_pull.py`, or just `gsc_pull.py` in a list of what ships —
+        never as a markdown link. It is the opposite of dead weight, so matching only
+        link syntax reports the files a skill leans on hardest.
+        """
+        hits = set()
+        for key, _path in available.items():
+            base = key.split("/", 1)[1]
+            if key in text or base in text:
+                hits.add(key)
+        for target in LINK_RE.findall(text):
+            t = target.split("#", 1)[0].strip().lstrip("./")
+            if not t or "://" in t:
+                continue
+            for key in available:
+                if key == t or key.endswith("/" + t):
+                    hits.add(key)
+        return hits
+
     seen = set()
-    stack = [key for key in available if key in skill_text]
+    stack = list(named_in(skill_text))
     while stack:
         key = stack.pop()
         if key in seen:
@@ -318,19 +340,11 @@ def _bundle_closure(skill_dir, skill_text):
         seen.add(key)
         if not key.endswith(".md"):
             continue
-        sub = key.split("/", 1)[0]
         try:
             txt = open(available[key], encoding="utf-8").read()
         except (OSError, UnicodeDecodeError):
             continue
-        for target in LINK_RE.findall(txt):
-            t = target.split("#", 1)[0].strip().lstrip("./")
-            if not t or "://" in t:
-                continue
-            # a bare name inside references/ means a sibling of that same directory
-            cand = t if "/" in t else "%s/%s" % (sub, t)
-            if cand in available and cand not in seen:
-                stack.append(cand)
+        stack.extend(k for k in named_in(txt) if k not in seen)
     return seen