agent-skills-standard 2.5.0 → 2.6.0

package/README.md

@@ -5,7 +5,7 @@
 
 **Sync 242 AI coding standards to any project in one command.** Works with Cursor, Claude Code, GitHub Copilot, Gemini, Windsurf, Trae, Kiro, and Roo.
 
-**Current release:** `v2.4.7` — workflow-end telemetry guidance, MCP session-cost helpers, and clearer runtime integration for SDLC handoff reporting.
+**Current release:** `v2.5.1` — automated SkillSpector security scanning, pull request evaluation gates, and verified release tags.
 
 ```bash
 npx agent-skills-standard@latest init   # detect your stack
@@ -126,6 +126,7 @@ The CLI **never** modifies user-home files (`~/.cursor/mcp.json`, `~/.gemini/set
 
 | Version | Date | Skills | Avg Tokens | Savings (%) | Report |
 | --- | --- | --- | --- | --- | --- |
+| v2.6.0 | 2026-07-10 | 264 | 528 | 46% | [Report](benchmarks/archive/v2.6.0.md) |
 | v2.4.7 | 2026-06-15 | 251 | 551 | 85% | [Report](benchmarks/archive/v2.4.7.md) |
 | v2.4.6 | 2026-06-10 | 251 | 548 | 85% | [Report](benchmarks/archive/v2.4.6.md) |
 | v2.4.1 | 2026-05-18 | 247 | 540 | 85% | [Report](benchmarks/archive/v2.4.1.md) |
@@ -135,4 +136,3 @@ The CLI **never** modifies user-home files (`~/.cursor/mcp.json`, `~/.gemini/set
 | v2.2.0 | 2026-04-22 | 242 | 538 | 85% | [Report](benchmarks/archive/v2.2.0.md) |
 | v2.1.2 | 2026-04-11 | 237 | 516 | 86% | [Report](benchmarks/archive/v2.1.2.md) |
 | v2.1.1 | 2026-04-11 | 237 | 516 | 86% | [Report](benchmarks/archive/v2.1.1.md) |
-| v2.1.0 | 2026-04-04 | 237 | 526 | 86% | [Report](benchmarks/archive/v2.1.0.md) |

package/dist/index.js

@@ -26,14 +26,14 @@ let dotenv = require("dotenv");
 dotenv = __toESM(dotenv);
 let picocolors = require("picocolors");
 picocolors = __toESM(picocolors);
-let inquirer = require("inquirer");
-inquirer = __toESM(inquirer);
 let fs_extra = require("fs-extra");
 fs_extra = __toESM(fs_extra);
-let js_yaml = require("js-yaml");
-js_yaml = __toESM(js_yaml);
 let path = require("path");
 path = __toESM(path);
+let inquirer = require("inquirer");
+inquirer = __toESM(inquirer);
+let js_yaml = require("js-yaml");
+js_yaml = __toESM(js_yaml);
 let zod = require("zod");
 let cross_fetch = require("cross-fetch");
 cross_fetch = __toESM(cross_fetch);
@@ -43,7 +43,7 @@ let child_process = require("child_process");
 let fs = require("fs");
 var package_default = {
 	name: "agent-skills-standard",
-	version: "2.5.0",
+	version: "2.6.0",
 	description: "A CLI to manage and sync AI agent skills standard for Cursor, Claude, Copilot, Windsurf, and more.",
 	main: "dist/index.js",
 	bin: {
@@ -94,6 +94,229 @@ var package_default = {
 	}
 };
 //#endregion
+//#region src/services/EvalsVerifier.ts
+function checkAssertion(assertion, transcript) {
+	const haystack = transcript.toLowerCase();
+	if (assertion.type === "contains_any") return (Array.isArray(assertion.value) ? assertion.value : [assertion.value]).some((value) => haystack.includes(value.toLowerCase()));
+	if (assertion.type === "not_contains") return !haystack.includes(String(assertion.value).toLowerCase());
+	if (assertion.type === "regex") try {
+		return new RegExp(String(assertion.value), "i").test(transcript);
+	} catch {
+		return false;
+	}
+	if (assertion.type === "file_reference") {
+		const value = String(assertion.value).toLowerCase();
+		return haystack.includes(value) || haystack.includes(path.basename(value));
+	}
+	return haystack.includes(String(assertion.value).toLowerCase());
+}
+function answerPath(runDir, manifest, skill, caseId, arm) {
+	const categoryParts = manifest.category === "all" ? [skill.category] : [];
+	const filename = arm ? `${caseId}.${arm}.md` : `${caseId}.md`;
+	return path.join(runDir, "answers", ...categoryParts, skill.skillName, filename);
+}
+function readAnswer(runDir, manifest, skill, currentCase, arm) {
+	const filePath = answerPath(runDir, manifest, skill, currentCase.id, arm);
+	return fs_extra.default.existsSync(filePath) ? fs_extra.default.readFileSync(filePath, "utf8") : null;
+}
+function readInputs(runDir) {
+	const inputsPath = path.join(runDir, "inputs.json");
+	return fs_extra.default.existsSync(inputsPath) ? fs_extra.default.readJSONSync(inputsPath) : null;
+}
+function evalDataFor(projectRoot, runDir, skill) {
+	const inputs = readInputs(runDir);
+	if (inputs) {
+		const source = inputs.sources[`${skill.category}/${skill.skillName}`];
+		if (!source) throw new Error(`inputs.json is missing ${skill.category}/${skill.skillName}`);
+		return source.evals;
+	}
+	const evalsPath = path.join(projectRoot, "skills", skill.category, skill.skillName, "evals", "evals.json");
+	return fs_extra.default.existsSync(evalsPath) ? fs_extra.default.readJSONSync(evalsPath) : {};
+}
+function passRate(results) {
+	return results.length > 0 ? results.filter(Boolean).length / results.length : 0;
+}
+function assertionRate(results) {
+	const total = results.reduce((sum, result) => sum + result.total, 0);
+	return total > 0 ? results.reduce((sum, result) => sum + result.passed, 0) / total : 0;
+}
+function triggerDecision(transcript) {
+	return transcript.match(/^\s*TRIGGER:\s*(yes|no)\s*$/im)?.[1].toLowerCase();
+}
+function summarizeSkill(projectRoot, runDir, manifest, skill) {
+	const evalsData = evalDataFor(projectRoot, runDir, skill);
+	const evalById = new Map((evalsData.evals ?? []).map((evaluation) => [String(evaluation.id), evaluation]));
+	const pressureByIndex = evalsData.pressure_scenarios ?? [];
+	const baseline = [];
+	const withSkill = [];
+	const baselineAssertions = [];
+	const withSkillAssertions = [];
+	const positive = [];
+	const negative = [];
+	for (const currentCase of skill.cases) {
+		if (currentCase.kind === "trigger") {
+			const transcript = readAnswer(runDir, manifest, skill, currentCase);
+			if (transcript === null) throw new Error(`missing answer: ${skill.skillName}/${currentCase.id}`);
+			const actual = triggerDecision(transcript);
+			if ((currentCase.expectedTrigger ?? "no") === "yes") positive.push(actual === "yes");
+			else negative.push(actual === "no");
+			continue;
+		}
+		const assertions = currentCase.kind === "eval" ? evalById.get(currentCase.id.replace("eval-", ""))?.assertions ?? [] : (pressureByIndex[Number(currentCase.id.replace("pressure-", "")) - 1]?.behavior_assertions ?? []).map((value) => ({
+			type: "contains",
+			value
+		}));
+		for (const arm of ["baseline", "with-skill"]) {
+			if (!(arm in currentCase.arms)) continue;
+			const transcript = readAnswer(runDir, manifest, skill, currentCase, arm);
+			if (transcript === null) throw new Error(`missing answer: ${skill.skillName}/${currentCase.id}.${arm}`);
+			const checks = assertions.map((assertion) => checkAssertion(assertion, transcript));
+			const passed = checks.every(Boolean);
+			(arm === "baseline" ? baseline : withSkill).push(passed);
+			(arm === "baseline" ? baselineAssertions : withSkillAssertions).push({
+				passed: checks.filter(Boolean).length,
+				total: checks.length
+			});
+		}
+	}
+	const baselineCompromised = manifest.compromisedSkills?.some((record) => record.category === skill.category && record.skillName === skill.skillName && record.arm === "baseline") ?? false;
+	const baselinePassRate = passRate(baseline);
+	const withSkillPassRate = passRate(withSkill);
+	const triggerRecall = positive.length > 0 ? positive.filter(Boolean).length / positive.length : null;
+	const triggerSpecificity = negative.length > 0 ? negative.filter(Boolean).length / negative.length : null;
+	const balancedTriggerAccuracy = triggerRecall === null || triggerSpecificity === null ? null : (triggerRecall + triggerSpecificity) / 2;
+	return {
+		baselinePassRate: baselineCompromised ? "n/a" : baselinePassRate,
+		withSkillPassRate,
+		delta: baselineCompromised ? "n/a" : withSkillPassRate - baselinePassRate,
+		casePassRate: {
+			baseline: baselineCompromised ? "n/a" : baselinePassRate,
+			withSkill: withSkillPassRate
+		},
+		assertionPassRate: {
+			baseline: baselineCompromised ? "n/a" : assertionRate(baselineAssertions),
+			withSkill: assertionRate(withSkillAssertions)
+		},
+		triggerRecall,
+		triggerSpecificity,
+		balancedTriggerAccuracy
+	};
+}
+function compareMetric(diffs, name, committed, recomputed) {
+	if (JSON.stringify(committed) !== JSON.stringify(recomputed)) diffs.push(`${name} committed=${JSON.stringify(committed)} recomputed=${JSON.stringify(recomputed)}`);
+}
+function verifyEvalRun(projectRoot, runId) {
+	const runDir = path.join(projectRoot, "benchmarks", "evals", "runs", runId);
+	const resultsPath = path.join(runDir, "results.json");
+	const manifestPath = path.join(runDir, "manifest.json");
+	if (!fs_extra.default.existsSync(runDir)) return {
+		runId,
+		ok: false,
+		reason: `run directory not found: ${runDir}`
+	};
+	if (!fs_extra.default.existsSync(resultsPath) || !fs_extra.default.existsSync(manifestPath)) return {
+		runId,
+		ok: false,
+		reason: "run is missing manifest.json or results.json"
+	};
+	const manifest = fs_extra.default.readJSONSync(manifestPath);
+	if (manifest.schemaVersion === 2 && readInputs(runDir) === null) return {
+		runId,
+		ok: false,
+		reason: "v2 run is missing immutable inputs.json"
+	};
+	const committed = fs_extra.default.readJSONSync(resultsPath);
+	const diffs = [];
+	for (const skill of manifest.skills) {
+		let recomputed;
+		try {
+			recomputed = summarizeSkill(projectRoot, runDir, manifest, skill);
+		} catch (error) {
+			diffs.push(`${skill.skillName}: ${error instanceof Error ? error.message : String(error)}`);
+			continue;
+		}
+		const committedSkill = committed.skills.find((entry) => entry.skillName === skill.skillName && (!entry.category || entry.category === skill.category));
+		if (!committedSkill) {
+			diffs.push(`${skill.skillName}: missing from committed results.json`);
+			continue;
+		}
+		if (manifest.schemaVersion === 2 || committed.schemaVersion === 2) {
+			compareMetric(diffs, `${skill.skillName}.baselinePassRate`, committedSkill.baselinePassRate, recomputed.baselinePassRate);
+			compareMetric(diffs, `${skill.skillName}.withSkillPassRate`, committedSkill.withSkillPassRate, recomputed.withSkillPassRate);
+			compareMetric(diffs, `${skill.skillName}.delta`, committedSkill.delta, recomputed.delta);
+			compareMetric(diffs, `${skill.skillName}.casePassRate`, committedSkill.casePassRate, recomputed.casePassRate);
+			compareMetric(diffs, `${skill.skillName}.assertionPassRate`, committedSkill.assertionPassRate, recomputed.assertionPassRate);
+			compareMetric(diffs, `${skill.skillName}.triggerRecall`, committedSkill.triggerRecall, recomputed.triggerRecall);
+			compareMetric(diffs, `${skill.skillName}.triggerSpecificity`, committedSkill.triggerSpecificity, recomputed.triggerSpecificity);
+			compareMetric(diffs, `${skill.skillName}.balancedTriggerAccuracy`, committedSkill.balancedTriggerAccuracy, recomputed.balancedTriggerAccuracy);
+		} else {
+			compareMetric(diffs, `${skill.skillName}.baselinePassRate`, committedSkill.baselinePassRate, recomputed.baselinePassRate);
+			compareMetric(diffs, `${skill.skillName}.withSkillPassRate`, committedSkill.withSkillPassRate, recomputed.withSkillPassRate);
+		}
+	}
+	return diffs.length > 0 ? {
+		runId,
+		ok: false,
+		reason: "recomputed scores differ from committed results.json",
+		diffs
+	} : {
+		runId,
+		ok: true
+	};
+}
+function listEvalRuns(projectRoot) {
+	const runsDir = path.join(projectRoot, "benchmarks", "evals", "runs");
+	if (!fs_extra.default.existsSync(runsDir)) return [];
+	return fs_extra.default.readdirSync(runsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort();
+}
+function readEvalsReport(projectRoot) {
+	const reportPath = path.join(projectRoot, "evals-report.md");
+	return fs_extra.default.existsSync(reportPath) ? fs_extra.default.readFileSync(reportPath, "utf8") : null;
+}
+//#endregion
+//#region src/commands/evals.ts
+/**
+* Command for verifying and displaying live skill-eval runs
+* (see docs/EVALS.md and the `evals-run` workflow for how runs are produced).
+*/
+var EvalsCommand = class {
+	async run(action, options = {}, projectRoot = process.cwd()) {
+		switch (action) {
+			case "verify": return this.verify(options.run, projectRoot);
+			case "report": return this.report(projectRoot);
+			default:
+				console.error(picocolors.default.red(`Unknown evals action "${action}". Use: verify | report`));
+				process.exit(1);
+		}
+	}
+	async verify(runId, projectRoot) {
+		const runIds = runId ? [runId] : listEvalRuns(projectRoot);
+		if (runIds.length === 0) {
+			console.log(picocolors.default.yellow("No eval runs found under benchmarks/evals/runs/. Run the `evals-run` workflow first (see docs/EVALS.md)."));
+			return;
+		}
+		let anyFailed = false;
+		for (const id of runIds) {
+			const outcome = verifyEvalRun(projectRoot, id);
+			if (outcome.ok) console.log(picocolors.default.green(`✅ ${id}: verified`));
+			else {
+				anyFailed = true;
+				console.log(picocolors.default.red(`❌ ${id}: ${outcome.reason}`));
+				for (const d of outcome.diffs || []) console.log(picocolors.default.red(`   - ${d}`));
+			}
+		}
+		if (anyFailed) process.exit(1);
+	}
+	async report(projectRoot) {
+		const report = readEvalsReport(projectRoot);
+		if (!report) {
+			console.log(picocolors.default.yellow("No evals-report.md found at the project root yet. Run the `evals-run` workflow (see docs/EVALS.md), then `pnpm evals:report`."));
+			return;
+		}
+		console.log(report);
+	}
+};
+//#endregion
 //#region src/services/FeedbackService.ts
 /**
 * Service to handle automated feedback reporting via Proxy Backend.
@@ -342,6 +565,7 @@ var Framework = /* @__PURE__ */ function(Framework) {
 	Framework["Android"] = "android";
 	Framework["iOS"] = "ios";
 	Framework["Laravel"] = "laravel";
+	Framework["Python"] = "python";
 	return Framework;
 }({});
 //#endregion
@@ -672,7 +896,8 @@ var BACKEND_FRAMEWORKS = [
 	Framework.NestJS,
 	Framework.Golang,
 	Framework.SpringBoot,
-	Framework.Laravel
+	Framework.Laravel,
+	Framework.Python
 ];
 var FRONTEND_FRAMEWORKS = [
 	Framework.React,
@@ -744,8 +969,18 @@ var DEFAULT_WORKFLOWS = [
 	"implement-feature",
 	"verify-work",
 	"verify-bug",
-	"security-test"
+	"security-test",
+	"uat-signoff",
+	"incident-hotfix"
 ];
+/**
+* Workflows that must never be synced to a consumer project, regardless of
+* `.skillsrc` (even `workflows: true`). These depend on agent-skills-standard's
+* own repo-root tooling (e.g. `scripts/evals/*` and its `pnpm evals:*` scripts,
+* `benchmarks/evals/`) which is never distributed to consumers — the workflow
+* would be broken/non-functional outside this monorepo.
+*/
+var INTERNAL_ONLY_WORKFLOWS = ["evals-run"];
 var getAgentDefinition = (id) => {
 	switch (id) {
 		case Agent.Cursor: return {
@@ -872,8 +1107,8 @@ var getAgentDefinition = (id) => {
 			ruleExtension: ".md",
 			frontmatterStyle: "cursor",
 			detectionFiles: [".windsurf"],
-			workflowFormat: "none",
-			workflowPath: "",
+			workflowFormat: "native",
+			workflowPath: ".windsurf/workflows",
 			hookScriptPath: ".windsurf/hooks/preedit-skill-loader.js",
 			hookConfigPath: ".windsurf/hooks.json"
 		};
@@ -1007,6 +1242,20 @@ var getFrameworkDefinition = (id) => {
 				javascript: ["resources/js", "vite.config.js"]
 			}
 		};
+		case Framework.Python: return {
+			id,
+			name: "Python",
+			languages: ["python"],
+			detectionFiles: [
+				"pyproject.toml",
+				"requirements.txt",
+				"setup.py",
+				"setup.cfg",
+				"Pipfile",
+				"poetry.lock",
+				"uv.lock"
+			]
+		};
 	}
 };
 var SUPPORTED_AGENTS = Object.values(Agent).map(getAgentDefinition);
@@ -3819,7 +4068,7 @@ var SkillSyncService = class {
 };
 //#endregion
 //#region src/services/utils/WorkflowTransformer.ts
-var WORKFLOW_ARGUMENTS = "Optional args: slug=<feature>, ticket=<id/url>, mode=interactive|autonomous|channel, channel=<id>, auto_continue=true|false.";
+var WORKFLOW_ARGUMENTS = "Optional args: slug=<feature>, ticket=<id/url>, mode=interactive|autonomous|channel, channel=<id>, auto_continue=true|false, profile=business|hybrid|technical.";
 /**
 * Transforms workflow markdown into each agent's native user-invoked command format.
 *
@@ -3846,11 +4095,11 @@ var WorkflowTransformer = class {
 			rawContent: source.content
 		};
 	}
-	static transform(source, format, workflowSourcePath = ".agents/workflows") {
+	static transform(source, format) {
 		const parsed = this.parse(source);
-		return this.transformParsed(parsed, format, workflowSourcePath);
+		return this.transformParsed(parsed, format);
 	}
-	static transformParsed(parsed, format, workflowSourcePath = ".agents/workflows") {
+	static transformParsed(parsed, format) {
 		if (format === "none") return null;
 		const { description, body } = parsed;
 		const baseName = parsed.key;
@@ -3865,7 +4114,7 @@ var WorkflowTransformer = class {
 			};
 			case "toml": return {
 				name: `${baseName}.toml`,
-				content: this.toGeminiCommand(baseName, description, workflowSourcePath)
+				content: this.toGeminiCommand(description, body)
 			};
 			case "prompt": return {
 				name: `${baseName}.prompt.md`,
@@ -3913,17 +4162,18 @@ ${body}`;
 	/**
 	* Gemini CLI TOML command format.
 	* Lives at .gemini/commands/<name>.toml
-	* References the workflow source file via prompt.
+	* Inlines the workflow body so the command is self-contained even when
+	* .agents/workflows/ is not also synced to this runtime.
 	* User invokes via /<name> [arguments]
 	*/
-	static toGeminiCommand(name, description, workflowSourcePath) {
+	static toGeminiCommand(description, body) {
 		return `description = "${description.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"
 prompt = """
-Please execute the workflow defined in \`${workflowSourcePath}/${name}.md\` for: {{args}}
+Execute this workflow for: {{args}}
 
 ${WORKFLOW_ARGUMENTS}
 
-Follow the exact steps in the workflow file.
+${body.replace(/"""/g, "\\\"\\\"\\\"")}
 """
 `;
 	}
@@ -3989,7 +4239,7 @@ var WorkflowSyncService = class {
 		const ref = (await this.githubService.getRepoInfo(owner, repo))?.default_branch || "main";
 		const treeData = await this.githubService.getRepoTree(owner, repo, ref);
 		if (!treeData) return false;
-		const availableWorkflows = treeData.tree.filter((f) => this.isWorkflowMarkdownPath(f.path)).map((f) => this.workflowNameFromPath(f.path));
+		const availableWorkflows = treeData.tree.filter((f) => this.isWorkflowMarkdownPath(f.path)).map((f) => this.workflowNameFromPath(f.path)).filter((wf) => !INTERNAL_ONLY_WORKFLOWS.includes(wf));
 		if (availableWorkflows.length === 0) return false;
 		let changed = false;
 		if (Array.isArray(config.workflows)) {
@@ -4028,6 +4278,7 @@ var WorkflowSyncService = class {
 		}
 		const workflowFiles = treeData.tree.filter((f) => {
 			if (!this.isWorkflowMarkdownPath(f.path)) return false;
+			if (INTERNAL_ONLY_WORKFLOWS.includes(this.workflowNameFromPath(f.path))) return false;
 			if (typeof config.workflows === "boolean") return config.workflows;
 			if (Array.isArray(config.workflows)) return config.workflows.includes(this.workflowNameFromPath(f.path));
 			return false;
@@ -4070,8 +4321,6 @@ var WorkflowSyncService = class {
 			if (!agentDef || agentDef.workflowFormat === "none") continue;
 			const workflowDir = path.default.join(process.cwd(), agentDef.workflowPath);
 			await fs_extra.default.ensureDir(workflowDir);
-			const sourceWorkflowDir = path.default.join(process.cwd(), ".agents/workflows");
-			const workflowSourceRelative = path.default.relative(workflowDir, sourceWorkflowDir);
 			let written = 0;
 			for (const wf of workflows) {
 				if (wf.skill !== "workflows") continue;
@@ -4080,7 +4329,7 @@ var WorkflowSyncService = class {
 						name: fileItem.name,
 						content: fileItem.content
 					});
-					const transformed = WorkflowTransformer.transformParsed(parsed, agentDef.workflowFormat, workflowSourceRelative);
+					const transformed = WorkflowTransformer.transformParsed(parsed, agentDef.workflowFormat);
 					if (!transformed) continue;
 					let targetFilePath;
 					if (agentDef.workflowFormat === "skill") {
@@ -4361,25 +4610,35 @@ var MarkdownUtils = class {
 	* @param rootDir Project root directory
 	* @param targets Array of target file names
 	* @param indexContent The markdown content to inject
+	* @returns Array of target files that were successfully updated/created
 	*/
 	static async injectIndex(rootDir, targets, indexContent) {
+		const updated = [];
 		for (const target of targets) {
 			const targetPath = path.default.join(rootDir, target);
 			let content = "";
+			const markerStart = "<!-- SKILLS_INDEX_START -->";
+			const markerEnd = "<!-- SKILLS_INDEX_END -->";
 			if (await fs_extra.default.pathExists(targetPath)) {
 				content = await fs_extra.default.readFile(targetPath, "utf8");
-				const markerStart = "<!-- SKILLS_INDEX_START -->";
-				const markerEnd = "<!-- SKILLS_INDEX_END -->";
 				const startIndex = content.indexOf(markerStart);
 				const endIndex = content.indexOf(markerEnd);
 				if (startIndex !== -1 && endIndex !== -1 && startIndex < endIndex) content = `${content.substring(0, startIndex + 27)}\n${indexContent}\n${content.substring(endIndex)}`;
-				else if (startIndex !== -1 || endIndex !== -1) {
-					content = content.replace(markerStart, "").replace(markerEnd, "");
-					content = content.trimEnd() + `\n\n${markerStart}\n${indexContent}\n${markerEnd}\n`;
-				} else content = content.trimEnd() + `\n\n${markerStart}\n${indexContent}\n${markerEnd}\n`;
-			} else content = `<!-- SKILLS_INDEX_START -->\n${indexContent}\n<!-- SKILLS_INDEX_END -->\n`;
+				else continue;
+			} else content = [
+				"# Project Context for AI Agents",
+				"",
+				"This file provides context and instructions for AI agents working in this repository.",
+				"",
+				markerStart,
+				indexContent,
+				markerEnd,
+				""
+			].join("\n");
 			await fs_extra.default.outputFile(targetPath, content);
+			updated.push(target);
 		}
+		return updated;
 	}
 };
 //#endregion
@@ -4475,13 +4734,11 @@ var SyncService = class {
 			if (Object.keys(categoryIndices).length > 0) console.log(picocolors.default.green(`  ✅ Generated _INDEX.md for ${Object.keys(categoryIndices).length} categories.`));
 			const mcpEnabled = config.mcp?.enabled === true;
 			const routerIndex = await generator.assembleRouterIndex(baseDir, allowedCategories, mcpEnabled);
-			await MarkdownUtils.injectIndex(process.cwd(), ["AGENTS.md"], routerIndex);
-			console.log(picocolors.default.green("  ✅ AGENTS.md router index updated."));
+			if ((await MarkdownUtils.injectIndex(process.cwd(), ["AGENTS.md"], routerIndex)).length > 0) console.log(picocolors.default.green("  ✅ AGENTS.md router index updated."));
+			else console.log(picocolors.default.yellow("  ⚠️  Skipped AGENTS.md update: index markers <!-- SKILLS_INDEX_START --> … <!-- SKILLS_INDEX_END --> are missing or out of order. Opt-in by adding these markers to your file."));
 			const serverDir = path.default.join(process.cwd(), "server");
-			if (await fs_extra.default.pathExists(serverDir)) {
-				await MarkdownUtils.injectIndex(serverDir, ["AGENTS.md"], routerIndex);
-				console.log(picocolors.default.green("  ✅ server/AGENTS.md router index updated."));
-			}
+			if (await fs_extra.default.pathExists(serverDir)) if ((await MarkdownUtils.injectIndex(serverDir, ["AGENTS.md"], routerIndex)).length > 0) console.log(picocolors.default.green("  ✅ server/AGENTS.md router index updated."));
+			else console.log(picocolors.default.yellow("  ⚠️  Skipped server/AGENTS.md update: index markers <!-- SKILLS_INDEX_START --> … <!-- SKILLS_INDEX_END --> are missing or out of order in server/AGENTS.md. Opt-in via markers."));
 			await new AgentBridgeService().bridge(process.cwd(), agents);
 		} catch (error) {
 			console.log(picocolors.default.yellow(`  ⚠️  Failed to update index: ${error}`));
@@ -5048,7 +5305,7 @@ var FrontmatterRule = class {
 			if (descMatch && descMatch[1].length > 1024) {
 				result.errors.push(`Description too long (${descMatch[1].length} chars > 1024 limit)`);
 				result.passed = false;
-			}
+			} else if (descMatch && descMatch[1].length > 300) result.warnings.push(`Description is ${descMatch[1].length} chars (> 300); trim for _INDEX.md readability`);
 		}
 		return result;
 	}
@@ -5088,16 +5345,82 @@ var InstructionsStyleRule = class {
 	}
 };
 /**
-* Ensures the mandatory priority section is present.
+* Canonical priority label per tier, enforced by PriorityRule.
+*/
+var CANONICAL_PRIORITY_LABELS = {
+	P0: "CRITICAL",
+	P1: "HIGH",
+	P2: "MEDIUM",
+	P3: "LOW"
+};
+/**
+* Ensures the mandatory priority section is present and, once `labelSeverity`
+* is 'error', that its label matches the canonical vocabulary.
 */
 var PriorityRule = class {
 	name = "Priority Section";
+	constructor(labelSeverity = "warning") {
+		this.labelSeverity = labelSeverity;
+	}
 	async validate(content) {
-		if (!content.includes("## **Priority:")) return {
+		const result = {
+			passed: true,
+			errors: [],
+			warnings: []
+		};
+		const match = content.match(/^## \*\*Priority:\s*(P\d)(?:\s*\(([^)]*)\))?([^\n]*)\*\*/m);
+		if (!match) return {
 			passed: false,
 			errors: ["Missing priority section"],
 			warnings: []
 		};
+		const [, tier, label, trailing] = match;
+		const canonicalLabel = CANONICAL_PRIORITY_LABELS[tier];
+		if (!canonicalLabel) {
+			result.errors.push(`Unknown priority tier "${tier}"`);
+			result.passed = false;
+			return result;
+		}
+		if (!(label === canonicalLabel && !trailing?.trim())) {
+			const message = `Priority label must be "${tier} (${canonicalLabel})"`;
+			if (this.labelSeverity === "error") {
+				result.errors.push(message);
+				result.passed = false;
+			} else result.warnings.push(message);
+		}
+		return result;
+	}
+};
+/**
+* Ensures every skill is routable: at least one file glob or keyword trigger.
+*/
+var TriggersRule = class {
+	name = "Triggers";
+	async validate(content) {
+		const frontmatterMatch = content.match(/^---\n([\s\S]*?)\n---\n/);
+		if (!frontmatterMatch) return {
+			passed: true,
+			errors: [],
+			warnings: []
+		};
+		let parsed;
+		try {
+			parsed = js_yaml.default.load(frontmatterMatch[1]);
+		} catch {
+			return {
+				passed: false,
+				errors: ["Invalid YAML frontmatter"],
+				warnings: []
+			};
+		}
+		const triggers = parsed?.metadata?.triggers;
+		const files = Array.isArray(triggers?.files) ? triggers.files : [];
+		const keywords = Array.isArray(triggers?.keywords) ? triggers.keywords : [];
+		if (files.length === 0 && keywords.length === 0) return {
+			passed: false,
+			errors: ["Skill is unroutable: metadata.triggers must define at least one files glob or keywords entry"],
+			warnings: []
+		};
 		return {
 			passed: true,
 			errors: [],
@@ -5149,7 +5472,8 @@ var SkillValidator = class {
 		new SizeRule(),
 		new FrontmatterRule(),
 		new InstructionsStyleRule(),
-		new PriorityRule(),
+		new PriorityRule("error"),
+		new TriggersRule(),
 		new DirectoryStructureRule()
 	];
 	/**
@@ -5305,6 +5629,9 @@ program.command("mcp <action> [scope]").description("Manage the optional MCP ser
 program.command("hooks <action>").description("Manage the PreToolUse skill-loader hook. Actions: status | install | uninstall").action(async (action) => {
 	await new HooksCommand().run(action);
 });
+program.command("evals <action>").description("Verify or display live skill-eval runs. Actions: verify | report").option("--run <runId>", "For verify: check a single run id instead of all committed runs").action(async (action, opts) => {
+	await new EvalsCommand().run(action, opts);
+});
 program.parse();
 //#endregion