mkt-skills 1.3.0 → 1.3.1

package/README.md

@@ -58,6 +58,10 @@ Override the API URL for testing against a local WordPress instance:
 MKT_API_URL=http://localhost:8080/wp-json/mkt/v1 npx mkt-skills list
 ```
 
+## Source
+
+https://github.com/sandeepkelvadi/mkt-skills
+
 ## License
 
 MIT

package/bin/mkt-skills.mjs

@@ -37,7 +37,7 @@ if (!command || command === '--help' || command === '-h') {
 }
 
 if (command === '--version' || command === '-v') {
-  console.log('mkt-skills 1.3.0');
+  console.log('mkt-skills 1.3.1');
   process.exit(0);
 }
 

package/lib/api.mjs

@@ -8,7 +8,7 @@ async function request(path) {
   try {
     const res = await fetch(`${BASE_URL}${path}`, {
       signal: controller.signal,
-      headers: { 'User-Agent': 'mkt-skills-cli/1.3.0' },
+      headers: { 'User-Agent': 'mkt-skills-cli/1.3.1' },
     });
     return res;
   } finally {

package/lib/paths.mjs

@@ -4,7 +4,13 @@ import { readdir } from 'fs/promises';
 
 const SKILLS_ROOT = join(homedir(), '.claude', 'skills');
 
+const SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;
+
+// Slugs come from the user and from the server. Never let one escape SKILLS_ROOT.
 export function skillDir(slug) {
+  if (typeof slug !== 'string' || !SLUG_RE.test(slug)) {
+    throw new Error(`Invalid skill slug: ${JSON.stringify(slug)}`);
+  }
   return join(SKILLS_ROOT, slug);
 }
 

package/lib/video.mjs

@@ -1,13 +1,14 @@
 import { createInterface } from "readline";
-import { mkdir, rm, writeFile, readFile } from "fs/promises";
+import { mkdir, mkdtemp, rm, writeFile, readFile } from "fs/promises";
 import { existsSync } from "fs";
 import { join, dirname } from "path";
-import { execSync } from "child_process";
+import { execSync, execFileSync } from "child_process";
+import { tmpdir } from "os";
 import { bold, dim, green, red, cyan } from "./ui.mjs";
 
 const TEMPLATE_REPO = "https://github.com/sandeepkelvadi/tm-videogen-template.git";
 const TEMPLATE_BRANCH = "main";
-const TEMPLATE_DIR = "/tmp/.tm-videogen-template";
+let TEMPLATE_DIR; // private temp dir, created per run in cloneTemplate()
 
 async function question(query) {
   const rl = createInterface({ input: process.stdin, output: process.stdout });
@@ -105,10 +106,8 @@ function exec(cmd, cwd) {
 }
 
 async function cloneTemplate() {
-  if (existsSync(TEMPLATE_DIR)) {
-    await rm(TEMPLATE_DIR, { recursive: true, force: true });
-  }
-  execSync(`git clone --depth=1 --branch ${TEMPLATE_BRANCH} ${TEMPLATE_REPO} "${TEMPLATE_DIR}"`, { stdio: "pipe" });
+  TEMPLATE_DIR = await mkdtemp(join(tmpdir(), "tm-videogen-"));
+  execFileSync("git", ["clone", "--depth=1", "--branch", TEMPLATE_BRANCH, TEMPLATE_REPO, TEMPLATE_DIR], { stdio: "pipe" });
 }
 
 export async function video(args) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mkt-skills",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "Install Claude Code marketing skills from marketingskills.directory",
   "type": "module",
   "bin": {
@@ -33,7 +33,11 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/sandeepkelvadi/mkt-skills-dir.git"
+    "url": "git+https://github.com/sandeepkelvadi/mkt-skills.git",
+    "directory": "cli"
   },
-  "homepage": "https://marketingskills.directory"
+  "homepage": "https://marketingskills.directory",
+  "bugs": {
+    "url": "https://github.com/sandeepkelvadi/mkt-skills/issues"
+  }
 }