omni-skills 0.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (176) hide show
  1. package/CODE_OF_CONDUCT.md +32 -0
  2. package/CONTRIBUTING.md +182 -0
  3. package/LICENSE +21 -0
  4. package/LICENSE-CONTENT +14 -0
  5. package/README.md +280 -0
  6. package/SECURITY.md +59 -0
  7. package/data/bundles.json +44 -0
  8. package/dist/archives/api-design.checksums.txt +2 -0
  9. package/dist/archives/api-design.checksums.txt.sig +0 -0
  10. package/dist/archives/api-design.tar.gz +0 -0
  11. package/dist/archives/api-design.tar.gz.sig +5 -0
  12. package/dist/archives/api-design.zip +0 -0
  13. package/dist/archives/api-design.zip.sig +0 -0
  14. package/dist/archives/architecture.checksums.txt +2 -0
  15. package/dist/archives/architecture.checksums.txt.sig +0 -0
  16. package/dist/archives/architecture.tar.gz +0 -0
  17. package/dist/archives/architecture.tar.gz.sig +3 -0
  18. package/dist/archives/architecture.zip +0 -0
  19. package/dist/archives/architecture.zip.sig +0 -0
  20. package/dist/archives/brainstorming.checksums.txt +2 -0
  21. package/dist/archives/brainstorming.checksums.txt.sig +1 -0
  22. package/dist/archives/brainstorming.tar.gz +0 -0
  23. package/dist/archives/brainstorming.tar.gz.sig +0 -0
  24. package/dist/archives/brainstorming.zip +0 -0
  25. package/dist/archives/brainstorming.zip.sig +0 -0
  26. package/dist/archives/changelog.checksums.txt +2 -0
  27. package/dist/archives/changelog.checksums.txt.sig +0 -0
  28. package/dist/archives/changelog.tar.gz +0 -0
  29. package/dist/archives/changelog.tar.gz.sig +0 -0
  30. package/dist/archives/changelog.zip +0 -0
  31. package/dist/archives/changelog.zip.sig +0 -0
  32. package/dist/archives/create-pr.checksums.txt +2 -0
  33. package/dist/archives/create-pr.checksums.txt.sig +0 -0
  34. package/dist/archives/create-pr.tar.gz +0 -0
  35. package/dist/archives/create-pr.tar.gz.sig +0 -0
  36. package/dist/archives/create-pr.zip +0 -0
  37. package/dist/archives/create-pr.zip.sig +0 -0
  38. package/dist/archives/database-design.checksums.txt +2 -0
  39. package/dist/archives/database-design.checksums.txt.sig +0 -0
  40. package/dist/archives/database-design.tar.gz +0 -0
  41. package/dist/archives/database-design.tar.gz.sig +0 -0
  42. package/dist/archives/database-design.zip +0 -0
  43. package/dist/archives/database-design.zip.sig +0 -0
  44. package/dist/archives/debugging.checksums.txt +2 -0
  45. package/dist/archives/debugging.checksums.txt.sig +0 -0
  46. package/dist/archives/debugging.tar.gz +0 -0
  47. package/dist/archives/debugging.tar.gz.sig +0 -0
  48. package/dist/archives/debugging.zip +0 -0
  49. package/dist/archives/debugging.zip.sig +0 -0
  50. package/dist/archives/documentation.checksums.txt +2 -0
  51. package/dist/archives/documentation.checksums.txt.sig +0 -0
  52. package/dist/archives/documentation.tar.gz +0 -0
  53. package/dist/archives/documentation.tar.gz.sig +0 -0
  54. package/dist/archives/documentation.zip +0 -0
  55. package/dist/archives/documentation.zip.sig +0 -0
  56. package/dist/archives/find-skills.checksums.txt +2 -0
  57. package/dist/archives/find-skills.checksums.txt.sig +0 -0
  58. package/dist/archives/find-skills.tar.gz +0 -0
  59. package/dist/archives/find-skills.tar.gz.sig +1 -0
  60. package/dist/archives/find-skills.zip +0 -0
  61. package/dist/archives/find-skills.zip.sig +0 -0
  62. package/dist/archives/frontend-design.checksums.txt +2 -0
  63. package/dist/archives/frontend-design.checksums.txt.sig +0 -0
  64. package/dist/archives/frontend-design.tar.gz +0 -0
  65. package/dist/archives/frontend-design.tar.gz.sig +0 -0
  66. package/dist/archives/frontend-design.zip +0 -0
  67. package/dist/archives/frontend-design.zip.sig +0 -0
  68. package/dist/archives/omni-figma.checksums.txt +2 -0
  69. package/dist/archives/omni-figma.checksums.txt.sig +0 -0
  70. package/dist/archives/omni-figma.tar.gz +0 -0
  71. package/dist/archives/omni-figma.tar.gz.sig +0 -0
  72. package/dist/archives/omni-figma.zip +0 -0
  73. package/dist/archives/omni-figma.zip.sig +0 -0
  74. package/dist/archives/security-auditor.checksums.txt +2 -0
  75. package/dist/archives/security-auditor.checksums.txt.sig +3 -0
  76. package/dist/archives/security-auditor.tar.gz +0 -0
  77. package/dist/archives/security-auditor.tar.gz.sig +0 -0
  78. package/dist/archives/security-auditor.zip +0 -0
  79. package/dist/archives/security-auditor.zip.sig +0 -0
  80. package/dist/archives/vulnerability-scanner.checksums.txt +2 -0
  81. package/dist/archives/vulnerability-scanner.checksums.txt.sig +0 -0
  82. package/dist/archives/vulnerability-scanner.tar.gz +0 -0
  83. package/dist/archives/vulnerability-scanner.tar.gz.sig +2 -0
  84. package/dist/archives/vulnerability-scanner.zip +0 -0
  85. package/dist/archives/vulnerability-scanner.zip.sig +0 -0
  86. package/dist/bundles.json +135 -0
  87. package/dist/catalog.json +645 -0
  88. package/dist/manifests/api-design.json +294 -0
  89. package/dist/manifests/architecture.json +293 -0
  90. package/dist/manifests/brainstorming.json +293 -0
  91. package/dist/manifests/changelog.json +293 -0
  92. package/dist/manifests/create-pr.json +293 -0
  93. package/dist/manifests/database-design.json +293 -0
  94. package/dist/manifests/debugging.json +293 -0
  95. package/dist/manifests/documentation.json +293 -0
  96. package/dist/manifests/find-skills.json +303 -0
  97. package/dist/manifests/frontend-design.json +294 -0
  98. package/dist/manifests/omni-figma.json +314 -0
  99. package/dist/manifests/security-auditor.json +293 -0
  100. package/dist/manifests/vulnerability-scanner.json +294 -0
  101. package/dist/signing/omni-skills-public.pem +14 -0
  102. package/docs/CATALOG.md +74 -0
  103. package/docs/README.md +206 -0
  104. package/docs/architecture/adr-0001-agent-native-workspace.md +82 -0
  105. package/docs/architecture/agent-native-roadmap.md +196 -0
  106. package/docs/architecture/codebase-analysis.md +275 -0
  107. package/docs/contributors/quality-bar.md +72 -0
  108. package/docs/contributors/skill-anatomy.md +120 -0
  109. package/docs/contributors/skill-template.md +104 -0
  110. package/docs/operations/runbook.md +485 -0
  111. package/docs/specs/catalog-api.md +178 -0
  112. package/docs/specs/local-mcp-sidecar.md +219 -0
  113. package/docs/specs/security-validation.md +179 -0
  114. package/docs/specs/skill-classification.md +195 -0
  115. package/docs/specs/skill-manifest.md +220 -0
  116. package/docs/users/bundles.md +93 -0
  117. package/docs/users/getting-started.md +151 -0
  118. package/docs/users/usage.md +187 -0
  119. package/metadata.json +323 -0
  120. package/package.json +101 -0
  121. package/packages/catalog-core/src/index.js +828 -0
  122. package/packages/server-a2a/src/server.js +138 -0
  123. package/packages/server-a2a/src/task-runtime.js +1134 -0
  124. package/packages/server-api/src/http-runtime.js +141 -0
  125. package/packages/server-api/src/server.js +246 -0
  126. package/packages/server-mcp/src/local-sidecar.js +822 -0
  127. package/packages/server-mcp/src/server.js +684 -0
  128. package/skills/api-design/SKILL.md +109 -0
  129. package/skills/api-design/metadata.json +129 -0
  130. package/skills/architecture/SKILL.md +109 -0
  131. package/skills/architecture/metadata.json +128 -0
  132. package/skills/brainstorming/SKILL.md +109 -0
  133. package/skills/brainstorming/metadata.json +128 -0
  134. package/skills/changelog/SKILL.md +105 -0
  135. package/skills/changelog/metadata.json +128 -0
  136. package/skills/create-pr/SKILL.md +105 -0
  137. package/skills/create-pr/metadata.json +128 -0
  138. package/skills/database-design/SKILL.md +109 -0
  139. package/skills/database-design/metadata.json +128 -0
  140. package/skills/debugging/SKILL.md +109 -0
  141. package/skills/debugging/metadata.json +128 -0
  142. package/skills/documentation/SKILL.md +109 -0
  143. package/skills/documentation/metadata.json +128 -0
  144. package/skills/find-skills/SKILL.md +108 -0
  145. package/skills/find-skills/agents/openai.yaml +4 -0
  146. package/skills/find-skills/metadata.json +133 -0
  147. package/skills/frontend-design/SKILL.md +109 -0
  148. package/skills/frontend-design/metadata.json +129 -0
  149. package/skills/omni-figma/LICENSE.txt +2 -0
  150. package/skills/omni-figma/SKILL.md +97 -0
  151. package/skills/omni-figma/agents/openai.yaml +12 -0
  152. package/skills/omni-figma/assets/figma-small.svg +3 -0
  153. package/skills/omni-figma/assets/figma.png +0 -0
  154. package/skills/omni-figma/assets/icon.svg +28 -0
  155. package/skills/omni-figma/metadata.json +139 -0
  156. package/skills/omni-figma/references/figma-best-practices-2026.md +67 -0
  157. package/skills/omni-figma/references/mcp-setup-and-troubleshooting.md +89 -0
  158. package/skills/omni-figma/references/tool-routing-and-prompts.md +78 -0
  159. package/skills/security-auditor/SKILL.md +118 -0
  160. package/skills/security-auditor/metadata.json +128 -0
  161. package/skills/vulnerability-scanner/SKILL.md +131 -0
  162. package/skills/vulnerability-scanner/metadata.json +129 -0
  163. package/tools/bin/cli.js +1189 -0
  164. package/tools/bin/install.js +403 -0
  165. package/tools/lib/catalog-client.js +112 -0
  166. package/tools/lib/symlink-safety.js +23 -0
  167. package/tools/scripts/build_catalog.js +97 -0
  168. package/tools/scripts/generate_index.py +660 -0
  169. package/tools/scripts/generate_release_notes.py +163 -0
  170. package/tools/scripts/install_githooks.js +18 -0
  171. package/tools/scripts/recategorize_skills.py +125 -0
  172. package/tools/scripts/skill_metadata.py +1650 -0
  173. package/tools/scripts/tests/run_tests.js +1057 -0
  174. package/tools/scripts/validate_skills.py +130 -0
  175. package/tools/scripts/verify_archives.py +175 -0
  176. package/tools/scripts/verify_security_scanners.py +125 -0
@@ -0,0 +1,32 @@
1
+ # Contributor Covenant Code of Conduct
2
+
3
+ ## Our Pledge
4
+
5
+ We as members, contributors, and maintainers pledge to make participation in this project and community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, caste, color, religion, or sexual identity and orientation.
6
+
7
+ ## Our Standards
8
+
9
+ Examples of behavior that contributes to a positive environment:
10
+
11
+ - using welcoming and inclusive language
12
+ - being respectful of differing viewpoints and experiences
13
+ - accepting constructive criticism
14
+ - focusing on what is best for the project and community
15
+ - showing empathy toward other community members
16
+
17
+ Examples of unacceptable behavior:
18
+
19
+ - sexualized language or imagery, and sexual attention or advances
20
+ - trolling, insulting, or derogatory comments
21
+ - personal or political attacks
22
+ - public or private harassment
23
+ - publishing someone else's private information without explicit permission
24
+ - other conduct that could reasonably be considered inappropriate in a professional setting
25
+
26
+ ## Enforcement
27
+
28
+ Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the maintainers. Reports will be reviewed and investigated promptly and fairly.
29
+
30
+ ## Attribution
31
+
32
+ This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org), version 2.1.
@@ -0,0 +1,182 @@
1
+ # Contributing to Omni Skills
2
+
3
+ Omni Skills now contains both a skill catalog and the runtime surfaces built on top of that catalog. Contributions can target either area, but both must stay aligned with the generated artifacts and the current CLI behavior.
4
+
5
+ ## Before You Start
6
+
7
+ - Skills are authored in `skills/<skill-name>/SKILL.md`.
8
+ - Contributor templates and guidance live in `docs/contributors/`.
9
+ - Runtime and architecture docs live in `docs/`.
10
+ - Repository-standard community files live in the root: `README.md`, `CONTRIBUTING.md`, `SECURITY.md`, and `CODE_OF_CONDUCT.md`.
11
+
12
+ ## Common Contribution Types
13
+
14
+ - Add or improve a skill under `skills/`
15
+ - Update contributor guidance under `docs/contributors/`
16
+ - Improve the CLI, installer, or generation scripts under `tools/`
17
+ - Improve the shared catalog runtime or the API, MCP, and A2A packages under `packages/`
18
+ - Tighten tests, smoke checks, packaging, or release docs
19
+
20
+ ## Quick Start
21
+
22
+ ```bash
23
+ # 1. Fork and clone
24
+ git clone https://github.com/YOUR-USERNAME/omni-skills.git
25
+ cd omni-skills
26
+
27
+ # 2. Install dependencies
28
+ npm install
29
+ npm run hooks:install # optional, enables the repo pre-commit hook
30
+
31
+ # 3. Create or update your change
32
+ # Example: create a new skill
33
+ mkdir -p skills/my-awesome-skill
34
+ cp docs/contributors/skill-template.md skills/my-awesome-skill/SKILL.md
35
+
36
+ # 4. Validate and regenerate artifacts
37
+ npm run build
38
+
39
+ # 5. Run the smoke suite
40
+ npm test
41
+ npm run smoke
42
+ ```
43
+
44
+ Open the PR with `Allow edits from maintainers` enabled.
45
+
46
+ ## Skill Contributions
47
+
48
+ A good skill should:
49
+
50
+ - solve a specific problem cleanly
51
+ - be reusable across projects
52
+ - include instructions an agent can actually follow
53
+ - avoid vague or redundant content
54
+ - declare accurate frontmatter and compatibility metadata
55
+ - land with generated `metadata.json` classification artifacts
56
+
57
+ Minimal structure:
58
+
59
+ ```text
60
+ skills/my-skill/
61
+ └── SKILL.md
62
+ ```
63
+
64
+ Larger skills can also include:
65
+
66
+ ```text
67
+ skills/my-skill/
68
+ ├── SKILL.md
69
+ ├── agents/
70
+ ├── assets/
71
+ ├── references/
72
+ └── LICENSE.txt
73
+ ```
74
+
75
+ ## Required Validation
76
+
77
+ Before opening a PR, run:
78
+
79
+ ```bash
80
+ npm run validate
81
+ npm run taxonomy:report
82
+ npm run build
83
+ npm test
84
+ ```
85
+
86
+ `npm run validate` now also regenerates:
87
+
88
+ - `metadata.json`
89
+ - `skills/<skill>/metadata.json`
90
+
91
+ It also computes:
92
+
93
+ - canonical taxonomy mapping
94
+ - maturity, best practices, quality, and security scores
95
+ - static security findings
96
+ - optional ClamAV and VirusTotal scanner status when configured
97
+
98
+ For a release-grade preflight, also run:
99
+
100
+ ```bash
101
+ npm run smoke
102
+ ```
103
+
104
+ That smoke pass currently validates:
105
+
106
+ - skill validation
107
+ - catalog generation
108
+ - docs catalog generation
109
+ - test suite
110
+ - `npm pack --dry-run`
111
+ - API boot
112
+ - MCP boot in `stdio`, `stream`, and `sse`
113
+ - A2A boot
114
+
115
+ ## Skill Frontmatter
116
+
117
+ Every skill must include YAML frontmatter. Use [docs/contributors/skill-template.md](docs/contributors/skill-template.md) as the baseline and keep the `name` aligned with the directory slug.
118
+
119
+ ```yaml
120
+ ---
121
+ name: my-skill-name
122
+ description: "What it does"
123
+ version: "0.0.1"
124
+ category: development
125
+ tags: [react, typescript]
126
+ complexity: intermediate
127
+ risk: safe
128
+ tools: [claude-code, cursor]
129
+ source: community
130
+ author: "Your Name"
131
+ date_added: "2026-03-26"
132
+ date_updated: "2026-03-26"
133
+ ---
134
+ ```
135
+
136
+ Use canonical categories in new skills. Current taxonomy:
137
+
138
+ - `development`
139
+ - `frontend`
140
+ - `backend`
141
+ - `fullstack-web`
142
+ - `tools`
143
+ - `cli-automation`
144
+ - `business`
145
+ - `product`
146
+ - `design`
147
+ - `data-ai`
148
+ - `ai-agents`
149
+ - `machine-learning`
150
+ - `devops`
151
+ - `testing-security`
152
+ - `documentation`
153
+ - `content-media`
154
+ - `communication`
155
+ - `uncategorized`
156
+
157
+ ## Runtime Contributions
158
+
159
+ If you touch `packages/`, `tools/bin/`, `tools/lib/`, or build scripts:
160
+
161
+ - keep `dist/` and docs aligned with the implementation
162
+ - prefer reusing `packages/catalog-core` instead of duplicating catalog logic
163
+ - keep local-write behavior behind preview or dry-run defaults
164
+ - treat security scanner warnings as part of the review bar for new skills and scripts
165
+ - update tests when changing CLI commands, transport modes, or public endpoints
166
+
167
+ ## Commit Conventions
168
+
169
+ Common prefixes:
170
+
171
+ - `feat:` new skill or feature
172
+ - `fix:` bug fix
173
+ - `docs:` documentation changes
174
+ - `refactor:` code cleanup or structure changes
175
+ - `test:` test changes
176
+ - `chore:` maintenance
177
+
178
+ ## Need Help?
179
+
180
+ - Questions: open a [Discussion](https://github.com/diegosouzapw/omni-skills/discussions)
181
+ - Bugs: open an [Issue](https://github.com/diegosouzapw/omni-skills/issues)
182
+ - Early feedback: open a [Draft PR](https://github.com/diegosouzapw/omni-skills/pulls)
package/LICENSE ADDED
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2026 Omni Skills Team
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.
@@ -0,0 +1,14 @@
1
+ Creative Commons Attribution 4.0 International (CC BY 4.0)
2
+
3
+ Original documentation and non-code content in this repository is licensed
4
+ under CC BY 4.0, unless a more specific upstream license applies.
5
+
6
+ You are free to:
7
+ - Share — copy and redistribute the material in any medium or format
8
+ - Adapt — remix, transform, and build upon the material for any purpose
9
+
10
+ Under the following terms:
11
+ - Attribution — You must give appropriate credit, provide a link to the
12
+ license, and indicate if changes were made.
13
+
14
+ Full license text: https://creativecommons.org/licenses/by/4.0/legalcode
package/README.md ADDED
@@ -0,0 +1,280 @@
1
+ <!-- omni-skills: version=0.0.1; skills=13; updated_at=2026-03-26 -->
2
+ # 🧠 Omni Skills — Agent-Native Skill Catalog and Runtime
3
+
4
+ > **Curated AI coding skills plus a unified runtime for CLI install, catalog API, MCP, and A2A.**
5
+ > Skills are still authored as `SKILL.md`, but the repository now also ships the machine-readable catalog and protocol surfaces agents need to discover, preview, and install them.
6
+
7
+ [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
8
+ [![Content License: CC BY 4.0](https://img.shields.io/badge/Content-CC_BY_4.0-blue.svg)](LICENSE-CONTENT)
9
+ [![npm](https://img.shields.io/badge/npm-omni--skills-cb3837?logo=npm)](https://www.npmjs.com/package/omni-skills)
10
+ [![Install with NPX](https://img.shields.io/badge/Install-npx%20omni--skills-black?style=for-the-badge&logo=npm)](#quick-start)
11
+ [![MCP](https://img.shields.io/badge/MCP-stdio%20%7C%20stream%20%7C%20sse-2ea44f)](#-runtime-surfaces)
12
+ [![API](https://img.shields.io/badge/API-read--only-0366d6)](#-runtime-surfaces)
13
+ [![A2A](https://img.shields.io/badge/A2A-task%20lifecycle-orange)](#-runtime-surfaces)
14
+
15
+ ---
16
+
17
+ ## ✨ What Omni Skills Is Now
18
+
19
+ Omni Skills is no longer only an installer.
20
+
21
+ - 📦 **Unified package**: the published `omni-skills` binary now handles install, diagnostics, MCP, API, A2A, and release smoke checks.
22
+ - 🖥️ **Operator-friendly CLI**: the package exposes `doctor`, `ui`, `smoke`, and `publish-check` in the same binary.
23
+ - 🔎 **Catalog discovery**: `npx omni-skills find <query>` now searches the published catalog and suggests install commands.
24
+ - 🧭 **Shared catalog contract**: `skills_index.json`, `dist/catalog.json`, `dist/bundles.json`, and `dist/manifests/*.json` drive the runtime.
25
+ - 🧪 **Skill classification**: validation now parses frontmatter, normalizes categories to a canonical taxonomy, and computes maturity level, best practices, and quality scores.
26
+ - 🛡️ **Security validation**: the validator now runs a static content and script scanner, emits security scores, and can optionally enrich results with ClamAV and VirusTotal hash lookups.
27
+ - 🎯 **Selective install**: `--skill` and `--bundle` now install only the relevant published artifacts.
28
+ - 📦 **Per-skill archives**: the build now emits `zip`, `tar.gz`, and checksum manifests per skill, with detached signatures when signing keys are configured.
29
+ - 🔌 **Protocol-native runtime**: the repo ships a read-only HTTP API, an MCP server with three transports, and an A2A runtime with task lifecycle, SSE streaming, cancelation, push notification hooks, and file-backed restart recovery.
30
+ - 🛠️ **Local sidecar mode**: MCP local mode can detect clients, preview writes, install or remove skills, and write client-aware MCP configs under an allowlist.
31
+ - 🔐 **Hosted hardening**: API and MCP HTTP transports now support optional bearer/API-key auth, in-memory rate limiting, and audit logging.
32
+ - 🚢 **Release automation**: GitHub Actions now verifies version tags, runs ClamAV and VirusTotal-gated release builds, requires detached archive signing in CI, publishes the exact tarball to npm, and creates a GitHub Release with custom notes.
33
+ - ✅ **Release preflight**: `smoke` and `publish-check` validate build output, tests, package contents, service boots, and scanner coverage.
34
+
35
+ ---
36
+
37
+ ## 📌 Current Status
38
+
39
+ The runtime foundation is in place and the public catalog is now broad enough to back the main starter bundles with real skills.
40
+
41
+ - Published skills currently available: **13**
42
+ - Current published skills: `api-design`, `architecture`, `brainstorming`, `changelog`, `create-pr`, `database-design`, `debugging`, `documentation`, `find-skills`, `frontend-design`, `omni-figma`, `security-auditor`, and `vulnerability-scanner`
43
+ - Fully backed bundles: **`essentials`**, **`full-stack`**, **`security`**, and **`oss-maintainer`**
44
+ - Roadmap-heavy bundles still pending publication: **`devops`** and **`ai-engineer`**
45
+
46
+ The docs below reflect that split directly: four bundles are installable end-to-end today, while the remaining domain bundles still surface warnings for unpublished members.
47
+
48
+ ---
49
+
50
+ ## 🚀 Quick Start
51
+
52
+ ### Install the default target
53
+
54
+ ```bash
55
+ npx omni-skills
56
+ ```
57
+
58
+ ### Install the published skill into a specific client
59
+
60
+ ```bash
61
+ npx omni-skills --cursor --skill omni-figma
62
+ ```
63
+
64
+ ### Search the catalog before installing
65
+
66
+ ```bash
67
+ npx omni-skills find figma
68
+ npx omni-skills find discovery --tool codex-cli
69
+ npx omni-skills find mcp --sort quality --min-quality 80 --min-security 90
70
+ npx omni-skills find figma --tool cursor --install --yes
71
+ npx omni-skills find foundation --bundle essentials --install --yes
72
+
73
+ # Audit taxonomy drift and optionally rewrite SKILL.md categories
74
+ npx omni-skills recategorize
75
+ npx omni-skills recategorize --write
76
+ ```
77
+
78
+ ### Start the local MCP sidecar
79
+
80
+ ```bash
81
+ npx omni-skills mcp stream --local
82
+ ```
83
+
84
+ ### Start the catalog API and A2A surface
85
+
86
+ ```bash
87
+ npx omni-skills api --port 3333
88
+ npx omni-skills a2a --port 3335
89
+ ```
90
+
91
+ ### Run the release preflight
92
+
93
+ ```bash
94
+ npx omni-skills smoke
95
+ npx omni-skills publish-check
96
+ ```
97
+
98
+ ### Publish a release through GitHub Actions
99
+
100
+ ```bash
101
+ npm version patch
102
+ git push origin main --follow-tags
103
+ ```
104
+
105
+ The `v*` tag workflow rebuilds the release with required antivirus gates, signs archives in CI, publishes the verified tarball to npm, and creates a GitHub Release with custom notes plus attached verification assets.
106
+
107
+ ---
108
+
109
+ ## 🔌 Runtime Surfaces
110
+
111
+ | Surface | Status | What it does | Example |
112
+ | :------ | :----- | :----------- | :------ |
113
+ | **CLI** | Implemented | Find and install skills, run diagnostics, open the terminal UI, boot services, run smoke checks | `npx omni-skills doctor` |
114
+ | **Catalog API** | Implemented | Read-only catalog, search, bundles, install plans, artifact downloads | `npx omni-skills api --port 3333` |
115
+ | **MCP** | Implemented | Discovery, recommendation, install preview, optional local sidecar mode | `npx omni-skills mcp stream --local` |
116
+ | **A2A** | Implemented | Task-aware discovery, install-plan handoff, polling, streaming, cancelation, and push notifications | `npx omni-skills a2a --port 3335` |
117
+
118
+ ### MCP Transports
119
+
120
+ The MCP runtime supports:
121
+
122
+ - `stdio`
123
+ - `stream`
124
+ - `sse`
125
+
126
+ Examples:
127
+
128
+ ```bash
129
+ npx omni-skills mcp stdio
130
+ npx omni-skills mcp stream
131
+ npx omni-skills mcp sse
132
+ ```
133
+
134
+ ### Generated Catalog Artifacts
135
+
136
+ The build pipeline emits:
137
+
138
+ - `metadata.json`
139
+ - `skills_index.json`
140
+ - `dist/catalog.json`
141
+ - `dist/bundles.json`
142
+ - `dist/manifests/<skill>.json`
143
+ - `dist/archives/<skill>.zip`
144
+ - `dist/archives/<skill>.tar.gz`
145
+ - `dist/archives/<skill>.checksums.txt`
146
+ - `skills/<skill>/metadata.json`
147
+
148
+ These generated artifacts are the shared source of truth for CLI, API, MCP, and A2A behavior.
149
+
150
+ Each skill also gets a generated `skills/<skill>/metadata.json` with:
151
+
152
+ - canonical taxonomy classification
153
+ - maturity level (`L1`/`L2`/`L3`)
154
+ - best practices score (`0-100`)
155
+ - quality score (`0-100`)
156
+ - security score (`0-100`)
157
+ - static security findings plus optional ClamAV and VirusTotal scanner status
158
+ - validation status and supporting metadata
159
+
160
+ ---
161
+
162
+ ## 📦 Catalog Reality
163
+
164
+ The current generated catalog contains:
165
+
166
+ - `13` published skills in `dist/catalog.json`
167
+ - installable skill bundles for planning, download, MCP, and A2A handoff
168
+ - curated bundle definitions in `dist/bundles.json`
169
+
170
+ Current bundle availability:
171
+
172
+ | Bundle | Available now | Notes |
173
+ | :----- | :------------ | :---- |
174
+ | `essentials` | `4/4` | `find-skills`, `brainstorming`, `architecture`, `debugging` |
175
+ | `full-stack` | `4/4` | `frontend-design`, `api-design`, `database-design`, `omni-figma` |
176
+ | `security` | `2/2` | `security-auditor`, `vulnerability-scanner` |
177
+ | `devops` | `0/3` | Metadata only for now |
178
+ | `ai-engineer` | `0/3` | Metadata only for now |
179
+ | `oss-maintainer` | `4/4` | `find-skills`, `create-pr`, `changelog`, `documentation` |
180
+
181
+ This is why `--bundle` is already useful both for real installs and for roadmap-aware planning. Four bundles install cleanly today, and the remaining two still surface warnings for unpublished members.
182
+
183
+ ---
184
+
185
+ ## 🧭 Documentation Map
186
+
187
+ ### Start Here
188
+
189
+ - [Documentation Hub](docs/README.md)
190
+ - [Getting Started](docs/users/getting-started.md)
191
+ - [Usage Guide](docs/users/usage.md)
192
+ - [Bundles](docs/users/bundles.md)
193
+ - [Catalog](docs/CATALOG.md)
194
+ - [System Runbook](docs/operations/runbook.md)
195
+
196
+ ### Architecture and Specs
197
+
198
+ - [Agent-Native Roadmap](docs/architecture/agent-native-roadmap.md)
199
+ - [ADR-0001: Agent-Native Workspace Foundation](docs/architecture/adr-0001-agent-native-workspace.md)
200
+ - [Catalog API Surface](docs/specs/catalog-api.md)
201
+ - [Local MCP Sidecar](docs/specs/local-mcp-sidecar.md)
202
+ - [Skill Classification and Metadata](docs/specs/skill-classification.md)
203
+ - [Security Validation and Distribution](docs/specs/security-validation.md)
204
+ - [Skill Manifest Specification](docs/specs/skill-manifest.md)
205
+
206
+ ### Community and Contribution
207
+
208
+ - [Contributing Guide](CONTRIBUTING.md)
209
+ - [Security Policy](SECURITY.md)
210
+ - [Code of Conduct](CODE_OF_CONDUCT.md)
211
+ - [Skill Template](docs/contributors/skill-template.md)
212
+ - [Skill Anatomy](docs/contributors/skill-anatomy.md)
213
+ - [Quality Bar](docs/contributors/quality-bar.md)
214
+
215
+ ---
216
+
217
+ ## 🗂️ Repository Layout
218
+
219
+ | Path | Purpose |
220
+ | :--- | :------ |
221
+ | `skills/` | Canonical authored skills |
222
+ | `docs/` | User, contributor, architecture, and spec documentation |
223
+ | `docs/operations/` | Operational runbooks and deployment workflows |
224
+ | `dist/` | Generated machine-readable catalog and manifests |
225
+ | `packages/catalog-core/` | Shared catalog runtime |
226
+ | `packages/server-api/` | Read-only HTTP API |
227
+ | `packages/server-mcp/` | MCP server with local sidecar mode |
228
+ | `packages/server-a2a/` | A2A server with task runtime, SSE streaming, and push config |
229
+ | `tools/bin/` | Published CLI entrypoints |
230
+ | `tools/lib/` | Shared installer libraries |
231
+ | `tools/scripts/` | Validation, generation, tests, and catalog build scripts |
232
+
233
+ ---
234
+
235
+ ## 🧪 Validation and Release Checks
236
+
237
+ Recommended local preflight:
238
+
239
+ ```bash
240
+ npm run smoke
241
+ ```
242
+
243
+ The smoke run currently validates:
244
+
245
+ - skill validation
246
+ - security scanner verification
247
+ - taxonomy recategorization tooling
248
+ - catalog generation
249
+ - generated catalog markdown
250
+ - automated tests
251
+ - `npm pack --dry-run`
252
+ - API boot
253
+ - MCP boot in `stdio`, `stream`, and `sse`
254
+ - A2A boot, polling, streaming, cancelation, and push-config lifecycle
255
+
256
+ Tag-based release automation now also validates:
257
+
258
+ - Git tag version matches `package.json`
259
+ - ClamAV scanning is enabled and completed for every skill
260
+ - VirusTotal hash lookup is enabled and completed for every skill
261
+ - archive signatures are required and verified in CI
262
+ - the exact verified tarball is what gets published to npm
263
+ - a GitHub Release is created automatically with custom notes and attached catalog or checksum artifacts
264
+
265
+ ---
266
+
267
+ ## 🛣️ What Is Still Pending
268
+
269
+ - stronger governance for hosted API or remote MCP deployments beyond the current auth, rate limit, and audit-log baseline
270
+ - broader client coverage and export recipes beyond the current known JSON and TOML MCP config targets
271
+ - external executor integration and stronger multi-node durability beyond the current file-backed A2A store
272
+ - expansion of the public catalog for the remaining roadmap bundles: `devops` and `ai-engineer`
273
+
274
+ ---
275
+
276
+ ## ⚖️ License
277
+
278
+ Code and tooling are licensed under the [MIT License](LICENSE).
279
+
280
+ Documentation and skill content are licensed under [CC BY 4.0](LICENSE-CONTENT).
package/SECURITY.md ADDED
@@ -0,0 +1,59 @@
1
+ # Security Policy
2
+
3
+ ## Reporting a Vulnerability
4
+
5
+ If you discover a security issue in Omni Skills, do not open a public issue first.
6
+
7
+ Please report it through one of these private channels:
8
+
9
+ 1. GitHub private security advisory
10
+ 2. Direct contact with the maintainers
11
+
12
+ Include:
13
+
14
+ - affected component or path
15
+ - reproduction steps
16
+ - impact assessment
17
+ - any proof-of-concept material needed to verify the issue
18
+
19
+ We aim to acknowledge reports within 48 hours and prioritize fixes according to impact.
20
+
21
+ ## Scope
22
+
23
+ This policy covers the repository runtime and content surfaces, including:
24
+
25
+ - the published CLI and installer under `tools/bin/`
26
+ - shared libraries under `tools/lib/`
27
+ - build and validation scripts under `tools/scripts/`
28
+ - generated catalog artifacts under `dist/`
29
+ - the API, MCP, and A2A packages under `packages/`
30
+ - skill content under `skills/`, especially when it contains shell commands, network access, credential flows, or security-sensitive guidance
31
+
32
+ ## Current Security Model
33
+
34
+ The project currently relies on these guardrails:
35
+
36
+ - skill metadata includes a `risk` field
37
+ - validation scripts inspect skill structure and metadata
38
+ - install flows use path safety checks
39
+ - local MCP sidecar writes are constrained by an allowlist
40
+ - write-oriented local tools default to dry-run behavior unless explicitly disabled
41
+ - smoke checks exercise the shipped runtime surfaces before release
42
+
43
+ ## Current Limitations
44
+
45
+ The following hardening steps are still pending:
46
+
47
+ - signed release artifacts or per-skill archives
48
+ - auth and rate limiting for hosted API or MCP deployments
49
+ - more specialized client-specific MCP config writers
50
+ - stronger remote governance around hosted catalog usage
51
+
52
+ ## Risk Levels in Skills
53
+
54
+ Each skill declares one of these `risk` levels:
55
+
56
+ - `safe`: no destructive operations expected
57
+ - `caution`: may modify files or interact with external systems
58
+ - `offensive`: security-testing or adversarial workflows that require explicit authorization
59
+ - `critical`: high-impact or system-level operations
@@ -0,0 +1,44 @@
1
+ [
2
+ {
3
+ "id": "essentials",
4
+ "name": "Essentials",
5
+ "description": "Recommended starting point for general developer workflows.",
6
+ "intended_for": "Every developer",
7
+ "skill_ids": ["find-skills", "brainstorming", "architecture", "debugging"]
8
+ },
9
+ {
10
+ "id": "full-stack",
11
+ "name": "Full-Stack",
12
+ "description": "Application design and implementation workflows.",
13
+ "intended_for": "Web and app developers",
14
+ "skill_ids": ["frontend-design", "api-design", "database-design", "omni-figma"]
15
+ },
16
+ {
17
+ "id": "security",
18
+ "name": "Security",
19
+ "description": "Security review and vulnerability-oriented workflows.",
20
+ "intended_for": "Security engineers",
21
+ "skill_ids": ["security-auditor", "vulnerability-scanner"]
22
+ },
23
+ {
24
+ "id": "devops",
25
+ "name": "DevOps",
26
+ "description": "Infrastructure and deployment workflows.",
27
+ "intended_for": "Infrastructure and platform teams",
28
+ "skill_ids": ["docker-expert", "kubernetes", "terraform"]
29
+ },
30
+ {
31
+ "id": "ai-engineer",
32
+ "name": "AI Engineer",
33
+ "description": "RAG, prompting, and AI application workflows.",
34
+ "intended_for": "LLM and ML developers",
35
+ "skill_ids": ["rag-engineer", "prompt-engineer", "llm-patterns"]
36
+ },
37
+ {
38
+ "id": "oss-maintainer",
39
+ "name": "OSS Maintainer",
40
+ "description": "Open source maintenance workflows.",
41
+ "intended_for": "Open source maintainers",
42
+ "skill_ids": ["find-skills", "create-pr", "changelog", "documentation"]
43
+ }
44
+ ]
@@ -0,0 +1,2 @@
1
+ 143d18402c2ad981eef9f53b01f2d20f413da2d04174f5775fb77903154b0854 api-design.zip
2
+ abbcbbbd879c1f6d83fa9aac78783fb6202fc715e3b24e5006c1b559a099723b api-design.tar.gz
Binary file
@@ -0,0 +1,5 @@
1
+ ͵k-6[��[�V�����GN>��$!��!l�Z��1�P!��:q�`�����#��u�V����gu��& ��J(�QRZ]�hk�������Z͈{+d�1�)��[��;�nX��G���HX
2
+ �⒆�� �n�uI$���-�b����Q[���K��o��Q�/�Y��
3
+ ?s
4
+ �A�b$�9)1�W���L�m�=+���$IK8w�2��"^�\��/)T�F�T�²\S(�,�v�6�û��i�w;,!�Q��t;w-�Z �U�Y����ɧ��N�X��B���.���6����"=�Ȃb2;!Q�9�y�?�y ����?6�sfF�4��vZ͚���*�
5
+ ���x=���/ƞQ@�]�C/Nװ�La�����36��r�'�)��AS=н��x��e>o�F�2��_D8�R��Ã}q�N4y�|
Binary file
Binary file
@@ -0,0 +1,2 @@
1
+ 3270590fa7626458f4c140dd7ba46643a549670afb571352eccb601a21f104c8 architecture.zip
2
+ b22cec8a3063abc976a1a04a3f5c432fd1ffb8020ec9b9ebb3cd0690a1d4d4dd architecture.tar.gz
@@ -0,0 +1,3 @@
1
+ �;:v�~��m��=����^k����\dF�b�L�en?k�[2O��,� ���.�\b�8�� s}TC����k�H�Ūol��EW��
2
+ �̧��E‹,��iXm����Jzu<,E�����{N�Y yN�k/~�IY->�4
3
+ �Ga�-{]X?���4Z�دu-����s1Xr��WNXu��t* �3F��zvx�#�~�%��H� *��*� �׺��6��B7`�I���#�KO�jG��px�Ū��
Binary file
@@ -0,0 +1,2 @@
1
+ 505c73e4f53d4bb1b3c6076faa8e5839ede8f29c052c36bcc33bf3ec3ddb410d brainstorming.zip
2
+ 9ffe37015b64e1934b6e3aa1f2cac29317d04cac83bdc2acf0a7c4edfd76fef6 brainstorming.tar.gz