cc-recommender 0.7.0 → 0.8.0

package/CHANGELOG.md

@@ -5,8 +5,59 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [0.7.0](https://github.com/yuji0809/cc-recommender/compare/v0.6.1...v0.7.0) (2026-01-31)
+## [0.8.0](https://github.com/yuji0809/cc-recommender/compare/v0.7.0...v0.8.0) (2026-02-01)
+
+
+### Features
+
+* enhance skill fetching and security filtering ([99745c2](https://github.com/yuji0809/cc-recommender/commit/99745c2391628607af2e5e87e0ceacfdf953cafb))
+
+## [Unreleased]
+
+### Added
+- OpenAI skills support (.curated and .experimental subdirectories)
+- Obra superpowers skills support
+- Direct skill source configuration separated from curated list sources
+- Automatic skill repository structure detection
+- VoltAgent repository exclusion to prevent false positives
+- Documentation Agent for checking MD file consistency with code
+- Pre-commit check command (`/pre-commit-check`) for comprehensive code review before commits
+- Quality scoring system for skills based on multiple metrics:
+  - Official status (0-40 points)
+  - Stars count (0-30 points, logarithmic scale)
+  - Freshness (0-20 points, based on last updated date)
+  - Source priority (0-10 points)
+  - Quality badges (⭐, ⭐⭐, ⭐⭐⭐) in recommendation output
+- Official skills support from GitHub repositories (Anthropic, Supabase, Vercel, etc.)
+- GitHub topic search for automatic skill discovery from community (requires GITHUB_TOKEN)
+- Retry utility with exponential backoff for handling API rate limits
+- Environment variable centralization via `src/config/env.ts` for better maintainability
+- New agents: Documentation Agent, TDD Agent, Architecture Agent, Security Agent, TypeScript Agent
+- New skills: documentation-check, architecture-check, security-check, typescript-check, tdd
+- New commands: pre-commit-check
+
+### Changed
+- SKILL_FILE_PATTERNS now prioritizes `SKILL.md` (uppercase) over lowercase variants
+- Split skill sources into direct repositories and curated lists for better organization
+- Improved skill validation with repository structure checks
+- Replace `console.error` with `console.log` for consistent logging across the codebase
+- Update score thresholds in `getScoreExplanation` function to use 1-100 scale
+- Use raw GitHub data (raw.githubusercontent.com) to avoid API rate limits
+- Reorganize fetchers into subdirectories by type (mcp/, plugins/, skills/)
+- Update frequency changed from weekly to daily for plugin marketplace, MCP servers, and skills list
+- Use `ENV` config instead of direct `process.env` access for better testability and type safety
+- Move module-level constants outside functions for improved performance
+- Update `.cc-audit.yaml` to treat MW-072 (Burp Suite) as warning instead of error
+
+### Fixed
+- OpenAI experimental skills now correctly fetched (codex-readiness-*, create-plan, gitlab-address-comments)
+- Obra skills discovery now working with flat directory structure
+- VoltAgent awesome-agent-skills no longer incorrectly detected as a skill itself
+- Security scanning now succeeds for all repositories (31/31)
+- Improved error handling in data fetching services
+- Better retry logic for GitHub API rate limits and temporary failures
 
+## [0.7.0](https://github.com/yuji0809/cc-recommender/compare/v0.6.1...v0.7.0) (2026-01-31)
 
 ### Features
 
@@ -82,8 +133,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 * remove deprecated package-name parameter from release-please ([c043385](https://github.com/yuji0809/cc-recommender/commit/c043385338885da915c956904af59eb382e5f99d))
 
-## [Unreleased]
-
 ## [0.1.0] - 2025-01-30
 
 ### Added

package/README.ja.md

@@ -1,6 +1,7 @@
 # cc-recommender
 
 [![npm version](https://img.shields.io/npm/v/cc-recommender.svg)](https://www.npmjs.com/package/cc-recommender)
+[![npm downloads](https://img.shields.io/npm/dm/cc-recommender.svg)](https://www.npmjs.com/package/cc-recommender)
 [![CI](https://github.com/yuji0809/cc-recommender/actions/workflows/ci.yml/badge.svg)](https://github.com/yuji0809/cc-recommender/actions/workflows/ci.yml)
 [![codecov](https://codecov.io/gh/yuji0809/cc-recommender/branch/main/graph/badge.svg)](https://codecov.io/gh/yuji0809/cc-recommender)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
@@ -20,6 +21,8 @@ Claude Codeで「何入れたらいい？」と聞くだけで、プロジェク
 - 🔍 **プロジェクト分析** - 使用言語、フレームワーク、依存関係を自動検出
 - 🏷️ **キーワード検索** - 名前やタグで検索
 - 🔄 **自動更新** - GitHubから常に最新データを取得（手動更新不要）
+- ⭐ **品質スコアリング** - 公式ステータス、スター数、更新日、ソースに基づいてスキルを評価
+- 🤖 **公式スキル自動検出** - 既知の組織から公式スキルを自動的に検出
 
 ## インストール
 
@@ -189,7 +192,8 @@ Claude: [search_skills ツールを使用]
 | `GITHUB_TOKEN` | GitHub パーソナルアクセストークン（API レート制限を 60 → 5000 req/hour に拡大） | 未設定 |
 | `SKIP_SECURITY_SCAN` | データ取得時にセキュリティスキャンをスキップ（開発者向け） | `false` |
 
-**注意:** GitHub から公式スキル（Anthropic、Supabase など）を取得する場合、レート制限を回避するために GitHub トークンの設定を推奨します。https://github.com/settings/tokens で `public_repo` スコープのトークンを作成してください。
+**注意:**
+- GitHub リポジトリからスキルを取得する場合、レート制限を回避するために GitHub トークンの設定を推奨します。https://github.com/settings/tokens で `public_repo` スコープのトークンを作成してください。
 
 ## 開発
 

package/README.md

@@ -1,6 +1,7 @@
 # cc-recommender
 
 [![npm version](https://img.shields.io/npm/v/cc-recommender.svg)](https://www.npmjs.com/package/cc-recommender)
+[![npm downloads](https://img.shields.io/npm/dm/cc-recommender.svg)](https://www.npmjs.com/package/cc-recommender)
 [![CI](https://github.com/yuji0809/cc-recommender/actions/workflows/ci.yml/badge.svg)](https://github.com/yuji0809/cc-recommender/actions/workflows/ci.yml)
 [![codecov](https://codecov.io/gh/yuji0809/cc-recommender/branch/main/graph/badge.svg)](https://codecov.io/gh/yuji0809/cc-recommender)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
@@ -20,6 +21,8 @@ Just ask "What should I install?" in Claude Code, and it will analyze your proje
 - 🔍 **Project Analysis** - Automatically detects languages, frameworks, and dependencies
 - 🏷️ **Keyword Search** - Search by name or tags
 - 🔄 **Auto-Update** - Always fetches the latest data from GitHub (no manual updates needed)
+- ⭐ **Quality Scoring** - Evaluates skills based on official status, stars, freshness, and source
+- 🤖 **Official Skills Discovery** - Automatically discovers official skills from known organizations
 
 ## Installation
 
@@ -189,7 +192,8 @@ When `CC_RECOMMENDER_OFFLINE_MODE` is enabled, only bundled data is used (no rem
 | `GITHUB_TOKEN` | GitHub personal access token (increases API rate limit from 60 to 5000 req/hour) | Not set |
 | `SKIP_SECURITY_SCAN` | Skip security scanning during data fetch (for developers) | `false` |
 
-**Note:** To fetch official skills from GitHub (Anthropic, Supabase, etc.), a GitHub token is recommended to avoid rate limits. Create a token at https://github.com/settings/tokens with `public_repo` scope.
+**Notes:**
+- To fetch skills from GitHub repositories, a GitHub token is recommended to avoid rate limits. Create a token at https://github.com/settings/tokens with `public_repo` scope.
 
 ## Development