@ssheleg/make-skill 0.27.0 → 0.27.1

package/CHANGELOG.md

@@ -1,3 +1,29 @@
+## v0.27.1 — the tarball stops shipping compiled Python, and the audit vocabulary the routing block promised becomes advertised
+
+Family audit 2026-09-06, wave `AUDIT-WAVE-0906`. Two findings, both a gap between what
+this member says and what it ships.
+
+**The npm tarball carried a 33kB `.pyc` from a used checkout.** `files` includes
+`plugins`, the gate imports the auditor, and Python drops
+`scripts/__pycache__/audit_skill.cpython-314.pyc` beside it — so a publish from any
+machine that had run the suite shipped bytecode nobody wrote. `.gitignore` already
+covered it, and that is exactly why it looked handled: git never carried the file, but
+npm's `files` allowlist does not read `.gitignore` inside a directory it was told to
+include. The durable fix is the shape `seo-aeo-audit` already ships — `"!**/__pycache__"`
+and `"!**/*.pyc"` in `files`. **Measured with the residue present on disk, not after
+deleting it**: the `.pyc` was regenerated first, then `npm pack --dry-run | grep -c pyc`
+→ **0**. The auditor's `BUNDLE_NESTED` GAP for that directory goes with it.
+
+**The umbrella's routing block advertises "skill audit" / «аудит скилов», and the
+description never did.** Both phrases now sit in the trigger enumeration, verbatim, after
+the "сделай скилл" pair. The room was paid for by trimming **54** characters from the
+non-trigger prose — "open standard and" → "standard,", "front-matter limits" → "limits",
+"manifest schemas, component layout" → "manifests, layout", "the Claude Code plugin
+reference" → "the plugin reference" — and **every previously advertised quoted phrase
+survives verbatim**, which is what the umbrella's soundness fixture refuses a pin
+without. Auditor before → after: description **965/970 → 943/970**, `DESC_WHAT` **550 →
+582** chars beyond the triggers, body untouched at ~4677/4750, **0 GAP**.
+
 ## v0.27.0 — the standard-keeper asked WHEN nine times and WHAT never
 
 `B-139`. `audit_skill.py` carried nine `DESC_*` rules — length, headroom, person, Russian

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ssheleg/make-skill",
-  "version": "0.27.0",
+  "version": "0.27.1",
   "description": "Create, retrofit, audit, and ship agent skills & Claude Code plugins the proven ssheleg way \u2014 conformance to the Agent Skills open standard AND Anthropic's platform rules (front-matter limits, disclosure budgets, per-surface runtime limits, the Skills API, evals) plus the Claude Code plugin reference (manifest schemas, component layout, claude plugin validate --strict), marketplace repo layout, version sync, validator + CI, multi-channel distribution (plugin, vercel skills CLI, npx, Cursor), npm gotchas, the review checklist for third-party skills, and MCP / A2A rules for protocol-connected skills. This package is the installer CLI.",
   "keywords": [
     "skill",
@@ -36,7 +36,9 @@
     "README.md",
     "LICENSE",
     "CHANGELOG.md",
-    "SECURITY.md"
+    "SECURITY.md",
+    "!**/__pycache__",
+    "!**/*.pyc"
   ],
   "publishConfig": {
     "access": "public"

package/plugins/make-skill/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "make-skill",
   "displayName": "Make Skill",
   "description": "Create, retrofit, audit, and ship agent skills & Claude Code plugins the proven ssheleg way: conformance to the Agent Skills open standard, Anthropic's platform rules (surfaces, Skills API, evals) and the Claude Code plugin reference, marketplace repo layout, version sync, validator + CI, multi-channel distribution (plugin, vercel skills CLI, npx, Cursor), npm gotchas, end-to-end first publish, the review checklist for third-party skills, plus MCP / A2A references for protocol-connected skills.",
-  "version": "0.27.0",
+  "version": "0.27.1",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/make-skill/skills/make-skill/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: make-skill
-description: Use when creating, upgrading, auditing, or publishing agent skills and Claude Code plugins - "make a skill" / "сделай скилл", "wrap it in a plugin" / "заверни в плагин", "publish a skill" / "опубликуй скилл", "retrofit a skill to the standard" / "приведи скилл к стандарту", "does this skill match the spec" / "соответствует ли скилл стандарту", "claude plugin validate fails" / "проверь плагин по документации Anthropic", "is this skill safe to install" / "безопасно ли ставить этот скилл" - or when a skill must reach an MCP server or another agent over A2A. NOT for a version bump or release in a repo that ships anything but a skill or plugin. Encodes the Agent Skills open standard and Anthropic's platform rules (front-matter limits, budgets, the Skills API, evals), the Claude Code plugin reference (manifest schemas, component layout, validate --strict), plus the ssheleg pipeline - marketplace layout, version sync, validator+CI, distribution, npm gotchas.
+description: Use when creating, upgrading, auditing, or publishing agent skills and Claude Code plugins - "make a skill" / "сделай скилл", "skill audit" / «аудит скилов», "wrap it in a plugin" / "заверни в плагин", "publish a skill" / "опубликуй скилл", "retrofit a skill to the standard" / "приведи скилл к стандарту", "does this skill match the spec" / "соответствует ли скилл стандарту", "claude plugin validate fails" / "проверь плагин по документации Anthropic", "is this skill safe to install" / "безопасно ли ставить этот скилл" - or when a skill must reach an MCP server or another agent over A2A. NOT for a version bump or release in a repo that ships anything but a skill or plugin. Encodes the Agent Skills standard, Anthropic's platform rules (limits, budgets, Skills API, evals), the plugin reference (manifests, layout, validate --strict), plus the ssheleg pipeline - marketplace layout, version sync, validator+CI, distribution, npm gotchas.
 license: MIT
 compatibility: Authoring works on any agent. The bundled scripts/ need python3. Publishing steps need git, gh, node and npm; the plugin gates need the claude CLI. Not usable on the Claude API surface, which has no network and no runtime package install.
 metadata:
   author: ssheleg
-  version: "0.27.0"
+  version: "0.27.1"
   homepage: https://github.com/ssheleg/make-skill
 ---