get-skill 1.0.21 → 1.3.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +242 -117
- package/LICENSE +21 -0
- package/README.md +130 -50
- package/assets/skillmd-banner.jpg +0 -0
- package/bin/skillmd-mcp.mjs +2 -330
- package/bin/skillmd.mjs +1 -1
- package/dist/chunk-MPBRLZWJ.js +919 -0
- package/dist/cli.js +1497 -1073
- package/dist/mcp.js +581 -0
- package/package.json +43 -24
- package/vendor/index.js +0 -333
package/CHANGELOG.md
CHANGED
|
@@ -1,117 +1,242 @@
|
|
|
1
|
-
# Changelog
|
|
2
|
-
|
|
3
|
-
All notable changes to `skillmds` are documented here. Versions follow [semver](https://semver.org).
|
|
4
|
-
|
|
5
|
-
## 1.
|
|
6
|
-
|
|
7
|
-
- **
|
|
8
|
-
|
|
9
|
-
## 1.
|
|
10
|
-
|
|
11
|
-
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
- **
|
|
17
|
-
|
|
18
|
-
## 1.
|
|
19
|
-
|
|
20
|
-
- **
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
-
|
|
36
|
-
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
-
|
|
44
|
-
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
-
|
|
61
|
-
-
|
|
62
|
-
-
|
|
63
|
-
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
-
|
|
78
|
-
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
- `
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
-
|
|
113
|
-
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
1
|
+
# Changelog
|
|
2
|
+
|
|
3
|
+
All notable changes to `get-skill` (published as `skillmds` until 1.3.6) are documented here. Versions follow [semver](https://semver.org).
|
|
4
|
+
|
|
5
|
+
## 1.3.8
|
|
6
|
+
|
|
7
|
+
- **Skills install all their files.** `add`, `update` and the MCP install tool now fetch every registry skill's bundle, not only skills marked as packs. Some skills were recorded as single-file while carrying scripts or references, and installed only their SKILL.md. A single-file skill whose bundle can't be reached still installs from its SKILL.md, as before.
|
|
8
|
+
|
|
9
|
+
## 1.3.7
|
|
10
|
+
|
|
11
|
+
- **The package is now `get-skill`.** Install and run it as `npx get-skill add owner/name`, `npx get-skill search "pdf"`, and so on; MCP clients start the server with `npx -y get-skill`. `npm i -g get-skill` installs the `get-skill` and `skillmd` commands. Every release is still published as `skillmds` too, with identical contents, so existing setups keep working.
|
|
12
|
+
|
|
13
|
+
## 1.3.6
|
|
14
|
+
|
|
15
|
+
- **Installed skills name where they came from.** A skill installed from the registry (with `add`, `update` or the MCP install tool) gets one line in its frontmatter, `metadata.source: https://skillmd.com/skills/<owner>/<name>`, so an agent reading it knows its SkillMD page. Every other byte is the author's: an existing `metadata` block gains that one line, and an author's own `metadata.source` is never replaced. The line is added after the integrity checks, and the lock file's digest still covers the bytes the registry served, so `update` is unaffected. GitHub, gist and local installs are written exactly as fetched.
|
|
16
|
+
- **find-skills, offered once.** After your first successful install in a terminal, `add` asks once whether to also add `skillmd/find-skills`, a skill that tells your agent to look on SkillMD when a task needs know-how it doesn't have, and to vet what it finds before suggesting it. Yes or no, it never asks again; an agent running the CLI, `-y` and `--json` are never asked.
|
|
17
|
+
|
|
18
|
+
## 1.3.5
|
|
19
|
+
|
|
20
|
+
- **The agent picker now says why Claude Code isn't in it.** `add plugin:owner/slug` installs the plugin into Claude Code as a real plugin first, then asks which other agents should get its skills, leaving Claude Code out so it doesn't get the same skills twice. The question read "Which agents do you want to install to?", and the confirmation only printed after the run, so the list looked as if Claude Code hadn't been detected. It now asks: `Claude Code already has <plugin> as a plugin. Which other agents should get its skills too?`
|
|
21
|
+
|
|
22
|
+
## 1.3.4
|
|
23
|
+
|
|
24
|
+
- **A companion file that its source repo no longer serves no longer fails the install.** When a registry pack links to a file the upstream repo has since deleted or moved, `add` (and the MCP install tool) now installs everything else and warns which files are missing, e.g. `1 companion file is gone from the source repo and was not installed (scripts/gone.ts)`. Before, one such link failed the whole bundle and `add owner/name` fell back to fetching the slug as a GitHub repo, ending in a misleading 404 with nothing installed. `update` stays strict: it never replaces a full install with a partial one.
|
|
25
|
+
|
|
26
|
+
## 1.2.0
|
|
27
|
+
|
|
28
|
+
`skillmd add` was rewritten. It no longer copies a skill into every agent folder it can find: it writes **one canonical copy** and links that copy into the agents you chose, in the scope you chose, and records what it did in a lock file.
|
|
29
|
+
|
|
30
|
+
### Never litters your folders
|
|
31
|
+
|
|
32
|
+
- In a terminal, `add` asks **Installation scope: Project / Global** before writing anything, then which of the detected agents to link into. The agent selection is remembered and pre-checked next time.
|
|
33
|
+
- With `-y`, `--json`, piped stdin, or inside a host agent (Claude Code, Cursor, Codex, Gemini CLI, CI) the scope is auto-detected: **project** when the current directory carries `.git`, `package.json`, `pyproject.toml`, `Cargo.toml`, `go.mod`, `AGENTS.md`, `CLAUDE.md`, `skills-lock.json` or an agent dot-dir, **global** otherwise. The run says which it picked.
|
|
34
|
+
- A piped run with neither `-y` nor a scope flag now **exits 1 with a hint** instead of guessing. Running `skillmd add owner/name` from your Desktop no longer scatters `.claude/`, `.cursor/`, `.codex/`, `.agents/` there.
|
|
35
|
+
- New `-p, --project` forces the current directory; `-g, --global` is unchanged. Cancelling a prompt installs nothing.
|
|
36
|
+
- Project installs only touch agents that are **already present in the project** (or named with `-a`) — `add -p` never creates a folder for an agent the project does not use.
|
|
37
|
+
|
|
38
|
+
### One canonical copy, links everywhere
|
|
39
|
+
|
|
40
|
+
- The skill's files are written once to `.agents/skills/<name>` (project) or `~/.agents/skills/<name>` (global). Each chosen agent directory gets a **junction** (Windows) or **symlink** (everywhere else) pointing at it; if the filesystem refuses, the CLI falls back to a copy and says so.
|
|
41
|
+
- `--mode link|copy` picks between the two (`link` is the default). The old `--copy` spelling still works as a hidden alias.
|
|
42
|
+
- Writes are staged and moved into place, so an interrupted install never leaves a half-written skill behind.
|
|
43
|
+
- `add` refuses to replace a skill installed from a **different source**, or a directory it does not track, unless you pass `--force`.
|
|
44
|
+
- Local directory sources install **all** of the skill's files. GitHub and gist sources install `SKILL.md` only for now; registry installs deliver the full bundle.
|
|
45
|
+
|
|
46
|
+
### Lock files
|
|
47
|
+
|
|
48
|
+
- Project installs write `skills-lock.json` next to your code — sorted, no timestamps, designed to be committed and to produce clean diffs. Global installs write `~/.skillmd/lock.json`.
|
|
49
|
+
- Each entry records the `source`, the `commit_sha` it came from, a `digest` of the installed files, the `agents` it is linked into, and the link `mode` per agent. `list`, `update`, `check` and `remove` all read it.
|
|
50
|
+
|
|
51
|
+
### Real source grammar
|
|
52
|
+
|
|
53
|
+
One parser now decides what a `<source>` argument means, and every command uses it:
|
|
54
|
+
|
|
55
|
+
- `owner/name` — a registry slug (GitHub is the fallback).
|
|
56
|
+
- `owner/repo#ref` — a branch, tag or commit.
|
|
57
|
+
- `owner/repo/sub/path` — a subdirectory of a repo.
|
|
58
|
+
- `owner/repo@skill` — one named skill inside a repo or pack.
|
|
59
|
+
- `github:owner/repo` / `gh:owner/repo` — force the GitHub reading of a bare `owner/name`.
|
|
60
|
+
- GitHub `tree/` and `blob/` URLs, with the ref in the URL preserved (a `blob` URL pointing at a `SKILL.md` resolves to its directory).
|
|
61
|
+
- Gist URLs.
|
|
62
|
+
- `--ref <ref>` overrides the ref on any GitHub source; `-l, --list` prints the skills a source contains without installing anything.
|
|
63
|
+
- GitLab and `git@`/`ssh://` sources get a clear "clone it locally and run `skillmd add ./path/to/skill`" message instead of a confusing 404.
|
|
64
|
+
|
|
65
|
+
### Production behaviour
|
|
66
|
+
|
|
67
|
+
- **`list` / `ls`** — both scopes by default (`-g`, `-p` to narrow, `-a` to filter by agent, `--json`). Columns: name · scope · agents · mode · source. Skills that are on disk but not in a lock file — hand-made, or installed by 1.1.x — are tagged `untracked`.
|
|
68
|
+
- **`remove` / `rm`** — takes `[names...]` or opens a picker; confirms unless `-y`. `--all` removes everything in scope (not combinable with names). `-a` unlinks only those agents and leaves the canonical copy alone; `-g`/`-p` narrow the scope, both are searched by default. `--json` supported; exits 1 when nothing was removed.
|
|
69
|
+
- **`update [names]`** — lock-driven: it refreshes the **full bundle** from the source recorded for each skill, re-lints before writing, and short-circuits when the recorded `commit_sha` has not moved. `--check` reports without writing, `-g`/`-p` narrow the scope, `--json` is supported, and any failure exits 1. Untracked skills are reported and skipped with "reinstall with `skillmd add`".
|
|
70
|
+
- **New `check` command** — `update --check` under its own name.
|
|
71
|
+
- **`login` / `logout` / `init`** never prompt off a TTY: they exit 1 naming the flags to pass instead of hanging an agent or a CI job. All three accept `--json`.
|
|
72
|
+
- A stored token is now **bound to the API host it was saved for**, so a token for one registry is never sent to another. `http://` bases are refused unless you pass `--insecure-http`.
|
|
73
|
+
- `--token` on a terminal prints a warning on stderr: it lands in shell history and in every `ps` listing — prefer `skillmd login` or `SKILLMD_TOKEN`.
|
|
74
|
+
|
|
75
|
+
### Security
|
|
76
|
+
|
|
77
|
+
- Every file in a registry bundle must carry a sha256 and match it, including companion files delivered by URL. A missing or mismatched hash refuses the install rather than writing unverifiable content. The one exception is the bundle's inline `SKILL.md`: the registry generates that file from the skill's stored record rather than storing it, so there is no hash to compare it against. Every other path, hashed or not, is either verified or refused.
|
|
78
|
+
- Registry bundles are capped at **200 files / 20 MB**. Every registry, GitHub raw and gist request carries a **30 s** timeout; the repository download itself runs through `giget`, which takes no deadline — it is bounded instead by the pre-download size check against the GitHub tree API and by the same 200 files / 20 MB caps once the files are on disk. Temp directories are cleaned up on both the success and the failure path.
|
|
79
|
+
- Terminal escape sequences are stripped from registry text before it is printed, so a description can never repaint your terminal.
|
|
80
|
+
- Windows reserved device names (`con`, `nul`, `lpt1`, …) are refused as skill or file names.
|
|
81
|
+
- The install-count `POST /api/skills/<owner>/<name>/install` (body `{"via":"cli"}`, nothing else) is documented in the README and skipped entirely when `SKILLMD_NO_TELEMETRY=1` or `DO_NOT_TRACK=1` is set.
|
|
82
|
+
|
|
83
|
+
### MCP server rewritten in TypeScript
|
|
84
|
+
|
|
85
|
+
- The server is now TypeScript on the same code path as the CLI — one installer, one source parser, one sanitiser, one set of schemas.
|
|
86
|
+
- `skillmd_install` gained `scope`, `agents`, `mode`, `force` and `deny`, and installs through the canonical-copy-plus-links model like the CLI.
|
|
87
|
+
- `dest` is **deprecated**: it is accepted only when it points at a known agent skills directory. Use `scope` + `agents`.
|
|
88
|
+
- `skillmd_lint` diagnostics declare the correct severity enum (`warn`, not `warning`).
|
|
89
|
+
- `skillmd_list_saved` results go through the same sanitiser as every other tool's output.
|
|
90
|
+
|
|
91
|
+
### Agent table refreshed
|
|
92
|
+
|
|
93
|
+
- codex, goose, amp and zed use the cross-agent `.agents/skills` convention; gemini-cli uses `.gemini/skills`; antigravity uses `.agent/skills`; droid uses `.factory/skills`.
|
|
94
|
+
- `CLAUDE_CONFIG_DIR` and `CODEX_HOME` relocate those agents' global directories.
|
|
95
|
+
- Project-only agents (eve, promptscript) no longer claim a global directory.
|
|
96
|
+
- Legacy directories stay in the detection list, so an existing install is still found.
|
|
97
|
+
|
|
98
|
+
### Removed
|
|
99
|
+
|
|
100
|
+
- `--copy` is now a hidden alias of `--mode copy` (still works, no longer advertised).
|
|
101
|
+
- The `yaml` dependency — nothing imported it since the validation engine moved to `@skillmds/core`.
|
|
102
|
+
- `lint`'s undocumented `check` alias, which collided with the new `check` command. Use `skillmd lint`.
|
|
103
|
+
|
|
104
|
+
### Upgrade notes
|
|
105
|
+
|
|
106
|
+
- A token saved by an earlier `skillmd login --api <other-host>` is now treated as bound to `api.skillmd.com`. If you use a different registry, re-run `skillmd login --api <url>`.
|
|
107
|
+
- Skills installed by 1.1.x show as `untracked` in `list` and are skipped by `update`. Re-run `skillmd add` on them once to bring them under the lock file.
|
|
108
|
+
- If a script used `skillmd check .` to lint, change it to `skillmd lint .` — `check` now reports available updates.
|
|
109
|
+
|
|
110
|
+
## 1.1.2
|
|
111
|
+
|
|
112
|
+
- **MCP tool metadata.** Every tool now declares a `title`, `annotations` (all read-only except `skillmd_install`, none destructive), an `outputSchema`, and a description on every parameter; list-returning tools respond with `structuredContent: { items }`, `skillmd_lint` and `skillmd_install` return structured results, and refusals are flagged `isError`.
|
|
113
|
+
- **Server metadata.** `initialize` reports a title, description, website URL, icons and usage instructions.
|
|
114
|
+
- No behavior changes to what the tools do.
|
|
115
|
+
|
|
116
|
+
## 1.1.1
|
|
117
|
+
|
|
118
|
+
- Releases are now published through npm Trusted Publishing (OIDC from GitHub Actions) with provenance; no long-lived npm tokens exist for this package.
|
|
119
|
+
- README: links to the registry's browse surfaces (search, categories, publishers, per-agent install guides, docs, stats) so the npm page points at where the skills live.
|
|
120
|
+
- No CLI or MCP behavior changes.
|
|
121
|
+
|
|
122
|
+
## 1.1.0
|
|
123
|
+
|
|
124
|
+
- **Open source.** `skillmds` now develops in the open at [github.com/skillmds/skillmd](https://github.com/skillmds/skillmd), and a MIT `LICENSE` file ships in the package (the manifest always claimed MIT; now the text does too).
|
|
125
|
+
- **The validation engine is its own package.** The lint/security/quality engine is published as [`@skillmds/core`](https://www.npmjs.com/package/@skillmds/core) and consumed as a regular dependency. The bundled `vendor/` copy is gone — anything that deep-imported `skillmds/vendor/index.js` (an undocumented internal) should import `@skillmds/core` instead.
|
|
126
|
+
- MCP setup snippets standardize on the server alias `skillmd` (`claude mcp add skillmd -- npx -y skillmds`). Existing configs with other aliases keep working — the alias is client-side.
|
|
127
|
+
- README correction: registry installs have not been gated on verification since 1.0.16.
|
|
128
|
+
- No CLI or MCP behavior changes.
|
|
129
|
+
|
|
130
|
+
## 1.0.21
|
|
131
|
+
|
|
132
|
+
- **No more `tar@6` deprecation warning on install.** Upgraded `giget` 1.x → 3.x, whose GitHub downloads no longer depend on the deprecated (and CVE-flagged) `tar@6.2.1`. The `skillmds` dependency tree is now tar-free; download behavior (`skillmd add <github url>`, pack fallbacks) is unchanged.
|
|
133
|
+
|
|
134
|
+
## 1.0.20
|
|
135
|
+
|
|
136
|
+
- **`skillmd add` now installs to every agent on your machine.** Detection is machine-level (an agent's config dir under your home, e.g. `~/.cursor`), so agents no longer need a pre-existing `skills/` folder to be targeted. The agent registry grows from 5 to **60+**: Gemini CLI, Antigravity, Kiro, Warp, GitHub Copilot, Cline, Roo Code, Goose, Trae, Qwen Code, Amp, OpenClaw, Kilo Code, Hermes (Nous Research), Continue, Devin, OpenHands, Replit, Mistral Vibe, Zed, Kimi Code, Droid (Factory), Crush, Augment, Junie, and more — with per-agent dirs matching each agent's own convention (`~/.codeium/windsurf/skills` for Windsurf, `~/.gemini/antigravity/skills` for Antigravity, etc.). Agents sharing the cross-agent `.agents/skills` convention are written once and labelled with every agent they serve. `-a/--agent` still overrides.
|
|
137
|
+
- Running from your home directory now behaves like `--global` (project scope rooted at `$HOME` *is* the global scope), so agents whose global skills live outside `~/<agent>/skills` get the right directory.
|
|
138
|
+
|
|
139
|
+
## 1.0.19
|
|
140
|
+
|
|
141
|
+
- **Clear diagnostics when the registry is blocked.** In sandboxed or proxied environments that deny network egress to `api.skillmd.com`, `skillmd add owner/name` used to fall back to GitHub and surface a misleading "repo not found" error. The CLI now tells 404 ("not in the registry" — GitHub fallback proceeds as before) apart from unreachable (DNS failure, proxy 403, 5xx): if the GitHub fallback also fails, the error names the blocked registry and says what fixes it (allowlist `api.skillmd.com`, or install via the SkillMD MCP server); if the fallback succeeds, a warning notes the copy came from GitHub, not the registry.
|
|
142
|
+
|
|
143
|
+
## 1.0.18
|
|
144
|
+
|
|
145
|
+
- **Cleaner tool output for agents.** `skillmd_search`, `skillmd_trending`, and `skillmd_recommend` no longer echo site-oriented fields (`avg_rating`, `rating_count`, `install_count`, `save_count`, `verified`, `type`, `owner_avatar`, `category_slug`, and the internal `confident` ranker flag). Results now carry just what an agent needs to pick a skill: slug, title, description, category, agents, repo stars, and the install snippet.
|
|
146
|
+
- **Quality score no longer punishes ordinary skills.** The security flags (`reads_secrets`, `network_calls`, `executes_scripts`) are pattern matches against prose and code samples, not proof of anything unsafe — they now cost 2/1/5 points respectively (was 25/8/15), so a skill that merely documents an env var or a URL keeps its high score. Verified skills are floored at 85 (unless the content fails to parse). `skillmd_lint` passes a skill's verified status through to the score.
|
|
147
|
+
|
|
148
|
+
## 1.0.16
|
|
149
|
+
|
|
150
|
+
- **Installs are no longer gated on verification.** Any skill installs directly — verified or not — with no flag, no prompt, and no second step, from both the CLI (`skillmd add`) and the MCP `skillmd_install` tool. Security flags (network_calls, executes_scripts, reads_secrets, docs_only) are still shown on the result as information, but never block. `--deny <flag>` remains available as an opt-in for anyone who wants to exclude a flag; `--allow-unverified` is now a no-op kept for backward compatibility.
|
|
151
|
+
|
|
152
|
+
## 1.0.15
|
|
153
|
+
|
|
154
|
+
- Search is now **browsable in the interactive menu**: arrow through results, press Enter on one to see a card, and install it to your project or user directory — all without leaving the CLI (`← Back` at each level; Esc goes up one step, never quits).
|
|
155
|
+
- Search results are clean two-line entries showing the source repo's **star count** (e.g. `★ 223.7k`) instead of the placeholder rating, with the description truncated to fit your terminal.
|
|
156
|
+
- Fixes for narrow terminals: result rows are width-budgeted so they don't wrap and garble the menu; the result card prints once instead of repainting on every action.
|
|
157
|
+
|
|
158
|
+
## 1.0.14
|
|
159
|
+
|
|
160
|
+
- Interactive menu (`skillmds` in a terminal) no longer exits after one action — it returns to the menu until you pick **Quit**; cancelling a sub-prompt goes back to the menu instead of quitting.
|
|
161
|
+
- "List installed skills" now shows project **and** global skills together, tagged `[agent/scope]`, replacing the misleading "Include global skills?" prompt (which actually toggled global-only vs project-only). Invalid skills show the parse reason.
|
|
162
|
+
- The in-menu command reference now includes `info`.
|
|
163
|
+
|
|
164
|
+
## 1.0.13
|
|
165
|
+
|
|
166
|
+
Safe & easy installs release.
|
|
167
|
+
|
|
168
|
+
- **Packs install their full file tree.** `skillmd add owner/pack` now downloads the pack's source directory (pinned to the registry's commit; falls back to the default branch with a warning if the pin is gone upstream), so `assets/` and `references/` files referenced by SKILL.md actually exist. Hardened: symlinks are skipped, 200-file/20MB caps, temp dirs cleaned up.
|
|
169
|
+
- **Unverified skills prompt instead of hard-blocking.** Interactive installs show the lint score and security flags and ask before installing; non-interactive installs (and `-y`) still require the explicit `--allow-unverified`. Blocked output links the skill's page for review.
|
|
170
|
+
- **New `skillmd info <slug>`** shows verification status, security flags, rating, provenance (source repo @ commit), and the install snippet. Unknown subcommands now print a proper error instead of silently starting the MCP server.
|
|
171
|
+
- **MCP `skillmd_install` gained the CLI's safety gates**: refuses unverified skills unless `allow_unverified: true` (only after explicit human approval), validates before writing, reports security flags, and guards against malformed skill names.
|
|
172
|
+
- **Installs are exact.** The registry now stores the published SKILL.md verbatim (`raw_md`) and installs deliver it byte-for-byte; reconstructed frontmatter (legacy rows) is YAML-quoted so descriptions with `:`/`#`/quotes can't corrupt the file.
|
|
173
|
+
- Description limit aligned with Claude Code's real spec (1024 chars, was 500) — valid skills are no longer flagged "(invalid SKILL.md)" by `skillmd list`, and `list` now says *why* a file is invalid.
|
|
174
|
+
|
|
175
|
+
## 1.0.12
|
|
176
|
+
|
|
177
|
+
- Registry-native `skillmd` CLI shipped inside `skillmds`: `search`, `add`, `list`, `remove`, `update`, `publish`, `login`/`logout`, plus lint/scan/rules/init. (Release notes added retroactively.)
|
|
178
|
+
|
|
179
|
+
## 1.0.11
|
|
180
|
+
|
|
181
|
+
- Security flags render with full readable labels, each with its own marker: `⚑ Executes Scripts ⚑ Calls Network ⚑ Reads Secrets`.
|
|
182
|
+
|
|
183
|
+
## 1.0.10
|
|
184
|
+
|
|
185
|
+
- Quality score is now a composite of spec correctness, completeness, and **security risk** — skills that read secrets, execute scripts, or make network calls score lower (a risky/stub skill is no longer a green 100).
|
|
186
|
+
- Lint output ends with a **Failed** section listing each failure's rule, message, and full path, so problems don't scroll off in a large run.
|
|
187
|
+
- New `--errors-only` flag to show only failing skills.
|
|
188
|
+
- Fixed emoji spacing/overlap; rule ids are grouped by severity per skill.
|
|
189
|
+
- The closer states how many skills failed instead of a vague "Problems found".
|
|
190
|
+
|
|
191
|
+
## 1.0.9
|
|
192
|
+
|
|
193
|
+
- Compact lint output: one line per skill (status dot, score, name, rule-id chips) with a single summary line, instead of a tall multi-row block per skill. Linting a single skill still shows full diagnostic messages.
|
|
194
|
+
|
|
195
|
+
## 1.0.8
|
|
196
|
+
|
|
197
|
+
- `skillmds` with no command in a terminal now opens the interactive CLI menu; it only starts the MCP server when launched over piped stdio (how MCP clients run it). Previously a bare `npx skillmds` in a terminal appeared to hang on the silent MCP server.
|
|
198
|
+
|
|
199
|
+
## 1.0.7
|
|
200
|
+
|
|
201
|
+
- Nicer CLI output: colored PASS/FAIL, quality-score bars, `ERROR`/`WARN`/`INFO` badges, and a summary with average score.
|
|
202
|
+
- Running `skillmd` (or `skillmds`) with no command on a terminal now opens a guided interactive menu (lint, scan, search, init, list). Piped/CI still prints help.
|
|
203
|
+
- Progress spinner while scanning.
|
|
204
|
+
|
|
205
|
+
## 1.0.6
|
|
206
|
+
|
|
207
|
+
- Bundle the banner image in the package and serve it via jsDelivr so it renders on the npm page (the previous absolute URL was unreachable).
|
|
208
|
+
|
|
209
|
+
## 1.0.5
|
|
210
|
+
|
|
211
|
+
- The `skillmds` binary now dispatches: `skillmds <command>` (lint, scan, add, …) runs the CLI, while `skillmds` with no command starts the MCP server. This makes `npx skillmds lint .` work without the `-p` flag.
|
|
212
|
+
|
|
213
|
+
## 1.0.4
|
|
214
|
+
|
|
215
|
+
- `skillmd lint`/`scan` print a progress line to stderr and warn when scanning a home directory, so a directory scan never looks like a frozen blank screen.
|
|
216
|
+
- Directory scans skip large build/OS directories (`AppData`, `node_modules`, `target`, …) and cap recursion depth, so `lint .` in a big tree terminates quickly.
|
|
217
|
+
- Clearer message when no `SKILL.md` is found.
|
|
218
|
+
- Bare `skillmd` (no command) prints help.
|
|
219
|
+
|
|
220
|
+
## 1.0.3
|
|
221
|
+
|
|
222
|
+
- CLI (`skillmd`) and MCP server (`skillmds`) now report their version from `package.json` instead of a hardcoded string.
|
|
223
|
+
- READMEs rewritten; added this changelog.
|
|
224
|
+
|
|
225
|
+
## 1.0.2
|
|
226
|
+
|
|
227
|
+
- `skillmd lint`: skip directories that cannot be read (e.g. `EPERM` on protected system folders) instead of aborting the scan.
|
|
228
|
+
|
|
229
|
+
## 1.0.1
|
|
230
|
+
|
|
231
|
+
- Fix `skillmd_lint` in the MCP server: keep `yaml` external in the bundled engine so it loads at runtime (bundling a CommonJS module into ESM raised `Dynamic require of "process"`).
|
|
232
|
+
|
|
233
|
+
## 1.0.0
|
|
234
|
+
|
|
235
|
+
- Add the `skillmd` CLI, shipped alongside the MCP server in this package. Commands: `lint`/`check`, `scan`, `rules`, `init`, `search`, `add`, `list`, `remove`, `update`, `publish`/`submit`, `login`, `logout`.
|
|
236
|
+
- Validation engine shared with the SkillMD registry: `SKILL.md` parser, lint rules `SK001`–`SK040`, security scan, quality score, and `text`/`json`/`sarif`/`github` output.
|
|
237
|
+
- Add the `skillmd_lint` MCP tool.
|
|
238
|
+
- MCP server and CLI authenticate with `Authorization: Bearer` tokens.
|
|
239
|
+
|
|
240
|
+
## 0.1.1
|
|
241
|
+
|
|
242
|
+
- Initial MCP server: `skillmd_search`, `skillmd_get`, `skillmd_install`, `skillmd_trending`, `skillmd_recommend`, `skillmd_list_saved`.
|
package/LICENSE
ADDED
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2026 SkillMD (https://skillmd.com)
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|