agent-skill-manager 1.8.2 → 1.8.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1,6 +1,6 @@
1
1
  #!/usr/bin/env bun
2
2
  // @bun
3
- import{a as I0,c as a,d as V4,e as w2,f as B4,g as W4,h as P2,i as _4,j as B,k as e9,l as F4,m as N2,n as T4,o as L4,p as O4,q as G0,r as j2,s as I4,u as R4,v as A4,w as b2}from"./chunk-6q3wqv6v.js";import{A as G4,B as x,C as H4,D as D2,E as Z$,F as g,G as Y4,x as i,y as I,z as h}from"./chunk-wdjcav1v.js";var N=I((q5)=>{var G$=Symbol.for("yaml.alias"),u2=Symbol.for("yaml.document"),Gq=Symbol.for("yaml.map"),v2=Symbol.for("yaml.pair"),H$=Symbol.for("yaml.scalar"),Hq=Symbol.for("yaml.seq"),o=Symbol.for("yaml.node.type"),a4=(q)=>!!q&&typeof q==="object"&&q[o]===G$,s4=(q)=>!!q&&typeof q==="object"&&q[o]===u2,n4=(q)=>!!q&&typeof q==="object"&&q[o]===Gq,o4=(q)=>!!q&&typeof q==="object"&&q[o]===v2,m2=(q)=>!!q&&typeof q==="object"&&q[o]===H$,r4=(q)=>!!q&&typeof q==="object"&&q[o]===Hq;function d2(q){if(q&&typeof q==="object")switch(q[o]){case Gq:case Hq:return!0}return!1}function t4(q){if(q&&typeof q==="object")switch(q[o]){case G$:case Gq:case H$:case Hq:return!0}return!1}var e4=(q)=>(m2(q)||d2(q))&&!!q.anchor;q5.ALIAS=G$;q5.DOC=u2;q5.MAP=Gq;q5.NODE_TYPE=o;q5.PAIR=v2;q5.SCALAR=H$;q5.SEQ=Hq;q5.hasAnchor=e4;q5.isAlias=a4;q5.isCollection=d2;q5.isDocument=s4;q5.isMap=n4;q5.isNode=t4;q5.isPair=o4;q5.isScalar=m2;q5.isSeq=r4});var f0=I((L5)=>{var y=N(),k=Symbol("break visit"),p2=Symbol("skip children"),l=Symbol("remove node");function Yq(q,$){let Z=l2($);if(y.isDocument(q)){if(R0(null,q.contents,Z,Object.freeze([q]))===l)q.contents=null}else R0(null,q,Z,Object.freeze([]))}Yq.BREAK=k;Yq.SKIP=p2;Yq.REMOVE=l;function R0(q,$,Z,X){let z=c2(q,$,Z,X);if(y.isNode(z)||y.isPair(z))return i2(q,X,z),R0(q,z,Z,X);if(typeof z!=="symbol"){if(y.isCollection($)){X=Object.freeze(X.concat($));for(let U=0;U<$.items.length;++U){let Q=R0(U,$.items[U],Z,X);if(typeof Q==="number")U=Q-1;else if(Q===k)return k;else if(Q===l)$.items.splice(U,1),U-=1}}else if(y.isPair($)){X=Object.freeze(X.concat($));let U=R0("key",$.key,Z,X);if(U===k)return k;else if(U===l)$.key=null;let Q=R0("value",$.value,Z,X);if(Q===k)return k;else if(Q===l)$.value=null}}return z}async function Vq(q,$){let Z=l2($);if(y.isDocument(q)){if(await A0(null,q.contents,Z,Object.freeze([q]))===l)q.contents=null}else await A0(null,q,Z,Object.freeze([]))}Vq.BREAK=k;Vq.SKIP=p2;Vq.REMOVE=l;async function A0(q,$,Z,X){let z=await c2(q,$,Z,X);if(y.isNode(z)||y.isPair(z))return i2(q,X,z),A0(q,z,Z,X);if(typeof z!=="symbol"){if(y.isCollection($)){X=Object.freeze(X.concat($));for(let U=0;U<$.items.length;++U){let Q=await A0(U,$.items[U],Z,X);if(typeof Q==="number")U=Q-1;else if(Q===k)return k;else if(Q===l)$.items.splice(U,1),U-=1}}else if(y.isPair($)){X=Object.freeze(X.concat($));let U=await A0("key",$.key,Z,X);if(U===k)return k;else if(U===l)$.key=null;let Q=await A0("value",$.value,Z,X);if(Q===k)return k;else if(Q===l)$.value=null}}return z}function l2(q){if(typeof q==="object"&&(q.Collection||q.Node||q.Value))return Object.assign({Alias:q.Node,Map:q.Node,Scalar:q.Node,Seq:q.Node},q.Value&&{Map:q.Value,Scalar:q.Value,Seq:q.Value},q.Collection&&{Map:q.Collection,Seq:q.Collection},q);return q}function c2(q,$,Z,X){if(typeof Z==="function")return Z(q,$,X);if(y.isMap($))return Z.Map?.(q,$,X);if(y.isSeq($))return Z.Seq?.(q,$,X);if(y.isPair($))return Z.Pair?.(q,$,X);if(y.isScalar($))return Z.Scalar?.(q,$,X);if(y.isAlias($))return Z.Alias?.(q,$,X);return}function i2(q,$,Z){let X=$[$.length-1];if(y.isCollection(X))X.items[q]=Z;else if(y.isPair(X))if(q==="key")X.key=Z;else X.value=Z;else if(y.isDocument(X))X.contents=Z;else{let z=y.isAlias(X)?"alias":"scalar";throw Error(`Cannot replace node with ${z} parent`)}}L5.visit=Yq;L5.visitAsync=Vq});var Y$=I((M5)=>{var a2=N(),R5=f0(),A5={"!":"%21",",":"%2C","[":"%5B","]":"%5D","{":"%7B","}":"%7D"},K5=(q)=>q.replace(/[!,[\]{}]/g,($)=>A5[$]);class v{constructor(q,$){this.docStart=null,this.docEnd=!1,this.yaml=Object.assign({},v.defaultYaml,q),this.tags=Object.assign({},v.defaultTags,$)}clone(){let q=new v(this.yaml,this.tags);return q.docStart=this.docStart,q}atDocument(){let q=new v(this.yaml,this.tags);switch(this.yaml.version){case"1.1":this.atNextDocument=!0;break;case"1.2":this.atNextDocument=!1,this.yaml={explicit:v.defaultYaml.explicit,version:"1.2"},this.tags=Object.assign({},v.defaultTags);break}return q}add(q,$){if(this.atNextDocument)this.yaml={explicit:v.defaultYaml.explicit,version:"1.1"},this.tags=Object.assign({},v.defaultTags),this.atNextDocument=!1;let Z=q.trim().split(/[ \t]+/),X=Z.shift();switch(X){case"%TAG":{if(Z.length!==2){if($(0,"%TAG directive should contain exactly two parts"),Z.length<2)return!1}let[z,U]=Z;return this.tags[z]=U,!0}case"%YAML":{if(this.yaml.explicit=!0,Z.length!==1)return $(0,"%YAML directive should contain exactly one part"),!1;let[z]=Z;if(z==="1.1"||z==="1.2")return this.yaml.version=z,!0;else{let U=/^\d+\.\d+$/.test(z);return $(6,`Unsupported YAML version ${z}`,U),!1}}default:return $(0,`Unknown directive ${X}`,!0),!1}}tagName(q,$){if(q==="!")return"!";if(q[0]!=="!")return $(`Not a valid tag: ${q}`),null;if(q[1]==="<"){let U=q.slice(2,-1);if(U==="!"||U==="!!")return $(`Verbatim tags aren't resolved, so ${q} is invalid.`),null;if(q[q.length-1]!==">")$("Verbatim tags must end with a >");return U}let[,Z,X]=q.match(/^(.*!)([^!]*)$/s);if(!X)$(`The ${q} tag has no suffix`);let z=this.tags[Z];if(z)try{return z+decodeURIComponent(X)}catch(U){return $(String(U)),null}if(Z==="!")return q;return $(`Could not resolve tag: ${q}`),null}tagString(q){for(let[$,Z]of Object.entries(this.tags))if(q.startsWith(Z))return $+K5(q.substring(Z.length));return q[0]==="!"?q:`!<${q}>`}toString(q){let $=this.yaml.explicit?[`%YAML ${this.yaml.version||"1.2"}`]:[],Z=Object.entries(this.tags),X;if(q&&Z.length>0&&a2.isNode(q.contents)){let z={};R5.visit(q.contents,(U,Q)=>{if(a2.isNode(Q)&&Q.tag)z[Q.tag]=!0}),X=Object.keys(z)}else X=[];for(let[z,U]of Z){if(z==="!!"&&U==="tag:yaml.org,2002:")continue;if(!q||X.some((Q)=>Q.startsWith(U)))$.push(`%TAG ${z} ${U}`)}return $.join(`
3
+ import{a as I0,c as a,d as V4,e as w2,f as B4,g as W4,h as P2,i as _4,j as B,k as e9,l as F4,m as N2,n as T4,o as L4,p as O4,q as G0,r as j2,s as I4,u as R4,v as A4,w as b2}from"./chunk-r21630cj.js";import{A as G4,B as x,C as H4,D as D2,E as Z$,F as g,G as Y4,x as i,y as I,z as h}from"./chunk-wdjcav1v.js";var N=I((q5)=>{var G$=Symbol.for("yaml.alias"),u2=Symbol.for("yaml.document"),Gq=Symbol.for("yaml.map"),v2=Symbol.for("yaml.pair"),H$=Symbol.for("yaml.scalar"),Hq=Symbol.for("yaml.seq"),o=Symbol.for("yaml.node.type"),a4=(q)=>!!q&&typeof q==="object"&&q[o]===G$,s4=(q)=>!!q&&typeof q==="object"&&q[o]===u2,n4=(q)=>!!q&&typeof q==="object"&&q[o]===Gq,o4=(q)=>!!q&&typeof q==="object"&&q[o]===v2,m2=(q)=>!!q&&typeof q==="object"&&q[o]===H$,r4=(q)=>!!q&&typeof q==="object"&&q[o]===Hq;function d2(q){if(q&&typeof q==="object")switch(q[o]){case Gq:case Hq:return!0}return!1}function t4(q){if(q&&typeof q==="object")switch(q[o]){case G$:case Gq:case H$:case Hq:return!0}return!1}var e4=(q)=>(m2(q)||d2(q))&&!!q.anchor;q5.ALIAS=G$;q5.DOC=u2;q5.MAP=Gq;q5.NODE_TYPE=o;q5.PAIR=v2;q5.SCALAR=H$;q5.SEQ=Hq;q5.hasAnchor=e4;q5.isAlias=a4;q5.isCollection=d2;q5.isDocument=s4;q5.isMap=n4;q5.isNode=t4;q5.isPair=o4;q5.isScalar=m2;q5.isSeq=r4});var f0=I((L5)=>{var y=N(),k=Symbol("break visit"),p2=Symbol("skip children"),l=Symbol("remove node");function Yq(q,$){let Z=l2($);if(y.isDocument(q)){if(R0(null,q.contents,Z,Object.freeze([q]))===l)q.contents=null}else R0(null,q,Z,Object.freeze([]))}Yq.BREAK=k;Yq.SKIP=p2;Yq.REMOVE=l;function R0(q,$,Z,X){let z=c2(q,$,Z,X);if(y.isNode(z)||y.isPair(z))return i2(q,X,z),R0(q,z,Z,X);if(typeof z!=="symbol"){if(y.isCollection($)){X=Object.freeze(X.concat($));for(let U=0;U<$.items.length;++U){let Q=R0(U,$.items[U],Z,X);if(typeof Q==="number")U=Q-1;else if(Q===k)return k;else if(Q===l)$.items.splice(U,1),U-=1}}else if(y.isPair($)){X=Object.freeze(X.concat($));let U=R0("key",$.key,Z,X);if(U===k)return k;else if(U===l)$.key=null;let Q=R0("value",$.value,Z,X);if(Q===k)return k;else if(Q===l)$.value=null}}return z}async function Vq(q,$){let Z=l2($);if(y.isDocument(q)){if(await A0(null,q.contents,Z,Object.freeze([q]))===l)q.contents=null}else await A0(null,q,Z,Object.freeze([]))}Vq.BREAK=k;Vq.SKIP=p2;Vq.REMOVE=l;async function A0(q,$,Z,X){let z=await c2(q,$,Z,X);if(y.isNode(z)||y.isPair(z))return i2(q,X,z),A0(q,z,Z,X);if(typeof z!=="symbol"){if(y.isCollection($)){X=Object.freeze(X.concat($));for(let U=0;U<$.items.length;++U){let Q=await A0(U,$.items[U],Z,X);if(typeof Q==="number")U=Q-1;else if(Q===k)return k;else if(Q===l)$.items.splice(U,1),U-=1}}else if(y.isPair($)){X=Object.freeze(X.concat($));let U=await A0("key",$.key,Z,X);if(U===k)return k;else if(U===l)$.key=null;let Q=await A0("value",$.value,Z,X);if(Q===k)return k;else if(Q===l)$.value=null}}return z}function l2(q){if(typeof q==="object"&&(q.Collection||q.Node||q.Value))return Object.assign({Alias:q.Node,Map:q.Node,Scalar:q.Node,Seq:q.Node},q.Value&&{Map:q.Value,Scalar:q.Value,Seq:q.Value},q.Collection&&{Map:q.Collection,Seq:q.Collection},q);return q}function c2(q,$,Z,X){if(typeof Z==="function")return Z(q,$,X);if(y.isMap($))return Z.Map?.(q,$,X);if(y.isSeq($))return Z.Seq?.(q,$,X);if(y.isPair($))return Z.Pair?.(q,$,X);if(y.isScalar($))return Z.Scalar?.(q,$,X);if(y.isAlias($))return Z.Alias?.(q,$,X);return}function i2(q,$,Z){let X=$[$.length-1];if(y.isCollection(X))X.items[q]=Z;else if(y.isPair(X))if(q==="key")X.key=Z;else X.value=Z;else if(y.isDocument(X))X.contents=Z;else{let z=y.isAlias(X)?"alias":"scalar";throw Error(`Cannot replace node with ${z} parent`)}}L5.visit=Yq;L5.visitAsync=Vq});var Y$=I((M5)=>{var a2=N(),R5=f0(),A5={"!":"%21",",":"%2C","[":"%5B","]":"%5D","{":"%7B","}":"%7D"},K5=(q)=>q.replace(/[!,[\]{}]/g,($)=>A5[$]);class v{constructor(q,$){this.docStart=null,this.docEnd=!1,this.yaml=Object.assign({},v.defaultYaml,q),this.tags=Object.assign({},v.defaultTags,$)}clone(){let q=new v(this.yaml,this.tags);return q.docStart=this.docStart,q}atDocument(){let q=new v(this.yaml,this.tags);switch(this.yaml.version){case"1.1":this.atNextDocument=!0;break;case"1.2":this.atNextDocument=!1,this.yaml={explicit:v.defaultYaml.explicit,version:"1.2"},this.tags=Object.assign({},v.defaultTags);break}return q}add(q,$){if(this.atNextDocument)this.yaml={explicit:v.defaultYaml.explicit,version:"1.1"},this.tags=Object.assign({},v.defaultTags),this.atNextDocument=!1;let Z=q.trim().split(/[ \t]+/),X=Z.shift();switch(X){case"%TAG":{if(Z.length!==2){if($(0,"%TAG directive should contain exactly two parts"),Z.length<2)return!1}let[z,U]=Z;return this.tags[z]=U,!0}case"%YAML":{if(this.yaml.explicit=!0,Z.length!==1)return $(0,"%YAML directive should contain exactly one part"),!1;let[z]=Z;if(z==="1.1"||z==="1.2")return this.yaml.version=z,!0;else{let U=/^\d+\.\d+$/.test(z);return $(6,`Unsupported YAML version ${z}`,U),!1}}default:return $(0,`Unknown directive ${X}`,!0),!1}}tagName(q,$){if(q==="!")return"!";if(q[0]!=="!")return $(`Not a valid tag: ${q}`),null;if(q[1]==="<"){let U=q.slice(2,-1);if(U==="!"||U==="!!")return $(`Verbatim tags aren't resolved, so ${q} is invalid.`),null;if(q[q.length-1]!==">")$("Verbatim tags must end with a >");return U}let[,Z,X]=q.match(/^(.*!)([^!]*)$/s);if(!X)$(`The ${q} tag has no suffix`);let z=this.tags[Z];if(z)try{return z+decodeURIComponent(X)}catch(U){return $(String(U)),null}if(Z==="!")return q;return $(`Could not resolve tag: ${q}`),null}tagString(q){for(let[$,Z]of Object.entries(this.tags))if(q.startsWith(Z))return $+K5(q.substring(Z.length));return q[0]==="!"?q:`!<${q}>`}toString(q){let $=this.yaml.explicit?[`%YAML ${this.yaml.version||"1.2"}`]:[],Z=Object.entries(this.tags),X;if(q&&Z.length>0&&a2.isNode(q.contents)){let z={};R5.visit(q.contents,(U,Q)=>{if(a2.isNode(Q)&&Q.tag)z[Q.tag]=!0}),X=Object.keys(z)}else X=[];for(let[z,U]of Z){if(z==="!!"&&U==="tag:yaml.org,2002:")continue;if(!q||X.some((Q)=>Q.startsWith(U)))$.push(`%TAG ${z} ${U}`)}return $.join(`
4
4
  `)}}v.defaultYaml={explicit:!1,version:"1.2"};v.defaultTags={"!!":"tag:yaml.org,2002:"};M5.Directives=v});var Bq=I((j5)=>{var s2=N(),w5=f0();function P5(q){if(/[\x00-\x19\s,[\]{}]/.test(q)){let Z=`Anchor must not contain whitespace or control characters: ${JSON.stringify(q)}`;throw Error(Z)}return!0}function n2(q){let $=new Set;return w5.visit(q,{Value(Z,X){if(X.anchor)$.add(X.anchor)}}),$}function o2(q,$){for(let Z=1;;++Z){let X=`${q}${Z}`;if(!$.has(X))return X}}function N5(q,$){let Z=[],X=new Map,z=null;return{onAnchor:(U)=>{Z.push(U),z??(z=n2(q));let Q=o2($,z);return z.add(Q),Q},setAnchors:()=>{for(let U of Z){let Q=X.get(U);if(typeof Q==="object"&&Q.anchor&&(s2.isScalar(Q.node)||s2.isCollection(Q.node)))Q.node.anchor=Q.anchor;else{let J=Error("Failed to resolve repeated object (this should not happen)");throw J.source=U,J}}},sourceObjects:X}}j5.anchorIsValid=P5;j5.anchorNames=n2;j5.createNodeAnchors=N5;j5.findNewAnchor=o2});var V$=I((f5)=>{function y0(q,$,Z,X){if(X&&typeof X==="object")if(Array.isArray(X))for(let z=0,U=X.length;z<U;++z){let Q=X[z],J=y0(q,X,String(z),Q);if(J===void 0)delete X[z];else if(J!==Q)X[z]=J}else if(X instanceof Map)for(let z of Array.from(X.keys())){let U=X.get(z),Q=y0(q,X,z,U);if(Q===void 0)X.delete(z);else if(Q!==U)X.set(z,Q)}else if(X instanceof Set)for(let z of Array.from(X)){let U=y0(q,X,z,z);if(U===void 0)X.delete(z);else if(U!==z)X.delete(z),X.add(U)}else for(let[z,U]of Object.entries(X)){let Q=y0(q,X,z,U);if(Q===void 0)delete X[z];else if(Q!==U)X[z]=Q}return q.call($,Z,X)}f5.applyReviver=y0});var e=I((g5)=>{var x5=N();function r2(q,$,Z){if(Array.isArray(q))return q.map((X,z)=>r2(X,String(z),Z));if(q&&typeof q.toJSON==="function"){if(!Z||!x5.hasAnchor(q))return q.toJSON($,Z);let X={aliasCount:0,count:1,res:void 0};Z.anchors.set(q,X),Z.onCreate=(U)=>{X.res=U,delete Z.onCreate};let z=q.toJSON($,Z);if(Z.onCreate)Z.onCreate(z);return z}if(typeof q==="bigint"&&!Z?.keep)return Number(q);return q}g5.toJS=r2});var Wq=I((v5)=>{var h5=V$(),t2=N(),u5=e();class e2{constructor(q){Object.defineProperty(this,t2.NODE_TYPE,{value:q})}clone(){let q=Object.create(Object.getPrototypeOf(this),Object.getOwnPropertyDescriptors(this));if(this.range)q.range=this.range.slice();return q}toJS(q,{mapAsMap:$,maxAliasCount:Z,onAnchor:X,reviver:z}={}){if(!t2.isDocument(q))throw TypeError("A document argument is required");let U={anchors:new Map,doc:q,keep:!0,mapAsMap:$===!0,mapKeyWarned:!1,maxAliasCount:typeof Z==="number"?Z:100},Q=u5.toJS(this,"",U);if(typeof X==="function")for(let{count:J,res:G}of U.anchors.values())X(G,J);return typeof z==="function"?h5.applyReviver(z,{"":Q},"",Q):Q}}v5.NodeBase=e2});var x0=I((i5)=>{var d5=Bq(),p5=f0(),K0=N(),l5=Wq(),c5=e();class q1 extends l5.NodeBase{constructor(q){super(K0.ALIAS);this.source=q,Object.defineProperty(this,"tag",{set(){throw Error("Alias nodes cannot have tags")}})}resolve(q,$){let Z;if($?.aliasResolveCache)Z=$.aliasResolveCache;else if(Z=[],p5.visit(q,{Node:(z,U)=>{if(K0.isAlias(U)||K0.hasAnchor(U))Z.push(U)}}),$)$.aliasResolveCache=Z;let X=void 0;for(let z of Z){if(z===this)break;if(z.anchor===this.source)X=z}return X}toJSON(q,$){if(!$)return{source:this.source};let{anchors:Z,doc:X,maxAliasCount:z}=$,U=this.resolve(X,$);if(!U){let J=`Unresolved alias (the anchor must be set before the alias): ${this.source}`;throw ReferenceError(J)}let Q=Z.get(U);if(!Q)c5.toJS(U,null,$),Q=Z.get(U);if(Q?.res===void 0)throw ReferenceError("This should not happen: Alias anchor was not resolved?");if(z>=0){if(Q.count+=1,Q.aliasCount===0)Q.aliasCount=_q(X,U,Z);if(Q.count*Q.aliasCount>z)throw ReferenceError("Excessive alias count indicates a resource exhaustion attack")}return Q.res}toString(q,$,Z){let X=`*${this.source}`;if(q){if(d5.anchorIsValid(this.source),q.options.verifyAliasOrder&&!q.anchors.has(this.source)){let z=`Unresolved alias (the anchor must be set before the alias): ${this.source}`;throw Error(z)}if(q.implicitKey)return`${X} `}return X}}function _q(q,$,Z){if(K0.isAlias($)){let X=$.resolve(q),z=Z&&X&&Z.get(X);return z?z.count*z.aliasCount:0}else if(K0.isCollection($)){let X=0;for(let z of $.items){let U=_q(q,z,Z);if(U>X)X=U}return X}else if(K0.isPair($)){let X=_q(q,$.key,Z),z=_q(q,$.value,Z);return Math.max(X,z)}return 1}i5.Alias=q1});var f=I((t5)=>{var s5=N(),n5=Wq(),o5=e(),r5=(q)=>!q||typeof q!=="function"&&typeof q!=="object";class H0 extends n5.NodeBase{constructor(q){super(s5.SCALAR);this.value=q}toJSON(q,$){return $?.keep?this.value:o5.toJS(this.value,q,$)}toString(){return String(this.value)}}H0.BLOCK_FOLDED="BLOCK_FOLDED";H0.BLOCK_LITERAL="BLOCK_LITERAL";H0.PLAIN="PLAIN";H0.QUOTE_DOUBLE="QUOTE_DOUBLE";H0.QUOTE_SINGLE="QUOTE_SINGLE";t5.Scalar=H0;t5.isScalarValue=r5});var g0=I((U8)=>{var $8=x0(),Y0=N(),$1=f(),Z8="tag:yaml.org,2002:";function X8(q,$,Z){if($){let X=Z.filter((U)=>U.tag===$),z=X.find((U)=>!U.format)??X[0];if(!z)throw Error(`Tag ${$} not found`);return z}return Z.find((X)=>X.identify?.(q)&&!X.format)}function z8(q,$,Z){if(Y0.isDocument(q))q=q.contents;if(Y0.isNode(q))return q;if(Y0.isPair(q)){let Y=Z.schema[Y0.MAP].createNode?.(Z.schema,null,Z);return Y.items.push(q),Y}if(q instanceof String||q instanceof Number||q instanceof Boolean||typeof BigInt<"u"&&q instanceof BigInt)q=q.valueOf();let{aliasDuplicateObjects:X,onAnchor:z,onTagObj:U,schema:Q,sourceObjects:J}=Z,G=void 0;if(X&&q&&typeof q==="object")if(G=J.get(q),G)return G.anchor??(G.anchor=z(q)),new $8.Alias(G.anchor);else G={anchor:null,node:null},J.set(q,G);if($?.startsWith("!!"))$=Z8+$.slice(2);let H=X8(q,$,Q.tags);if(!H){if(q&&typeof q.toJSON==="function")q=q.toJSON();if(!q||typeof q!=="object"){let Y=new $1.Scalar(q);if(G)G.node=Y;return Y}H=q instanceof Map?Q[Y0.MAP]:(Symbol.iterator in Object(q))?Q[Y0.SEQ]:Q[Y0.MAP]}if(U)U(H),delete Z.onTagObj;let W=H?.createNode?H.createNode(Z.schema,q,Z):typeof H?.nodeClass?.from==="function"?H.nodeClass.from(Z.schema,q,Z):new $1.Scalar(q);if($)W.tag=$;else if(!H.default)W.tag=H.tag;if(G)G.node=W;return W}U8.createNode=z8});var Fq=I((H8)=>{var J8=g0(),c=N(),G8=Wq();function B$(q,$,Z){let X=Z;for(let z=$.length-1;z>=0;--z){let U=$[z];if(typeof U==="number"&&Number.isInteger(U)&&U>=0){let Q=[];Q[U]=X,X=Q}else X=new Map([[U,X]])}return J8.createNode(X,void 0,{aliasDuplicateObjects:!1,keepUndefined:!1,onAnchor:()=>{throw Error("This should not happen, please report a bug.")},schema:q,sourceObjects:new Map})}var Z1=(q)=>q==null||typeof q==="object"&&!!q[Symbol.iterator]().next().done;class X1 extends G8.NodeBase{constructor(q,$){super(q);Object.defineProperty(this,"schema",{value:$,configurable:!0,enumerable:!1,writable:!0})}clone(q){let $=Object.create(Object.getPrototypeOf(this),Object.getOwnPropertyDescriptors(this));if(q)$.schema=q;if($.items=$.items.map((Z)=>c.isNode(Z)||c.isPair(Z)?Z.clone(q):Z),this.range)$.range=this.range.slice();return $}addIn(q,$){if(Z1(q))this.add($);else{let[Z,...X]=q,z=this.get(Z,!0);if(c.isCollection(z))z.addIn(X,$);else if(z===void 0&&this.schema)this.set(Z,B$(this.schema,X,$));else throw Error(`Expected YAML collection at ${Z}. Remaining path: ${X}`)}}deleteIn(q){let[$,...Z]=q;if(Z.length===0)return this.delete($);let X=this.get($,!0);if(c.isCollection(X))return X.deleteIn(Z);else throw Error(`Expected YAML collection at ${$}. Remaining path: ${Z}`)}getIn(q,$){let[Z,...X]=q,z=this.get(Z,!0);if(X.length===0)return!$&&c.isScalar(z)?z.value:z;else return c.isCollection(z)?z.getIn(X,$):void 0}hasAllNullValues(q){return this.items.every(($)=>{if(!c.isPair($))return!1;let Z=$.value;return Z==null||q&&c.isScalar(Z)&&Z.value==null&&!Z.commentBefore&&!Z.comment&&!Z.tag})}hasIn(q){let[$,...Z]=q;if(Z.length===0)return this.has($);let X=this.get($,!0);return c.isCollection(X)?X.hasIn(Z):!1}setIn(q,$){let[Z,...X]=q;if(X.length===0)this.set(Z,$);else{let z=this.get(Z,!0);if(c.isCollection(z))z.setIn(X,$);else if(z===void 0&&this.schema)this.set(Z,B$(this.schema,X,$));else throw Error(`Expected YAML collection at ${Z}. Remaining path: ${X}`)}}}H8.Collection=X1;H8.collectionFromPath=B$;H8.isEmptyPath=Z1});var k0=I((F8)=>{var W8=(q)=>q.replace(/^(?!$)(?: $)?/gm,"#");function W$(q,$){if(/^\n+$/.test(q))return q.substring(1);return $?q.replace(/^(?! *$)/gm,$):q}var _8=(q,$,Z)=>q.endsWith(`
5
5
  `)?W$(Z,$):Z.includes(`
6
6
  `)?`
@@ -172,7 +172,7 @@ as instructions for when and how to use this skill.
172
172
  - Step-by-step instructions for the agent
173
173
  `}async function o9(q,$){await aU($,{recursive:!0});let Z=oU($,"SKILL.md"),X=rU(q);await sU(Z,X,"utf-8")}async function r9(q){try{return await nU(q),!0}catch{return!1}}import{readdir as tU,stat as eU}from"fs/promises";import{join as qQ}from"path";async function $Q(q){let $=0;try{let X=(await tU(q,{recursive:!0})).map(async(U)=>{try{let Q=await eU(qQ(q,U));if(Q.isFile())return Q.size}catch{}return 0});$=(await Promise.all(X)).reduce((U,Q)=>U+Q,0)}catch{}return $}async function q4(q,$){let Z={},X={global:0,project:0},z={},U=q.map(async(G)=>{Z[G.provider]=(Z[G.provider]||0)+1,X[G.scope]++;let H=await $Q(G.path);return z[G.path]=H,H}),J=(await Promise.all(U)).reduce((G,H)=>G+H,0);return{totalSkills:q.length,byProvider:Z,byScope:X,totalDiskBytes:J,perSkillDiskBytes:z,duplicateGroups:$.duplicateGroups.length,duplicateInstances:$.totalDuplicateInstances}}function ZQ(q){if(q<1024)return`${q} B`;if(q<1048576)return`${(q/1024).toFixed(1)} KB`;if(q<1073741824)return`${(q/1048576).toFixed(1)} MB`;return`${(q/1073741824).toFixed(1)} GB`}function R2(q,$,Z=20){let X=Math.round(q/$*Z),z=Z-X;return B.green("#".repeat(X))+B.dim("-".repeat(z))}var t9={claude:"Claude Code",codex:"Codex",openclaw:"OpenClaw",agents:"Agents"};function $4(q){let $=[];$.push(""),$.push(B.blueBold(" Skill Statistics")),$.push(B.dim(" "+"-".repeat(20))),$.push(""),$.push(` ${B.bold("Total:")} ${B.cyan(String(q.totalSkills))} skills`),$.push(` ${B.bold("Disk:")} ${B.cyan(ZQ(q.totalDiskBytes))}`),$.push(""),$.push(B.bold(" By Provider"));let Z=Object.entries(q.byProvider).sort((G,H)=>H[1]-G[1]),X=Math.max(...Z.map(([,G])=>G)),z=Math.max(...Z.map(([G])=>(t9[G]||G).length));for(let[G,H]of Z){let W=t9[G]||G,Y=e9(G,W.padEnd(z)),V=String(H).padStart(4);$.push(` ${Y} ${V} ${R2(H,X)}`)}$.push(""),$.push(B.bold(" By Scope"));let U=Math.max(q.byScope.global,q.byScope.project),Q=String(q.byScope.global).padStart(4),J=String(q.byScope.project).padStart(4);if($.push(` ${"global ".padEnd(z)} ${Q} ${R2(q.byScope.global,U)}`),$.push(` ${"project".padEnd(z)} ${J} ${R2(q.byScope.project,U)}`),$.push(""),$.push(B.bold(" Duplicates")),q.duplicateGroups>0)$.push(` ${B.yellow(`${q.duplicateGroups} group(s), ${q.duplicateInstances} total instance(s)`)}`),$.push(B.dim(` Run ${B.bold("asm audit")} to review`));else $.push(` ${B.green("None")}`);return $.push(""),$.join(`
174
174
  `)}import{access as XQ,lstat as zQ,readFile as UQ,rm as QQ,symlink as JQ}from"fs/promises";import{join as Z4}from"path";async function X4(q){let $;try{$=await zQ(q)}catch{throw Error(`Path does not exist: ${q}`)}if(!$.isDirectory())throw Error(`Path is not a directory: ${q}`);let Z=Z4(q,"SKILL.md"),X;try{X=await UQ(Z,"utf-8")}catch{throw Error(`No SKILL.md found in ${q}`)}let z=I0(X);if(!z.name)throw Error(`Invalid SKILL.md in ${q}: missing "name" in frontmatter`);return{name:z.name,version:z.version||"0.0.0"}}async function nq(q,$,Z,X){let z=Z4($,Z),U=!1;try{await XQ(z),U=!0}catch{}if(U){if(!X)throw Error(`Target already exists: ${z}. Use --force to overwrite.`);await QQ(z,{recursive:!0,force:!0})}await JQ(q,z,"dir")}var Q4=[{category:"Network requests",description:"Commands or APIs that download or upload data over the network",pattern:/\bcurl\b/,severity:"critical",permissionType:"network"},{category:"Network requests",description:"Commands or APIs that download or upload data over the network",pattern:/\bwget\b/,severity:"critical",permissionType:"network"},{category:"Network requests",description:"Commands or APIs that download or upload data over the network",pattern:/\bfetch\s*\(/,severity:"warning",permissionType:"network"},{category:"Network requests",description:"Commands or APIs that download or upload data over the network",pattern:/\baxios\b/,severity:"warning",permissionType:"network"},{category:"Network requests",description:"Commands or APIs that download or upload data over the network",pattern:/\bhttp\.request\b/,severity:"warning",permissionType:"network"},{category:"Network requests",description:"Commands or APIs that download or upload data over the network",pattern:/\bXMLHttpRequest\b/,severity:"warning",permissionType:"network"},{category:"External URLs",description:"Hardcoded URLs that may indicate data exfiltration or remote payload loading",pattern:/https?:\/\/(?!github\.com|localhost|127\.0\.0\.1|example\.com)/,severity:"warning",permissionType:"network"},{category:"Shell execution",description:"Commands that execute shell processes or arbitrary system commands",pattern:/\bexec\s*\(/,severity:"critical",permissionType:"shell"},{category:"Shell execution",description:"Commands that execute shell processes or arbitrary system commands",pattern:/\bexecSync\b/,severity:"critical",permissionType:"shell"},{category:"Shell execution",description:"Commands that execute shell processes or arbitrary system commands",pattern:/\bchild_process\b/,severity:"critical",permissionType:"shell"},{category:"Shell execution",description:"Commands that execute shell processes or arbitrary system commands",pattern:/\bspawn\s*\(/,severity:"critical",permissionType:"shell"},{category:"Shell execution",description:"Commands that execute shell processes or arbitrary system commands",pattern:/\bBun\.spawn\b/,severity:"critical",permissionType:"shell"},{category:"Shell execution",description:"Commands that execute shell processes or arbitrary system commands",pattern:/\bshelljs\b/,severity:"critical",permissionType:"shell"},{category:"Shell execution",description:"Commands that execute shell processes or arbitrary system commands",pattern:/\b(?:bash|sh|zsh)\s+-c\b/,severity:"critical",permissionType:"shell"},{category:"Dynamic code execution",description:"Patterns that execute dynamically constructed code at runtime",pattern:/\beval\s*\(/,severity:"critical",permissionType:"code-execution"},{category:"Dynamic code execution",description:"Patterns that execute dynamically constructed code at runtime",pattern:/\bnew\s+Function\b/,severity:"critical",permissionType:"code-execution"},{category:"Dynamic code execution",description:"Patterns that execute dynamically constructed code at runtime",pattern:/\bFunction\s*\(/,severity:"critical",permissionType:"code-execution"},{category:"Dynamic code execution",description:"Patterns that execute dynamically constructed code at runtime",pattern:/\bimport\s*\(\s*[^'"]/,severity:"warning",permissionType:"code-execution"},{category:"File system access",description:"Operations that read, write, or modify files on disk",pattern:/\bfs\.(?:write|append|unlink|rm|mkdir|rename)\b/,severity:"warning",permissionType:"filesystem"},{category:"File system access",description:"Operations that read, write, or modify files on disk",pattern:/\bwriteFile(?:Sync)?\b/,severity:"warning",permissionType:"filesystem"},{category:"File system access",description:"Operations that read, write, or modify files on disk",pattern:/\brm\s+-rf?\b/,severity:"critical",permissionType:"filesystem"},{category:"File system access",description:"Operations that read, write, or modify files on disk",pattern:/\bchmod\b/,severity:"warning",permissionType:"filesystem"},{category:"Embedded credentials",description:"Hardcoded secrets, API keys, tokens, or passwords",pattern:/\b(?:API_KEY|SECRET_KEY|ACCESS_TOKEN|PRIVATE_KEY)\s*[=:]/,severity:"critical"},{category:"Embedded credentials",description:"Hardcoded secrets, API keys, tokens, or passwords",pattern:/\bPASSWORD\s*[=:]/,severity:"critical"},{category:"Embedded credentials",description:"Hardcoded secrets, API keys, tokens, or passwords",pattern:/(?:sk|pk)[-_](?:live|test)[-_][a-zA-Z0-9]{20,}/,severity:"critical"},{category:"Environment variable access",description:"Reading environment variables which may contain secrets or configuration",pattern:/\bprocess\.env\b/,severity:"info",permissionType:"environment"},{category:"Environment variable access",description:"Reading environment variables which may contain secrets or configuration",pattern:/\bBun\.env\b/,severity:"info",permissionType:"environment"},{category:"Obfuscation patterns",description:"Base64 encoding, hex strings, or other obfuscation techniques",pattern:/\batob\s*\(/,severity:"warning"},{category:"Obfuscation patterns",description:"Base64 encoding, hex strings, or other obfuscation techniques",pattern:/\bBuffer\.from\s*\([^,]+,\s*['"]base64['"]\)/,severity:"warning"},{category:"Obfuscation patterns",description:"Base64 encoding, hex strings, or other obfuscation techniques",pattern:/\\x[0-9a-fA-F]{2}(?:\\x[0-9a-fA-F]{2}){5,}/,severity:"warning"}];async function GQ(q,$){let Z={owner:q,repo:$,profileUrl:`https://github.com/${q}`,reposUrl:`https://github.com/${q}?tab=repositories`,isOrganization:null,publicRepos:null,accountAge:null,fetchError:null};try{let X=await fetch(`https://api.github.com/users/${q}`,{headers:{Accept:"application/vnd.github.v3+json","User-Agent":"agent-skill-manager"},signal:AbortSignal.timeout(1e4)});if(!X.ok)return Z.fetchError=`GitHub API returned ${X.status}`,Z;let z=await X.json();if(Z.isOrganization=z.type==="Organization",Z.publicRepos=typeof z.public_repos==="number"?z.public_repos:null,typeof z.created_at==="string"){let U=new Date(z.created_at),Q=new Date,J=Math.floor((Q.getTime()-U.getTime())/31557600000),G=Math.floor((Q.getTime()-U.getTime())%31557600000/2630016000.0000005);Z.accountAge=J>0?`${J}y ${G}m`:`${G}m`}x(`security-audit: source analysis for ${q} -> repos=${Z.publicRepos}, org=${Z.isOrganization}, age=${Z.accountAge}`)}catch(X){Z.fetchError=X.message||"Failed to fetch GitHub profile",x(`security-audit: source analysis failed -> ${Z.fetchError}`)}return Z}function HQ(q){let $=new Map;for(let{relPath:z,content:U}of q){let Q=U.split(`
175
- `);for(let J=0;J<Q.length;J++){let G=Q[J],H=G.trim();for(let W of Q4)if(W.pattern.test(G)){let Y=W.category;if(!$.has(Y))$.set(Y,{description:W.description,matches:[]});let V=H.length>120?H.slice(0,120)+"...":H;$.get(Y).matches.push({file:z,line:J+1,match:V,severity:W.severity})}}}let Z=[];for(let[z,U]of $)Z.push({category:z,description:U.description,matches:U.matches});let X={critical:0,warning:1,info:2};return Z.sort((z,U)=>{let Q=Math.min(...z.matches.map((G)=>X[G.severity])),J=Math.min(...U.matches.map((G)=>X[G.severity]));return Q-J}),Z}function YQ(q){let $=new Map;for(let U of q)for(let Q of U.matches)for(let J of Q4)if(J.permissionType&&J.category===U.category&&J.pattern.test(Q.match)){let G=J.permissionType;if(!$.has(G))$.set(G,{evidence:[],categories:new Set});let H=$.get(G);H.evidence.push({file:Q.file,line:Q.line,match:Q.match}),H.categories.add(U.category);break}let Z={filesystem:"Skill reads, writes, or modifies files on disk. Verify it only accesses intended paths.",shell:"Skill executes shell commands or spawns processes. This allows arbitrary system access.",network:"Skill makes network requests or downloads external content. Data may be sent to remote servers.","code-execution":"Skill dynamically constructs and executes code. This can bypass static analysis.",environment:"Skill reads environment variables, which may contain secrets or API keys."},X=[];for(let[U,Q]of $)X.push({type:U,evidence:Q.evidence,reason:Z[U]});let z={shell:0,"code-execution":1,network:2,filesystem:3,environment:4};return X.sort((U,Q)=>(z[U.type]??99)-(z[Q.type]??99)),X}function VQ(q,$,Z){let X=0,z=0;for(let G of q)for(let H of G.matches){if(H.severity==="critical")X++;if(H.severity==="warning")z++}let U=$.some((G)=>G.type==="shell"),Q=$.some((G)=>G.type==="code-execution"),J=$.some((G)=>G.type==="network");if(U&&J)return{verdict:"dangerous",reason:"Skill has both shell execution and network access -- potential data exfiltration risk."};if(Q&&J)return{verdict:"dangerous",reason:"Skill has dynamic code execution and network access -- potential remote code execution risk."};if(X>=10)return{verdict:"dangerous",reason:`${X} critical findings detected. High concentration of risky patterns.`};if(U||Q)return{verdict:"warning",reason:U?"Skill executes shell commands. Review commands carefully before installing.":"Skill uses dynamic code execution. Review usage carefully."};if(X>0)return{verdict:"warning",reason:`${X} critical finding${X>1?"s":""} detected. Manual review recommended.`};if(z>0)return{verdict:"caution",reason:`${z} warning${z>1?"s":""} found. Generally acceptable but worth reviewing.`};if(Z&&Z.publicRepos!==null&&Z.publicRepos<3)return{verdict:"caution",reason:"No code issues found, but the author has very few public repositories."};return{verdict:"safe",reason:"No suspicious patterns detected."}}async function rq(q,$,Z,X){x(`security-audit: scanning ${q}`);let z=await Xq(q),U=z.reduce((Y,V)=>Y+V.lineCount,0),Q=null;if(Z&&X)Q=await GQ(Z,X);let J=HQ(z),G=YQ(J),{verdict:H,reason:W}=VQ(J,G,Q);return{scannedAt:new Date().toISOString(),skillName:$,skillPath:q,source:Q,codeScans:J,permissions:G,totalFiles:z.length,totalLines:U,verdict:H,verdictReason:W}}var D=B,T0=56,BQ={"Shell execution":"shell","Dynamic code execution":"code-execution","Network requests":"network","External URLs":"network","File system access":"filesystem","Environment variable access":"environment","Embedded credentials":"credentials","Obfuscation patterns":"obfuscation"},z4={critical:0,warning:1,info:2};function WQ(q){switch(q){case"safe":return D.bgGreen(" SAFE ");case"caution":return D.bgCyan(" CAUTION ");case"warning":return D.bgYellow(" WARNING ");case"dangerous":return D.bgRed(" DANGEROUS ")}}function _Q(q){switch(q){case"safe":return D.green;case"caution":return D.cyan;case"warning":return D.yellow;case"dangerous":return D.red}}function S0(q){switch(q){case"critical":return D.red("!!");case"warning":return D.yellow(" !");case"info":return D.dim(" i")}}function A2(q,$){return q.length>$?q.slice(0,$-3)+"...":q}function oq(q){return q.toLocaleString("en-US")}function J4(q){return q.replace(/\x1b\[[0-9;]*m/g,"")}function U4(q){return J4(q).length}function FQ(q){let $=new Map;for(let Z of q){let X=`${Z.file}:${Z.line}`,z=$.get(X);if(!z||z4[Z.severity]<z4[z.severity])$.set(X,Z)}return Array.from($.values())}function TQ(q){let $=new Map;for(let Z of q){let X=$.get(Z.file);if(!X)X={file:Z.file,entries:[]},$.set(Z.file,X);X.entries.push({line:Z.line,match:Z.match,severity:Z.severity})}return Array.from($.values())}function tq(q){let $=[],Z=WQ(q.verdict),X=J4(Z),z=` ${D.bold(q.skillName)}`,U=` ${q.skillName}`,Q=T0-4,J=Math.max(1,Q-U.length-X.length);if($.push(""),$.push(D.dim(" ┌─ ")+D.bold("Security Audit")+D.dim(" "+"".repeat(T0-19)+"")),$.push(D.dim(" ")+z+" ".repeat(J)+Z+D.dim("")),$.push(D.dim(" ")+D.dim(` ${oq(q.totalFiles)} files · ${oq(q.totalLines)} lines`)+" ".repeat(Math.max(1,Q-` ${oq(q.totalFiles)} files · ${oq(q.totalLines)} lines`.length))+D.dim("")),$.push(D.dim(" "+"".repeat(T0-2)+"")),q.source){let Y=q.source;if(Y.fetchError)$.push(` ${D.yellow("!")} Could not fetch profile: ${Y.fetchError}`);else{let V=[];if(V.push(`${Y.owner} ${Y.isOrganization?D.cyan("(org)"):D.dim("(user)")}`),Y.publicRepos!==null){let T=Y.publicRepos,L=T<3?D.yellow(`${T} repos`):T<10?D.cyan(`${T} repos`):D.green(`${T} repos`);V.push(L)}if(Y.accountAge)V.push(Y.accountAge);$.push(` ${D.dim("Author:")} ${V.join(D.dim(" · "))}`)}}if($.push(""),q.codeScans.length===0)$.push(` ${D.green("")} ${D.green("No suspicious patterns detected.")}`);else{let Y=_Q(q.verdict),V=q.verdict==="dangerous"||q.verdict==="warning"?S0("critical"):q.verdict==="caution"?S0("warning"):S0("info");$.push(` ${V} ${Y(q.verdictReason)}`);let T=0,L=0,F=0;for(let R of q.codeScans)for(let M of R.matches)if(M.severity==="critical")T++;else if(M.severity==="warning")L++;else F++;let _=[];if(T>0)_.push(D.red(`${T} critical`));if(L>0)_.push(D.yellow(`${L} warning`));if(F>0)_.push(D.dim(`${F} info`));let O=q.permissions.map((R)=>R.type),A=O.length>0?D.dim(`Perms: ${O.join(", ")}`):"";$.push(` ${_.join(D.dim(" · "))} ${A}`)}if($.push(""),q.codeScans.length>0){$.push(` ${D.bold("Findings")}`),$.push(D.dim(" "+"".repeat(T0-2)));for(let Y of q.codeScans){let V=FQ(Y.matches),T=V.filter((b)=>b.severity==="critical").length,L=V.filter((b)=>b.severity==="warning").length,F=V.filter((b)=>b.severity==="info").length,_=T>0?S0("critical"):L>0?S0("warning"):S0("info"),O=[];if(T>0)O.push(D.red(`${T} critical`));if(L>0)O.push(D.yellow(`${L} warning`));if(F>0)O.push(D.dim(`${F} info`));let A=BQ[Y.category],R=A?D.dim(`PERM: ${A}`):"",M=` ${_} ${D.bold(Y.category)} (${O.join(", ")})`;if(R){let b=U4(M),u=U4(R),C=Math.max(2,T0-b-u);$.push(M+" ".repeat(C)+R)}else $.push(M);let w=TQ(V),P=Math.min(24,Math.max(...w.map((b)=>b.file.length))),j=0,K=3;for(let b of w){if(j>=K)break;let u=A2(b.file,24),C=D.dim(u.padEnd(P));if(b.entries.length===1){let s=b.entries[0],O0=A2(s.match,50);$.push(` ${C} :${s.line} ${D.dim("--")} ${s.severity==="critical"?O0:D.dim(O0)}`),j++}else if(b.entries.length<=3){let s=b.entries.map((eq)=>`:${eq.line}`).join(", "),O0=A2(b.entries[0].match,40);$.push(` ${C} ${s} ${D.dim("--")} ${D.dim(O0)}`),j++}else{let O0=b.entries.slice(0,3).map((w4)=>`:${w4.line}`).join(", "),eq=b.entries.length-3;$.push(` ${C} ${O0} ${D.dim(`(+${eq} more)`)}`),j++}}let E=w.length-Math.min(w.length,K);if(E>0){let b=V.length-w.slice(0,K).reduce((u,C)=>u+C.entries.length,0);if(b>0)$.push(` ${D.dim(`... ${b} more in ${E} file${E>1?"s":""}`)}`)}$.push("")}}$.push(D.dim(" "+"".repeat(T0-2)));let G=new Date(q.scannedAt),H=`${G.getFullYear()}-${String(G.getMonth()+1).padStart(2,"0")}-${String(G.getDate()).padStart(2,"0")} ${String(G.getHours()).padStart(2,"0")}:${String(G.getMinutes()).padStart(2,"0")}`,W=q.source&&!q.source.fetchError?`github.com/${q.source.owner}`:"";if(W){let Y=Math.max(2,T0-2-H.length-W.length);$.push(D.dim(` ${H}${" ".repeat(Y)}${W}`))}else $.push(D.dim(` ${H}`));return $.push(""),$.join(`
175
+ `);for(let J=0;J<Q.length;J++){let G=Q[J],H=G.trim();for(let W of Q4)if(W.pattern.test(G)){let Y=W.category;if(!$.has(Y))$.set(Y,{description:W.description,matches:[]});let V=H.length>120?H.slice(0,120)+"...":H;$.get(Y).matches.push({file:z,line:J+1,match:V,severity:W.severity})}}}let Z=[];for(let[z,U]of $)Z.push({category:z,description:U.description,matches:U.matches});let X={critical:0,warning:1,info:2};return Z.sort((z,U)=>{let Q=Math.min(...z.matches.map((G)=>X[G.severity])),J=Math.min(...U.matches.map((G)=>X[G.severity]));return Q-J}),Z}function YQ(q){let $=new Map;for(let U of q)for(let Q of U.matches)for(let J of Q4)if(J.permissionType&&J.category===U.category&&J.pattern.test(Q.match)){let G=J.permissionType;if(!$.has(G))$.set(G,{evidence:[],categories:new Set});let H=$.get(G);H.evidence.push({file:Q.file,line:Q.line,match:Q.match}),H.categories.add(U.category);break}let Z={filesystem:"Skill reads, writes, or modifies files on disk. Verify it only accesses intended paths.",shell:"Skill executes shell commands or spawns processes. This allows arbitrary system access.",network:"Skill makes network requests or downloads external content. Data may be sent to remote servers.","code-execution":"Skill dynamically constructs and executes code. This can bypass static analysis.",environment:"Skill reads environment variables, which may contain secrets or API keys."},X=[];for(let[U,Q]of $)X.push({type:U,evidence:Q.evidence,reason:Z[U]});let z={shell:0,"code-execution":1,network:2,filesystem:3,environment:4};return X.sort((U,Q)=>(z[U.type]??99)-(z[Q.type]??99)),X}function VQ(q,$,Z){let X=0,z=0;for(let G of q)for(let H of G.matches){if(H.severity==="critical")X++;if(H.severity==="warning")z++}let U=$.some((G)=>G.type==="shell"),Q=$.some((G)=>G.type==="code-execution"),J=$.some((G)=>G.type==="network");if(U&&J)return{verdict:"dangerous",reason:"Skill has both shell execution and network access -- potential data exfiltration risk."};if(Q&&J)return{verdict:"dangerous",reason:"Skill has dynamic code execution and network access -- potential remote code execution risk."};if(X>=10)return{verdict:"dangerous",reason:`${X} critical findings detected. High concentration of risky patterns.`};if(U||Q)return{verdict:"warning",reason:U?"Skill executes shell commands. Review commands carefully before installing.":"Skill uses dynamic code execution. Review usage carefully."};if(X>0)return{verdict:"warning",reason:`${X} critical finding${X>1?"s":""} detected. Manual review recommended.`};if(z>0)return{verdict:"caution",reason:`${z} warning${z>1?"s":""} found. Generally acceptable but worth reviewing.`};if(Z&&Z.publicRepos!==null&&Z.publicRepos<3)return{verdict:"caution",reason:"No code issues found, but the author has very few public repositories."};return{verdict:"safe",reason:"No suspicious patterns detected."}}async function rq(q,$,Z,X){x(`security-audit: scanning ${q}`);let z=await Xq(q),U=z.reduce((Y,V)=>Y+V.lineCount,0),Q=null;if(Z&&X)Q=await GQ(Z,X);let J=HQ(z),G=YQ(J),{verdict:H,reason:W}=VQ(J,G,Q);return{scannedAt:new Date().toISOString(),skillName:$,skillPath:q,source:Q,codeScans:J,permissions:G,totalFiles:z.length,totalLines:U,verdict:H,verdictReason:W}}var D=B,T0=56,BQ={"Shell execution":"shell","Dynamic code execution":"code-execution","Network requests":"network","External URLs":"network","File system access":"filesystem","Environment variable access":"environment","Embedded credentials":"credentials","Obfuscation patterns":"obfuscation"},z4={critical:0,warning:1,info:2};function WQ(q){switch(q){case"safe":return D.bgGreen(" SAFE ");case"caution":return D.bgCyan(" CAUTION ");case"warning":return D.bgYellow(" WARNING ");case"dangerous":return D.bgRed(" DANGEROUS ")}}function _Q(q){switch(q){case"safe":return D.green;case"caution":return D.cyan;case"warning":return D.yellow;case"dangerous":return D.red}}function S0(q){switch(q){case"critical":return D.red("!!");case"warning":return D.yellow(" !");case"info":return D.dim(" i")}}function A2(q,$){return q.length>$?q.slice(0,$-3)+"...":q}function oq(q){return q.toLocaleString("en-US")}function J4(q){return q.replace(/\x1b\[[0-9;]*m/g,"")}function U4(q){return J4(q).length}function FQ(q){let $=new Map;for(let Z of q){let X=`${Z.file}:${Z.line}`,z=$.get(X);if(!z||z4[Z.severity]<z4[z.severity])$.set(X,Z)}return Array.from($.values())}function TQ(q){let $=new Map;for(let Z of q){let X=$.get(Z.file);if(!X)X={file:Z.file,entries:[]},$.set(Z.file,X);X.entries.push({line:Z.line,match:Z.match,severity:Z.severity})}return Array.from($.values())}function tq(q){let $=[],Z=WQ(q.verdict),X=J4(Z),z=` ${D.bold(q.skillName)}`,U=` ${q.skillName}`,Q=T0-4,J=Math.max(1,Q-U.length-X.length);if($.push(""),$.push(D.dim(" +-- ")+D.bold("Security Audit")+D.dim(" "+"-".repeat(T0-19)+"+")),$.push(D.dim(" |")+z+" ".repeat(J)+Z+D.dim("|")),$.push(D.dim(" |")+D.dim(` ${oq(q.totalFiles)} files | ${oq(q.totalLines)} lines`)+" ".repeat(Math.max(1,Q-` ${oq(q.totalFiles)} files | ${oq(q.totalLines)} lines`.length))+D.dim("|")),$.push(D.dim(" +"+"-".repeat(T0-2)+"+")),q.source){let Y=q.source;if(Y.fetchError)$.push(` ${D.yellow("!")} Could not fetch profile: ${Y.fetchError}`);else{let V=[];if(V.push(`${Y.owner} ${Y.isOrganization?D.cyan("(org)"):D.dim("(user)")}`),Y.publicRepos!==null){let T=Y.publicRepos,L=T<3?D.yellow(`${T} repos`):T<10?D.cyan(`${T} repos`):D.green(`${T} repos`);V.push(L)}if(Y.accountAge)V.push(Y.accountAge);$.push(` ${D.dim("Author:")} ${V.join(D.dim(" | "))}`)}}if($.push(""),q.codeScans.length===0)$.push(` ${D.green("*")} ${D.green("No suspicious patterns detected.")}`);else{let Y=_Q(q.verdict),V=q.verdict==="dangerous"||q.verdict==="warning"?S0("critical"):q.verdict==="caution"?S0("warning"):S0("info");$.push(` ${V} ${Y(q.verdictReason)}`);let T=0,L=0,F=0;for(let R of q.codeScans)for(let M of R.matches)if(M.severity==="critical")T++;else if(M.severity==="warning")L++;else F++;let _=[];if(T>0)_.push(D.red(`${T} critical`));if(L>0)_.push(D.yellow(`${L} warning`));if(F>0)_.push(D.dim(`${F} info`));let O=q.permissions.map((R)=>R.type),A=O.length>0?D.dim(`Perms: ${O.join(", ")}`):"";$.push(` ${_.join(D.dim(" | "))} ${A}`)}if($.push(""),q.codeScans.length>0){$.push(` ${D.bold("Findings")}`),$.push(D.dim(" "+"=".repeat(T0-2)));for(let Y of q.codeScans){let V=FQ(Y.matches),T=V.filter((b)=>b.severity==="critical").length,L=V.filter((b)=>b.severity==="warning").length,F=V.filter((b)=>b.severity==="info").length,_=T>0?S0("critical"):L>0?S0("warning"):S0("info"),O=[];if(T>0)O.push(D.red(`${T} critical`));if(L>0)O.push(D.yellow(`${L} warning`));if(F>0)O.push(D.dim(`${F} info`));let A=BQ[Y.category],R=A?D.dim(`PERM: ${A}`):"",M=` ${_} ${D.bold(Y.category)} (${O.join(", ")})`;if(R){let b=U4(M),u=U4(R),C=Math.max(2,T0-b-u);$.push(M+" ".repeat(C)+R)}else $.push(M);let w=TQ(V),P=Math.min(24,Math.max(...w.map((b)=>b.file.length))),j=0,K=3;for(let b of w){if(j>=K)break;let u=A2(b.file,24),C=D.dim(u.padEnd(P));if(b.entries.length===1){let s=b.entries[0],O0=A2(s.match,50);$.push(` ${C} :${s.line} ${D.dim("--")} ${s.severity==="critical"?O0:D.dim(O0)}`),j++}else if(b.entries.length<=3){let s=b.entries.map((eq)=>`:${eq.line}`).join(", "),O0=A2(b.entries[0].match,40);$.push(` ${C} ${s} ${D.dim("--")} ${D.dim(O0)}`),j++}else{let O0=b.entries.slice(0,3).map((w4)=>`:${w4.line}`).join(", "),eq=b.entries.length-3;$.push(` ${C} ${O0} ${D.dim(`(+${eq} more)`)}`),j++}}let E=w.length-Math.min(w.length,K);if(E>0){let b=V.length-w.slice(0,K).reduce((u,C)=>u+C.entries.length,0);if(b>0)$.push(` ${D.dim(`... ${b} more in ${E} file${E>1?"s":""}`)}`)}$.push("")}}$.push(D.dim(" "+"=".repeat(T0-2)));let G=new Date(q.scannedAt),H=`${G.getFullYear()}-${String(G.getMonth()+1).padStart(2,"0")}-${String(G.getDate()).padStart(2,"0")} ${String(G.getHours()).padStart(2,"0")}:${String(G.getMinutes()).padStart(2,"0")}`,W=q.source&&!q.source.fetchError?`github.com/${q.source.owner}`:"";if(W){let Y=Math.max(2,T0-2-H.length-W.length);$.push(D.dim(` ${H}${" ".repeat(Y)}${W}`))}else $.push(D.dim(` ${H}`));return $.push(""),$.join(`
176
176
  `)}function K2(q){return JSON.stringify(q,null,2)}function LQ(q){let $=q.slice(2),Z={command:null,subcommand:null,positional:[],flags:{help:!1,version:!1,json:!1,yes:!1,noColor:!1,scope:"both",sort:"name",provider:null,name:null,force:!1,path:null,all:!1,verbose:!1,flat:!1,transport:"auto"}},X=0;while(X<$.length){let z=$[X];if(z==="--help"||z==="-h")Z.flags.help=!0;else if(z==="--version"||z==="-v")Z.flags.version=!0;else if(z==="--json")Z.flags.json=!0;else if(z==="--yes"||z==="-y")Z.flags.yes=!0;else if(z==="--no-color")Z.flags.noColor=!0;else if(z==="--scope"||z==="-s"){X++;let U=$[X];if(U==="global"||U==="project"||U==="both")Z.flags.scope=U;else S(`Invalid scope: "${U}". Must be global, project, or both.`),process.exit(2)}else if(z==="--sort"){X++;let U=$[X];if(U==="name"||U==="version"||U==="location")Z.flags.sort=U;else S(`Invalid sort: "${U}". Must be name, version, or location.`),process.exit(2)}else if(z==="--provider"||z==="-p")X++,Z.flags.provider=$[X]||null;else if(z==="--name")X++,Z.flags.name=$[X]||null;else if(z==="--force"||z==="-f")Z.flags.force=!0;else if(z==="--path")X++,Z.flags.path=$[X]||null;else if(z==="--all")Z.flags.all=!0;else if(z==="--verbose"||z==="-V")Z.flags.verbose=!0;else if(z==="--flat")Z.flags.flat=!0;else if(z==="--transport"||z==="-t"){X++;let U=$[X];if(U==="https"||U==="ssh"||U==="auto")Z.flags.transport=U;else S(`Invalid transport: "${U}". Must be https, ssh, or auto.`),process.exit(2)}else if(z.startsWith("-"))S(`Unknown option: ${z}`),console.error('Run "asm --help" for usage.'),process.exit(2);else if(!Z.command)Z.command=z;else if(!Z.subcommand)Z.subcommand=z;else Z.positional.push(z);X++}return Z}function S(q){console.error(B.red(`Error: ${q}`))}function OQ(){console.log(`${B.blueBold("agent-skill-manager")} (${B.bold("asm")}) ${b2}
177
177
 
178
178
  Interactive TUI and CLI for managing installed skills for AI coding agents.
@@ -433,4 +433,4 @@ ${B.bold("Examples:")}
433
433
  asm link ./my-skill ${B.dim("Link (interactive provider)")}
434
434
  asm link ./my-skill -p claude ${B.dim("Link to Claude Code")}
435
435
  asm link ./my-skill --name alias ${B.dim("Link with custom name")}`)}async function lQ(q){if(q.flags.help){pQ();return}let $=q.subcommand;if(!$)S("Missing required argument: <path>"),console.error('Run "asm link --help" for usage.'),process.exit(2);let{resolve:Z,basename:X}=await import("path"),z=Z($),U=await X4(z),Q=q.flags.name?Qq(q.flags.name):X(z),J=await g(),{provider:G}=await Jq(J,q.flags.provider,!!process.stdin.isTTY),{resolveProviderPath:H}=await import("./chunk-wdjcav1v.js"),W=H(J.providers.find((T)=>T.name===G.name).global),{join:Y}=await import("path"),V=Y(W,Q);if(!q.flags.force){let T=!1;try{let{access:L}=await import("fs/promises");await L(V),T=!0}catch{}if(T){if(!process.stdin.isTTY)S(`Target already exists: ${V}. Use --force to overwrite.`),process.exit(2);process.stderr.write(`${B.yellow(`Target already exists: ${V}`)}
436
- ${B.bold("Overwrite?")} [y/N] `);let L=await L0();if(L.toLowerCase()!=="y"&&L.toLowerCase()!=="yes")console.error("Aborted."),process.exit(0);await nq(z,W,Q,!0)}else await nq(z,W,Q,!1)}else await nq(z,W,Q,!0);if(q.flags.json)console.log(G0({success:!0,name:Q,symlinkPath:V,targetPath:z}));else console.error(B.green(`Done! Linked "${Q}" -> ${z}`)),console.error(` Symlink: ${V}`),console.error(B.dim(` If you move or delete the source, run "asm uninstall ${Q}" to clean up.`))}async function M4(q){let $=LQ(q);if($.flags.noColor)globalThis.__CLI_NO_COLOR=!0;if($.flags.verbose)G4(!0);if($.flags.version){console.log(`asm ${b2}`);return}if(!$.command&&$.flags.help){OQ();return}if(!$.command)return;switch($.command){case"list":await wQ($);break;case"search":await PQ($);break;case"inspect":await NQ($);break;case"uninstall":await jQ($);break;case"audit":await bQ($);break;case"install":await gQ($);break;case"config":await yQ($);break;case"export":await hQ($);break;case"init":await vQ($);break;case"stats":await dQ($);break;case"link":await lQ($);break;default:S(`Unknown command: "${$.command}"`),console.error('Run "asm --help" for usage.'),process.exit(2)}}function D4(q){let $=q.slice(2);if($.length===0)return!1;let Z=["list","search","inspect","uninstall","audit","config","install","export","init","stats","link"],X=$[0];if(Z.includes(X))return!0;if(X==="--help"||X==="-h")return!0;if(X==="--version"||X==="-v")return!0;if(X.startsWith("-")||X.length>0)return!0;return!1}if(D4(process.argv))await M4(process.argv);else await import("./chunk-dp2yw2bk.js");
436
+ ${B.bold("Overwrite?")} [y/N] `);let L=await L0();if(L.toLowerCase()!=="y"&&L.toLowerCase()!=="yes")console.error("Aborted."),process.exit(0);await nq(z,W,Q,!0)}else await nq(z,W,Q,!1)}else await nq(z,W,Q,!0);if(q.flags.json)console.log(G0({success:!0,name:Q,symlinkPath:V,targetPath:z}));else console.error(B.green(`Done! Linked "${Q}" -> ${z}`)),console.error(` Symlink: ${V}`),console.error(B.dim(` If you move or delete the source, run "asm uninstall ${Q}" to clean up.`))}async function M4(q){let $=LQ(q);if($.flags.noColor)globalThis.__CLI_NO_COLOR=!0;if($.flags.verbose)G4(!0);if($.flags.version){console.log(`asm ${b2}`);return}if(!$.command&&$.flags.help){OQ();return}if(!$.command)return;switch($.command){case"list":await wQ($);break;case"search":await PQ($);break;case"inspect":await NQ($);break;case"uninstall":await jQ($);break;case"audit":await bQ($);break;case"install":await gQ($);break;case"config":await yQ($);break;case"export":await hQ($);break;case"init":await vQ($);break;case"stats":await dQ($);break;case"link":await lQ($);break;default:S(`Unknown command: "${$.command}"`),console.error('Run "asm --help" for usage.'),process.exit(2)}}function D4(q){let $=q.slice(2);if($.length===0)return!1;let Z=["list","search","inspect","uninstall","audit","config","install","export","init","stats","link"],X=$[0];if(Z.includes(X))return!0;if(X==="--help"||X==="-h")return!0;if(X==="--version"||X==="-v")return!0;if(X.startsWith("-")||X.length>0)return!0;return!1}if(D4(process.argv))await M4(process.argv);else await import("./chunk-4ftygzj1.js");