ai-agent-skills 1.2.0 → 1.2.2

package/README.md

@@ -6,7 +6,7 @@
 
 <p align="center">
   <strong>Homebrew for AI agent skills.</strong><br>
-  One command. Ten agents. Skills that follow you.
+  Universal Skills installer for any agent that follows the open standard spec 
 </p>
 
 <p align="center">
@@ -179,10 +179,8 @@ cp -r Ai-Agent-Skills/skills/pdf ~/.claude/skills/
 
 ## Create Your Own
 
-Two options:
 
-1. **Generate in 30 seconds**: [skillcreator.ai/build](https://skillcreator.ai/build)
-2. **Build manually**: Follow the [Agent Skills spec](https://agentskills.io/specification)
+1. **Build manually**: Follow the [Agent Skills spec](https://agentskills.io/specification)
 
 ## What Are Agent Skills?
 
@@ -209,19 +207,17 @@ We review all contributions for quality and spec compliance.
 
 ## Links
 
-- [Awesome Agent Skills](https://github.com/skillcreatorai/Awesome-Agent-Skills) - Curated list of 50+ skills
+
 - [Agent Skills Spec](https://agentskills.io) - Official format documentation
-- [Browse Skills](https://skillcreator.ai/discover) - Visual skill gallery with one-click install
-- [Create Skills](https://skillcreator.ai/build) - Generate skills from plain English
+- [Browse Skills](https://skillcreator.ai/explore) - Visual skill gallery with one-click install
+- [Create Skills](https://skillcreator.ai/build) - Generate skills (waitlist) 
 - [Anthropic Skills](https://github.com/anthropics/skills) - Official example skills
 
 ## See Also
 
-**[openskills](https://github.com/numman-ali/openskills)** - Universal skills loader that inspired parts of this project. openskills focuses on flexibility: install from any GitHub repo, sync to AGENTS.md, works with any agent via CLI calls. Great if you need maximum customization.
-
-**We took a different approach**: Homebrew-style simplicity. No global install, no sync step, no AGENTS.md. Just `npx ai-agent-skills install pdf` and it lands in the right folder for your agent. Curated catalog, native paths, zero config.
+**[openskills](https://github.com/numman-ali/openskills)** - another universal skills loader that inspired parts of this project (created pre the open agent skills standard) & Requires global install, AGENTS.md sync, and Bash calls. Great for flexibility.
 
-Different tools for different needs.
+**ai-agent-skills** - Just `npx`, installs to native agent folders. Homebrew for skills.
 
 ---
 

package/cli.js

@@ -202,7 +202,10 @@ function parseArgs(args) {
 
 // ============ SAFE FILE OPERATIONS ============
 
-function copyDir(src, dest, currentSize = { total: 0 }) {
+function copyDir(src, dest, currentSize = { total: 0 }, rootSrc = null) {
+  // Track root source to prevent path escape attacks
+  if (rootSrc === null) rootSrc = src;
+
   try {
     if (fs.existsSync(dest)) {
       fs.rmSync(dest, { recursive: true });
@@ -211,13 +214,32 @@ function copyDir(src, dest, currentSize = { total: 0 }) {
 
     const entries = fs.readdirSync(src, { withFileTypes: true });
 
+    // Files/folders to skip during copy
+    const skipList = ['.git', '.github', 'node_modules', '.DS_Store'];
+
     for (const entry of entries) {
+      // Skip unnecessary files/folders
+      if (skipList.includes(entry.name)) continue;
+
+      // Skip symlinks to prevent path escape attacks
+      if (entry.isSymbolicLink()) {
+        warn(`Skipping symlink: ${entry.name}`);
+        continue;
+      }
+
       const srcPath = path.join(src, entry.name);
       const destPath = path.join(dest, entry.name);
 
+      // Verify resolved path stays within source directory (prevent path traversal)
+      const resolvedSrc = fs.realpathSync(srcPath);
+      if (!resolvedSrc.startsWith(fs.realpathSync(rootSrc))) {
+        warn(`Skipping file outside source directory: ${entry.name}`);
+        continue;
+      }
+
       if (entry.isDirectory()) {
-        copyDir(srcPath, destPath, currentSize);
-      } else {
+        copyDir(srcPath, destPath, currentSize, rootSrc);
+      } else if (entry.isFile()) {
         const stat = fs.statSync(srcPath);
         currentSize.total += stat.size;
 
@@ -227,6 +249,7 @@ function copyDir(src, dest, currentSize = { total: 0 }) {
 
         fs.copyFileSync(srcPath, destPath);
       }
+      // Skip any other special file types (sockets, devices, etc.)
     }
   } catch (e) {
     // Clean up partial install on failure
@@ -395,7 +418,6 @@ function getInstalledSkills(agent = 'claude') {
 function listInstalledSkills(agent = 'claude') {
   const installed = getInstalledSkills(agent);
   const destDir = AGENT_PATHS[agent] || AGENT_PATHS.claude;
-  const data = loadSkillsJson();
 
   if (installed.length === 0) {
     warn(`No skills installed for ${agent}`);
@@ -406,43 +428,12 @@ function listInstalledSkills(agent = 'claude') {
   log(`\n${colors.bold}Installed Skills${colors.reset} (${installed.length} for ${agent})\n`);
   log(`${colors.dim}Location: ${destDir}${colors.reset}\n`);
 
-  // Check for updates
-  let updatesAvailable = 0;
-
   installed.forEach(name => {
-    const skill = data.skills.find(s => s.name === name);
-    const hasUpdate = skill && skill.lastUpdated && isUpdateAvailable(name, agent, skill.lastUpdated);
-
-    if (hasUpdate) {
-      updatesAvailable++;
-      log(`  ${colors.green}${name}${colors.reset} ${colors.yellow}(update available)${colors.reset}`);
-    } else {
-      log(`  ${colors.green}${name}${colors.reset}`);
-    }
+    log(`  ${colors.green}${name}${colors.reset}`);
   });
 
-  if (updatesAvailable > 0) {
-    log(`\n${colors.yellow}${updatesAvailable} update(s) available.${colors.reset}`);
-    log(`${colors.dim}Run: npx ai-agent-skills update <name> --agent ${agent}${colors.reset}`);
-  }
-
-  log(`\n${colors.dim}Uninstall: npx ai-agent-skills uninstall <name> --agent ${agent}${colors.reset}`);
-}
-
-function isUpdateAvailable(skillName, agent, repoLastUpdated) {
-  // Simple check based on file modification time
-  const destDir = AGENT_PATHS[agent] || AGENT_PATHS.claude;
-  const skillPath = path.join(destDir, skillName, 'SKILL.md');
-
-  try {
-    if (!fs.existsSync(skillPath)) return false;
-    const stat = fs.statSync(skillPath);
-    const installedTime = stat.mtime.getTime();
-    const repoTime = new Date(repoLastUpdated).getTime();
-    return repoTime > installedTime;
-  } catch {
-    return false;
-  }
+  log(`\n${colors.dim}Update:    npx ai-agent-skills update <name> --agent ${agent}${colors.reset}`);
+  log(`${colors.dim}Uninstall: npx ai-agent-skills uninstall <name> --agent ${agent}${colors.reset}`);
 }
 
 function updateSkill(skillName, agent = 'claude', dryRun = false) {
@@ -768,11 +759,28 @@ async function browseSkills(agent = 'claude') {
 // ============ EXTERNAL INSTALL (GitHub/Local) ============
 
 function isGitHubUrl(source) {
-  return source.includes('/') && !source.startsWith('.') && !source.startsWith('/') && !source.startsWith('~');
+  // Must have owner/repo format, not start with path indicators
+  return source.includes('/') &&
+         !source.startsWith('./') &&
+         !source.startsWith('../') &&
+         !source.startsWith('/') &&
+         !source.startsWith('~') &&
+         !isWindowsPath(source);
+}
+
+function isWindowsPath(source) {
+  // Match Windows absolute paths like C:\, D:\, etc.
+  return /^[a-zA-Z]:[\\\/]/.test(source);
 }
 
 function isLocalPath(source) {
-  return source.startsWith('.') || source.startsWith('/') || source.startsWith('~');
+  // Explicit local paths: ./ or / or ~/ or Windows paths like C:\
+  // Also accept ../ as local path (will be resolved)
+  return source.startsWith('./') ||
+         source.startsWith('../') ||
+         source.startsWith('/') ||
+         source.startsWith('~/') ||
+         isWindowsPath(source);
 }
 
 function expandPath(p) {
@@ -782,8 +790,23 @@ function expandPath(p) {
   return path.resolve(p);
 }
 
+// Validate GitHub owner/repo names (alphanumeric, hyphens, underscores, dots)
+function validateGitHubName(name, type = 'name') {
+  if (!name || typeof name !== 'string') {
+    throw new Error(`Invalid GitHub ${type}`);
+  }
+  // GitHub allows: alphanumeric, hyphens, underscores, dots (no leading/trailing dots for repos)
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(name)) {
+    throw new Error(`Invalid GitHub ${type}: "${name}" contains invalid characters`);
+  }
+  if (name.length > 100) {
+    throw new Error(`GitHub ${type} too long: ${name.length} > 100 characters`);
+  }
+  return true;
+}
+
 async function installFromGitHub(source, agent = 'claude', dryRun = false) {
-  const { execSync } = require('child_process');
+  const { execFileSync } = require('child_process');
 
   // Parse owner/repo format
   const parts = source.split('/');
@@ -796,6 +819,18 @@ async function installFromGitHub(source, agent = 'claude', dryRun = false) {
   const repo = parts[1];
   const skillName = parts[2]; // Optional specific skill
 
+  // Validate owner and repo to prevent injection attacks
+  try {
+    validateGitHubName(owner, 'owner');
+    validateGitHubName(repo, 'repository');
+    if (skillName) {
+      validateSkillName(skillName);
+    }
+  } catch (e) {
+    error(e.message);
+    return false;
+  }
+
   const repoUrl = `https://github.com/${owner}/${repo}.git`;
   const tempDir = path.join(os.tmpdir(), `ai-skills-${Date.now()}`);
 
@@ -809,13 +844,17 @@ async function installFromGitHub(source, agent = 'claude', dryRun = false) {
 
   try {
     info(`Cloning ${owner}/${repo}...`);
-    execSync(`git clone --depth 1 ${repoUrl} ${tempDir}`, { stdio: 'pipe' });
+    // Use execFileSync with args array to prevent shell injection
+    execFileSync('git', ['clone', '--depth', '1', repoUrl, tempDir], { stdio: 'pipe' });
 
     // Find skills in the cloned repo
     const skillsDir = fs.existsSync(path.join(tempDir, 'skills'))
       ? path.join(tempDir, 'skills')
       : tempDir;
 
+    // Check if repo root IS a skill (has SKILL.md at root)
+    const isRootSkill = fs.existsSync(path.join(tempDir, 'SKILL.md'));
+
     if (skillName) {
       // Install specific skill
       const skillPath = path.join(skillsDir, skillName);
@@ -835,6 +874,29 @@ async function installFromGitHub(source, agent = 'claude', dryRun = false) {
       copyDir(skillPath, destPath);
       success(`\nInstalled: ${skillName} from ${owner}/${repo}`);
       info(`Location: ${destPath}`);
+    } else if (isRootSkill) {
+      // Repo itself is a single skill
+      // Sanitize repo name to valid skill name (lowercase, alphanumeric + hyphens)
+      const skillName = repo.toLowerCase().replace(/[^a-z0-9-]/g, '-').replace(/-+/g, '-').replace(/^-|-$/g, '');
+
+      try {
+        validateSkillName(skillName);
+      } catch (e) {
+        error(`Cannot install: repo name "${repo}" cannot be converted to valid skill name`);
+        fs.rmSync(tempDir, { recursive: true });
+        return false;
+      }
+
+      const destDir = AGENT_PATHS[agent] || AGENT_PATHS.claude;
+      const destPath = path.join(destDir, skillName);
+
+      if (!fs.existsSync(destDir)) {
+        fs.mkdirSync(destDir, { recursive: true });
+      }
+
+      copyDir(tempDir, destPath);
+      success(`\nInstalled: ${skillName} from ${owner}/${repo}`);
+      info(`Location: ${destPath}`);
     } else {
       // Install all skills from repo
       const entries = fs.readdirSync(skillsDir, { withFileTypes: true });
@@ -970,6 +1032,7 @@ ${colors.bold}Commands:${colors.reset}
   ${colors.green}search <query>${colors.reset}                   Search skills by name, description, or tags
   ${colors.green}info <name>${colors.reset}                      Show skill details
   ${colors.green}config${colors.reset}                           Show/edit configuration
+  ${colors.green}version${colors.reset}                          Show version number
   ${colors.green}help${colors.reset}                             Show this help
 
 ${colors.bold}Options:${colors.reset}
@@ -978,6 +1041,7 @@ ${colors.bold}Options:${colors.reset}
   ${colors.cyan}--dry-run, -n${colors.reset}    Preview changes without applying
   ${colors.cyan}--category <c>${colors.reset}   Filter by category
   ${colors.cyan}--all${colors.reset}            Apply to all (with update)
+  ${colors.cyan}--version, -v${colors.reset}    Show version number
 
 ${colors.bold}Agents:${colors.reset}
   ${colors.cyan}claude${colors.reset}   (default) ~/.claude/skills/
@@ -1202,6 +1266,13 @@ switch (command || 'help') {
     showHelp();
     break;
 
+  case 'version':
+  case '--version':
+  case '-v':
+    const pkg = require('./package.json');
+    log(`ai-agent-skills v${pkg.version}`);
+    break;
+
   default:
     // If command looks like a skill name, try to install it
     if (getAvailableSkills().includes(command)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-agent-skills",
-  "version": "1.2.0",
+  "version": "1.2.2",
   "description": "Install curated AI agent skills with one command. Works with Claude Code, Cursor, Amp, VS Code, and all Agent Skills compatible tools.",
   "main": "cli.js",
   "bin": {
@@ -8,7 +8,7 @@
     "skills": "./cli.js"
   },
   "engines": {
-    "node": ">=14.0.0"
+    "node": ">=14.14.0"
   },
   "scripts": {
     "test": "node test.js",

package/skills.json

@@ -1,6 +1,6 @@
 {
-  "version": "1.2.0",
-  "updated": "2025-12-20T00:00:00Z",
+  "version": "1.2.2",
+  "updated": "2025-12-25T00:00:00Z",
   "total": 39,
   "skills": [
     {
@@ -516,7 +516,7 @@
       "id": "development",
       "name": "Development",
       "description": "Coding and software development skills",
-      "count": 12
+      "count": 13
     },
     {
       "id": "document",
@@ -528,19 +528,19 @@
       "id": "creative",
       "name": "Creative",
       "description": "Design and creative skills",
-      "count": 2
+      "count": 6
     },
     {
       "id": "business",
       "name": "Business",
       "description": "Business and communication skills",
-      "count": 2
+      "count": 5
     },
     {
       "id": "productivity",
       "name": "Productivity",
       "description": "Productivity and workflow skills",
-      "count": 3
+      "count": 11
     }
   ]
 }

package/.github/FUNDING.yml

@@ -1,2 +0,0 @@
-github: skillcreatorai
-custom: ["https://skillcreator.ai"]

package/.github/ISSUE_TEMPLATE/bug-report.yml

@@ -1,41 +0,0 @@
-name: Bug Report
-description: Report an issue with a skill
-title: "[Bug] "
-labels: ["bug"]
-body:
-  - type: input
-    id: skill
-    attributes:
-      label: Skill Name
-      description: Which skill has the issue?
-      placeholder: e.g., frontend-design
-    validations:
-      required: true
-
-  - type: textarea
-    id: description
-    attributes:
-      label: What happened?
-      description: Describe the bug
-    validations:
-      required: true
-
-  - type: textarea
-    id: expected
-    attributes:
-      label: Expected behavior
-      description: What should have happened?
-
-  - type: input
-    id: agent
-    attributes:
-      label: Agent
-      description: Which AI agent are you using?
-      placeholder: e.g., Claude Code, Cursor, Amp
-
-  - type: textarea
-    id: logs
-    attributes:
-      label: Relevant logs
-      description: Any error messages or output
-      render: shell

package/.github/ISSUE_TEMPLATE/config.yml

@@ -1,11 +0,0 @@
-blank_issues_enabled: false
-contact_links:
-  - name: Browse Skills
-    url: https://skillcreator.ai/discover
-    about: Find and install skills from our gallery
-  - name: Create a Skill
-    url: https://skillcreator.ai/build
-    about: Generate a custom skill in 30 seconds
-  - name: Follow Updates
-    url: https://x.com/skillcreatorai
-    about: Get notified about new skills and features

package/.github/ISSUE_TEMPLATE/skill-request.yml

@@ -1,54 +0,0 @@
-name: Skill Request
-description: Request a new skill to be added
-title: "[Skill Request] "
-labels: ["skill-request"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Thanks for suggesting a skill! We review all requests.
-
-  - type: input
-    id: skill-name
-    attributes:
-      label: Skill Name
-      description: What should this skill be called?
-      placeholder: e.g., slack-automation
-    validations:
-      required: true
-
-  - type: textarea
-    id: description
-    attributes:
-      label: What should this skill do?
-      description: Describe the use case and functionality
-      placeholder: |
-        I want a skill that can...
-
-        Use cases:
-        - ...
-        - ...
-    validations:
-      required: true
-
-  - type: dropdown
-    id: category
-    attributes:
-      label: Category
-      options:
-        - Development
-        - Documents
-        - Creative
-        - Productivity
-        - Other
-    validations:
-      required: true
-
-  - type: textarea
-    id: examples
-    attributes:
-      label: Example prompts
-      description: How would you use this skill?
-      placeholder: |
-        "Create a Slack message to #engineering about the deployment"
-        "Summarize this channel's messages from today"

package/.github/PULL_REQUEST_TEMPLATE.md

@@ -1,23 +0,0 @@
-## Summary
-
-Brief description of the changes.
-
-## Type
-
-- [ ] New skill
-- [ ] Skill update/fix
-- [ ] Documentation
-- [ ] Other
-
-## Checklist
-
-- [ ] SKILL.md has valid YAML frontmatter with `name` and `description`
-- [ ] Skill name is lowercase with hyphens only
-- [ ] Added entry to `skills.json`
-- [ ] Tested the skill works as expected
-
-## Skill Details (if adding new skill)
-
-**Name:**
-**Category:**
-**Description:**

package/.github/workflows/validate.yml

@@ -1,188 +0,0 @@
-name: Validate Skills
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-
-jobs:
-  validate:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '18'
-
-      - name: Validate skills.json schema
-        run: |
-          echo "Validating skills.json..."
-          node -e "
-            const fs = require('fs');
-            const data = JSON.parse(fs.readFileSync('skills.json', 'utf8'));
-
-            // Check structure
-            if (!Array.isArray(data.skills)) {
-              console.error('ERROR: skills must be an array');
-              process.exit(1);
-            }
-
-            const required = ['name', 'description', 'category', 'author', 'license'];
-            const validCategories = ['development', 'document', 'creative', 'business', 'productivity'];
-            const names = new Set();
-            let errors = 0;
-
-            data.skills.forEach((skill, i) => {
-              // Check required fields
-              required.forEach(field => {
-                if (!skill[field]) {
-                  console.error('ERROR: Skill ' + skill.name + ' missing ' + field);
-                  errors++;
-                }
-              });
-
-              // Check category
-              if (skill.category && !validCategories.includes(skill.category)) {
-                console.error('ERROR: Invalid category ' + skill.category + ' for ' + skill.name);
-                errors++;
-              }
-
-              // Check for duplicates
-              if (names.has(skill.name)) {
-                console.error('ERROR: Duplicate skill name: ' + skill.name);
-                errors++;
-              }
-              names.add(skill.name);
-
-              // Check name format
-              if (!/^[a-z0-9][a-z0-9-]*[a-z0-9]$|^[a-z0-9]$/.test(skill.name)) {
-                console.error('ERROR: Invalid skill name format: ' + skill.name);
-                errors++;
-              }
-
-              // Check description length
-              if (skill.description && skill.description.length < 10) {
-                console.error('WARNING: Short description for ' + skill.name);
-              }
-            });
-
-            if (errors > 0) {
-              console.error('Found ' + errors + ' errors');
-              process.exit(1);
-            }
-
-            console.log('✓ skills.json is valid (' + data.skills.length + ' skills)');
-          "
-
-      - name: Check skill folders match JSON
-        run: |
-          echo "Checking skill folders..."
-          node -e "
-            const fs = require('fs');
-            const path = require('path');
-
-            const data = JSON.parse(fs.readFileSync('skills.json', 'utf8'));
-            const jsonSkills = new Set(data.skills.map(s => s.name));
-
-            const skillsDir = 'skills';
-            const folders = fs.readdirSync(skillsDir).filter(f =>
-              fs.statSync(path.join(skillsDir, f)).isDirectory()
-            );
-
-            let errors = 0;
-
-            // Check each folder has an entry in JSON
-            folders.forEach(folder => {
-              if (!jsonSkills.has(folder)) {
-                console.error('ERROR: Folder ' + folder + ' not in skills.json');
-                errors++;
-              }
-
-              // Check SKILL.md exists
-              const skillMd = path.join(skillsDir, folder, 'SKILL.md');
-              if (!fs.existsSync(skillMd)) {
-                console.error('ERROR: Missing SKILL.md in ' + folder);
-                errors++;
-              }
-            });
-
-            // Check each JSON entry has a folder
-            jsonSkills.forEach(name => {
-              if (!folders.includes(name)) {
-                console.error('ERROR: skills.json has ' + name + ' but folder missing');
-                errors++;
-              }
-            });
-
-            if (errors > 0) {
-              process.exit(1);
-            }
-
-            console.log('✓ All ' + folders.length + ' skill folders match skills.json');
-          "
-
-      - name: Validate SKILL.md frontmatter
-        run: |
-          echo "Validating frontmatter..."
-          node -e "
-            const fs = require('fs');
-            const path = require('path');
-
-            const skillsDir = 'skills';
-            const folders = fs.readdirSync(skillsDir).filter(f =>
-              fs.statSync(path.join(skillsDir, f)).isDirectory()
-            );
-
-            let errors = 0;
-
-            folders.forEach(folder => {
-              const skillMd = path.join(skillsDir, folder, 'SKILL.md');
-              if (!fs.existsSync(skillMd)) return;
-
-              const content = fs.readFileSync(skillMd, 'utf8');
-
-              // Check for frontmatter
-              if (!content.startsWith('---')) {
-                console.error('ERROR: ' + folder + '/SKILL.md missing frontmatter');
-                errors++;
-                return;
-              }
-
-              // Extract frontmatter
-              const endIndex = content.indexOf('---', 3);
-              if (endIndex === -1) {
-                console.error('ERROR: ' + folder + '/SKILL.md has unclosed frontmatter');
-                errors++;
-                return;
-              }
-
-              const frontmatter = content.slice(3, endIndex);
-
-              // Check for name field
-              if (!frontmatter.includes('name:')) {
-                console.error('ERROR: ' + folder + '/SKILL.md missing name in frontmatter');
-                errors++;
-              }
-
-              // Check for description field
-              if (!frontmatter.includes('description:')) {
-                console.error('ERROR: ' + folder + '/SKILL.md missing description in frontmatter');
-                errors++;
-              }
-            });
-
-            if (errors > 0) {
-              process.exit(1);
-            }
-
-            console.log('✓ All SKILL.md files have valid frontmatter');
-          "
-
-      - name: Run tests
-        run: node test.js
-
-      - name: Validate CLI loads
-        run: node cli.js list > /dev/null && echo "✓ CLI loads successfully"

package/CHANGELOG.md

@@ -1,120 +0,0 @@
-# Changelog
-
-All notable changes to this project will be documented in this file.
-
-## [1.1.0] - 2024-12-20
-
-### Added
-- **Dry-run mode**: Preview installations with `--dry-run` flag
-- **Config file support**: `~/.agent-skills.json` for default settings
-- **Update notifications**: See available updates when listing installed skills
-- **Update all**: `update --all` to update all installed skills at once
-- **Category filter**: `list --category development` to filter skills
-- **Tag support**: Search now includes tags
-- **"Did you mean" suggestions**: Typo-tolerant skill name matching
-- **Config command**: `config --default-agent cursor` to set defaults
-- **Security validation**: Block path traversal attacks in skill names
-- **Size limit**: 50MB max skill size to prevent abuse
-- **Proper error handling**: Graceful failures with helpful messages
-- **Test suite**: `npm test` runs validation tests
-- **Enhanced CI**: Schema validation, duplicate detection, frontmatter checks
-
-### Changed
-- Bump to version 1.1.0 (semver: new features)
-- Node.js 14+ now required (was implicit, now explicit)
-- CLI shows skill size on install
-- Better help output with categories section
-
-### Fixed
-- JSON parsing errors now show helpful messages instead of crashing
-- File operation errors properly caught and reported
-- Partial installs cleaned up on failure
-
-### Security
-- Skill names validated against path traversal patterns (`../`, `\`)
-- Max file size enforced during copy operations
-
-## [1.0.8] - 2024-12-20
-
-### Added
-- `uninstall` command to remove installed skills
-- `update` command to update skills to latest version
-- `list --installed` flag to show installed skills per agent
-- Letta agent support (`--agent letta`)
-- Command aliases: `add`, `remove`, `rm`, `find`, `show`, `upgrade`
-
-### Fixed
-- Description truncation now only adds "..." when actually truncated
-
-## [1.0.7] - 2024-12-19
-
-### Added
-- Credits & Attribution section in README
-- npm downloads badge
-- Full skill listing in README (all 38 skills now documented)
-
-### Fixed
-- `--agent` flag parsing improvements
-- Codex agent support
-
-## [1.0.6] - 2024-12-18
-
-### Added
-- 15 new skills from ComposioHQ ecosystem:
-  - `artifacts-builder` - Interactive React/Tailwind components
-  - `changelog-generator` - Generate changelogs from git commits
-  - `competitive-ads-extractor` - Analyze competitor ads
-  - `content-research-writer` - Research and write with citations
-  - `developer-growth-analysis` - Track developer metrics
-  - `domain-name-brainstormer` - Generate domain name ideas
-  - `file-organizer` - Organize files and find duplicates
-  - `image-enhancer` - Improve image quality
-  - `invoice-organizer` - Organize invoices for tax prep
-  - `lead-research-assistant` - Identify and qualify leads
-  - `meeting-insights-analyzer` - Analyze meeting transcripts
-  - `raffle-winner-picker` - Select contest winners
-  - `slack-gif-creator` - Create animated GIFs for Slack
-  - `theme-factory` - Professional font and color themes
-  - `video-downloader` - Download videos from platforms
-- Cross-link to Awesome Agent Skills repository
-
-## [1.0.5] - 2024-12-17
-
-### Fixed
-- VS Code install message now correctly shows `.github/skills/`
-
-## [1.0.4] - 2024-12-17
-
-### Fixed
-- VS Code path corrected to `.github/skills/` (was `.vscode/`)
-
-## [1.0.3] - 2024-12-17
-
-### Added
-- `job-application` skill for cover letters and applications
-
-## [1.0.2] - 2024-12-17
-
-### Added
-- Multi-agent support with `--agent` flag
-- Support for Claude Code, Cursor, Amp, VS Code, Goose, OpenCode
-- Portable install option with `--agent project`
-
-## [1.0.1] - 2024-12-16
-
-### Added
-- `qa-regression` skill for automated Playwright testing
-- `jira-issues` skill for Jira integration
-- GitHub issue templates and PR templates
-- CI validation workflow
-- Funding configuration
-
-## [1.0.0] - 2024-12-16
-
-### Added
-- Initial release with 20 curated skills
-- NPX installer (`npx ai-agent-skills install <name>`)
-- Skills from Anthropic's official examples
-- Core document skills: `pdf`, `xlsx`, `docx`, `pptx`
-- Development skills: `frontend-design`, `mcp-builder`, `skill-creator`
-- Creative skills: `canvas-design`, `algorithmic-art`

package/CONTRIBUTING.md

@@ -1,84 +0,0 @@
-# Contributing to Agent Skills
-
-We welcome contributions to the universal skill repository.
-
-## Adding a Skill
-
-### Requirements
-
-1. Your skill must follow the [Agent Skills specification](https://agentskills.io/specification)
-2. The `SKILL.md` file must include valid YAML frontmatter with `name` and `description`
-3. The skill name must be lowercase with hyphens only (e.g., `my-skill`)
-4. The skill must actually work and provide value
-
-### Process
-
-1. Fork this repository
-2. Create your skill folder: `skills/<skill-name>/`
-3. Add your `SKILL.md` file with proper frontmatter:
-
-```yaml
----
-name: my-skill
-description: What this skill does and when to use it.
-license: MIT
----
-
-# My Skill
-
-Instructions for the agent...
-```
-
-4. Add an entry to `skills.json`:
-
-```json
-{
-  "name": "my-skill",
-  "description": "What this skill does and when to use it.",
-  "category": "development",
-  "author": "your-username",
-  "source": "your-username/your-repo",
-  "license": "MIT",
-  "path": "skills/my-skill",
-  "stars": 0,
-  "downloads": 0,
-  "featured": false,
-  "verified": false
-}
-```
-
-5. Submit a pull request
-
-### Categories
-
-Use one of these categories:
-
-- `development` - Coding, debugging, testing, tooling
-- `document` - PDF, Word, Excel, presentations
-- `creative` - Art, design, visuals
-- `business` - Communication, research, productivity
-- `data` - Analytics, visualization, databases
-- `content` - Writing, research, media
-- `lifestyle` - Personal productivity
-
-### Review Process
-
-We review all submissions for:
-
-- **Spec compliance**: Valid SKILL.md format
-- **Quality**: Clear instructions, actually useful
-- **Safety**: No malicious or harmful content
-- **Uniqueness**: Not duplicating existing skills
-
-## Updating Existing Skills
-
-If you find a bug or want to improve an existing skill:
-
-1. Fork the repo
-2. Make your changes
-3. Test that the skill still works
-4. Submit a PR with a clear description of the change
-
-## Questions?
-
-Open an issue or visit [skillcreator.ai](https://skillcreator.ai).

package/test.js

@@ -1,180 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * Test suite for ai-agent-skills CLI
- * Run with: node test.js
- */
-
-const fs = require('fs');
-const path = require('path');
-const { execSync } = require('child_process');
-
-const colors = {
-  reset: '\x1b[0m',
-  green: '\x1b[32m',
-  red: '\x1b[31m',
-  yellow: '\x1b[33m',
-  dim: '\x1b[2m'
-};
-
-let passed = 0;
-let failed = 0;
-
-function test(name, fn) {
-  try {
-    fn();
-    console.log(`${colors.green}✓${colors.reset} ${name}`);
-    passed++;
-  } catch (e) {
-    console.log(`${colors.red}✗${colors.reset} ${name}`);
-    console.log(`  ${colors.dim}${e.message}${colors.reset}`);
-    failed++;
-  }
-}
-
-function assert(condition, message) {
-  if (!condition) throw new Error(message || 'Assertion failed');
-}
-
-function assertEqual(a, b, message) {
-  if (a !== b) throw new Error(message || `Expected ${b}, got ${a}`);
-}
-
-function assertContains(str, substr, message) {
-  if (!str.includes(substr)) throw new Error(message || `Expected "${str}" to contain "${substr}"`);
-}
-
-function run(cmd) {
-  try {
-    return execSync(`node cli.js ${cmd}`, { encoding: 'utf8', cwd: __dirname });
-  } catch (e) {
-    return e.stdout || e.message;
-  }
-}
-
-console.log('\n🧪 Running tests...\n');
-
-// ============ SKILLS.JSON TESTS ============
-
-test('skills.json exists and is valid JSON', () => {
-  const content = fs.readFileSync(path.join(__dirname, 'skills.json'), 'utf8');
-  const data = JSON.parse(content);
-  assert(Array.isArray(data.skills), 'skills should be an array');
-});
-
-test('skills.json has skills with required fields', () => {
-  const data = JSON.parse(fs.readFileSync(path.join(__dirname, 'skills.json'), 'utf8'));
-  const required = ['name', 'description', 'category', 'author', 'license'];
-
-  data.skills.forEach(skill => {
-    required.forEach(field => {
-      assert(skill[field], `Skill ${skill.name} missing ${field}`);
-    });
-  });
-});
-
-test('skill names match folder names', () => {
-  const data = JSON.parse(fs.readFileSync(path.join(__dirname, 'skills.json'), 'utf8'));
-  const skillsDir = path.join(__dirname, 'skills');
-
-  data.skills.forEach(skill => {
-    const skillPath = path.join(skillsDir, skill.name);
-    assert(fs.existsSync(skillPath), `Folder missing for skill: ${skill.name}`);
-    assert(fs.existsSync(path.join(skillPath, 'SKILL.md')), `SKILL.md missing for: ${skill.name}`);
-  });
-});
-
-test('no duplicate skill names', () => {
-  const data = JSON.parse(fs.readFileSync(path.join(__dirname, 'skills.json'), 'utf8'));
-  const names = data.skills.map(s => s.name);
-  const unique = [...new Set(names)];
-  assertEqual(names.length, unique.length, 'Duplicate skill names found');
-});
-
-test('all categories are valid', () => {
-  const validCategories = ['development', 'document', 'creative', 'business', 'productivity'];
-  const data = JSON.parse(fs.readFileSync(path.join(__dirname, 'skills.json'), 'utf8'));
-
-  data.skills.forEach(skill => {
-    assert(
-      validCategories.includes(skill.category),
-      `Invalid category "${skill.category}" for skill ${skill.name}`
-    );
-  });
-});
-
-// ============ CLI TESTS ============
-
-test('help command works', () => {
-  const output = run('help');
-  assertContains(output, 'AI Agent Skills');
-  assertContains(output, 'install');
-  assertContains(output, 'uninstall');
-});
-
-test('list command works', () => {
-  const output = run('list');
-  assertContains(output, 'Available Skills');
-  assertContains(output, 'DEVELOPMENT');
-});
-
-test('search command works', () => {
-  const output = run('search pdf');
-  assertContains(output, 'pdf');
-});
-
-test('info command works', () => {
-  const output = run('info pdf');
-  assertContains(output, 'pdf');
-  assertContains(output, 'Category:');
-});
-
-test('invalid skill name rejected', () => {
-  const output = run('install ../etc/passwd');
-  assertContains(output, 'Invalid skill name');
-});
-
-test('dry-run shows preview', () => {
-  const output = run('install pdf --dry-run');
-  assertContains(output, 'Dry Run');
-  assertContains(output, 'Would install');
-});
-
-test('config command works', () => {
-  const output = run('config');
-  assertContains(output, 'Configuration');
-  assertContains(output, 'defaultAgent');
-});
-
-test('unknown command shows error', () => {
-  const output = run('notacommand');
-  assertContains(output, 'Unknown command');
-});
-
-test('category filter works', () => {
-  const output = run('list --category document');
-  assertContains(output, 'DOCUMENT');
-});
-
-// ============ SECURITY TESTS ============
-
-test('path traversal blocked in skill names', () => {
-  const output = run('install ../../etc');
-  assertContains(output, 'Invalid skill name');
-});
-
-test('backslash path traversal blocked', () => {
-  const output = run('install ..\\..\\etc');
-  assertContains(output, 'Invalid skill name');
-});
-
-// ============ SUMMARY ============
-
-console.log('\n' + '─'.repeat(40));
-console.log(`${colors.green}Passed: ${passed}${colors.reset}`);
-if (failed > 0) {
-  console.log(`${colors.red}Failed: ${failed}${colors.reset}`);
-}
-console.log('─'.repeat(40) + '\n');
-
-process.exit(failed > 0 ? 1 : 0);