@ssheleg/make-skill 0.6.4 → 0.6.5

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## v0.6.5 — 2026-07-30
+
+### Added
+- **`claude plugin validate <path> --strict` is now canon** — the upstream gate,
+  wired into CI against both the plugin and the marketplace manifest. It needs
+  no auth or API key, so a runner can install `@anthropic-ai/claude-code` and run
+  it. The canon records the two failures it found across all six repos of this
+  family at once, because neither is visible to a house validator:
+  - **`argument-hint` must be quoted.** Bare `[a | b]` is a YAML flow sequence,
+    so it parses as a list — and one comma or stray character breaks the block
+    outright, at which point the command loads with empty metadata and no
+    description, silently.
+  - **`homepage` and `repository` are not top-level `marketplace.json` fields.**
+    They belong to a plugin entry. Unrecognized fields are warnings the runtime
+    tolerates, which is why they survive everything except `--strict`.
+
+### Fixed
+- This repo's own command hint and marketplace manifest, per the above.
+
 ## v0.6.4 — 2026-07-30
 
 ### Changed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ssheleg/make-skill",
-  "version": "0.6.4",
+  "version": "0.6.5",
   "description": "Create, retrofit, audit, and ship agent skills & Claude Code plugins the proven ssheleg way — conformance to the Agent Skills open standard (front-matter limits, progressive-disclosure budgets), marketplace repo layout, version sync, validator + CI, multi-channel distribution (plugin, vercel skills CLI, npx, Cursor), npm gotchas, and MCP / A2A rules for protocol-connected skills. This package is the installer CLI.",
   "keywords": [
     "skill",

package/plugins/make-skill/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "make-skill",
   "description": "Create, retrofit, audit, and ship agent skills & Claude Code plugins the proven ssheleg way: conformance to the Agent Skills open standard, marketplace repo layout, version sync, validator + CI, multi-channel distribution (plugin, vercel skills CLI, npx, Cursor), npm gotchas, end-to-end first publish, plus MCP / A2A references for protocol-connected skills.",
-  "version": "0.6.4",
+  "version": "0.6.5",
   "author": {
     "name": "ssheleg"
   },

package/plugins/make-skill/commands/make-skill.md

@@ -1,6 +1,6 @@
 ---
 description: Create, retrofit, audit, or publish an agent skill / Claude Code plugin the proven ssheleg way — Agent Skills spec conformance, marketplace layout, version sync, validator + CI, multi-channel distribution, MCP / A2A rules.
-argument-hint: <what to build/retrofit/audit, or a skill path>
+argument-hint: "<what to build/retrofit/audit, or a skill path>"
 ---
 Use the `make-skill` skill for the task below. First **detect the workflow** from
 the task and any path in `$ARGUMENTS`, announce it, then follow the skill exactly:

package/plugins/make-skill/skills/make-skill/SKILL.md

@@ -134,6 +134,24 @@ top CHANGELOG entry — SAME semver, bumped together, validator enforces. If
 version an agent outside Claude Code ever sees), it joins the sync as a 5th
 point.
 
+**`claude plugin validate <path> --strict` is the upstream gate — wire it into
+CI, both manifests.** Your own validator enforces house rules; this one enforces
+Claude Code's actual schema, and it catches a class your validator cannot see.
+It needs no auth and no API key, so a GitHub runner can install
+`@anthropic-ai/claude-code` and run it. Two failures it found across this whole
+family at once:
+
+- **Front matter that silently drops.** `argument-hint: [a | b]` is a YAML flow
+  sequence, not a string: it parses as a *list*, and one value containing a
+  comma or a stray character breaks the block outright — at which point the
+  command loads with **empty metadata and no description**, with nothing at
+  runtime saying so. **Always quote `argument-hint`**, single quotes when the
+  value itself contains double quotes.
+- **`homepage` and `repository` at the top level of `marketplace.json` are not
+  fields.** They are valid on a *plugin entry*; at the root Claude Code ignores
+  them. Unrecognized fields are warnings the runtime tolerates, which is exactly
+  why they survive without `--strict`.
+
 **Validator** (adapt super-ux `test/validate.py`): manifests parse+fields;
 SKILL.md front-matter — **spec rules** (name charset/length, description ≤1024,
 `compatibility` ≤500, `metadata` all-string, `allowed-tools` a string, no unknown