omni-skills 0.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CODE_OF_CONDUCT.md +32 -0
- package/CONTRIBUTING.md +182 -0
- package/LICENSE +21 -0
- package/LICENSE-CONTENT +14 -0
- package/README.md +280 -0
- package/SECURITY.md +59 -0
- package/data/bundles.json +44 -0
- package/dist/archives/api-design.checksums.txt +2 -0
- package/dist/archives/api-design.checksums.txt.sig +0 -0
- package/dist/archives/api-design.tar.gz +0 -0
- package/dist/archives/api-design.tar.gz.sig +5 -0
- package/dist/archives/api-design.zip +0 -0
- package/dist/archives/api-design.zip.sig +0 -0
- package/dist/archives/architecture.checksums.txt +2 -0
- package/dist/archives/architecture.checksums.txt.sig +0 -0
- package/dist/archives/architecture.tar.gz +0 -0
- package/dist/archives/architecture.tar.gz.sig +3 -0
- package/dist/archives/architecture.zip +0 -0
- package/dist/archives/architecture.zip.sig +0 -0
- package/dist/archives/brainstorming.checksums.txt +2 -0
- package/dist/archives/brainstorming.checksums.txt.sig +1 -0
- package/dist/archives/brainstorming.tar.gz +0 -0
- package/dist/archives/brainstorming.tar.gz.sig +0 -0
- package/dist/archives/brainstorming.zip +0 -0
- package/dist/archives/brainstorming.zip.sig +0 -0
- package/dist/archives/changelog.checksums.txt +2 -0
- package/dist/archives/changelog.checksums.txt.sig +0 -0
- package/dist/archives/changelog.tar.gz +0 -0
- package/dist/archives/changelog.tar.gz.sig +0 -0
- package/dist/archives/changelog.zip +0 -0
- package/dist/archives/changelog.zip.sig +0 -0
- package/dist/archives/create-pr.checksums.txt +2 -0
- package/dist/archives/create-pr.checksums.txt.sig +0 -0
- package/dist/archives/create-pr.tar.gz +0 -0
- package/dist/archives/create-pr.tar.gz.sig +0 -0
- package/dist/archives/create-pr.zip +0 -0
- package/dist/archives/create-pr.zip.sig +0 -0
- package/dist/archives/database-design.checksums.txt +2 -0
- package/dist/archives/database-design.checksums.txt.sig +0 -0
- package/dist/archives/database-design.tar.gz +0 -0
- package/dist/archives/database-design.tar.gz.sig +0 -0
- package/dist/archives/database-design.zip +0 -0
- package/dist/archives/database-design.zip.sig +0 -0
- package/dist/archives/debugging.checksums.txt +2 -0
- package/dist/archives/debugging.checksums.txt.sig +0 -0
- package/dist/archives/debugging.tar.gz +0 -0
- package/dist/archives/debugging.tar.gz.sig +0 -0
- package/dist/archives/debugging.zip +0 -0
- package/dist/archives/debugging.zip.sig +0 -0
- package/dist/archives/documentation.checksums.txt +2 -0
- package/dist/archives/documentation.checksums.txt.sig +0 -0
- package/dist/archives/documentation.tar.gz +0 -0
- package/dist/archives/documentation.tar.gz.sig +0 -0
- package/dist/archives/documentation.zip +0 -0
- package/dist/archives/documentation.zip.sig +0 -0
- package/dist/archives/find-skills.checksums.txt +2 -0
- package/dist/archives/find-skills.checksums.txt.sig +0 -0
- package/dist/archives/find-skills.tar.gz +0 -0
- package/dist/archives/find-skills.tar.gz.sig +1 -0
- package/dist/archives/find-skills.zip +0 -0
- package/dist/archives/find-skills.zip.sig +0 -0
- package/dist/archives/frontend-design.checksums.txt +2 -0
- package/dist/archives/frontend-design.checksums.txt.sig +0 -0
- package/dist/archives/frontend-design.tar.gz +0 -0
- package/dist/archives/frontend-design.tar.gz.sig +0 -0
- package/dist/archives/frontend-design.zip +0 -0
- package/dist/archives/frontend-design.zip.sig +0 -0
- package/dist/archives/omni-figma.checksums.txt +2 -0
- package/dist/archives/omni-figma.checksums.txt.sig +0 -0
- package/dist/archives/omni-figma.tar.gz +0 -0
- package/dist/archives/omni-figma.tar.gz.sig +0 -0
- package/dist/archives/omni-figma.zip +0 -0
- package/dist/archives/omni-figma.zip.sig +0 -0
- package/dist/archives/security-auditor.checksums.txt +2 -0
- package/dist/archives/security-auditor.checksums.txt.sig +3 -0
- package/dist/archives/security-auditor.tar.gz +0 -0
- package/dist/archives/security-auditor.tar.gz.sig +0 -0
- package/dist/archives/security-auditor.zip +0 -0
- package/dist/archives/security-auditor.zip.sig +0 -0
- package/dist/archives/vulnerability-scanner.checksums.txt +2 -0
- package/dist/archives/vulnerability-scanner.checksums.txt.sig +0 -0
- package/dist/archives/vulnerability-scanner.tar.gz +0 -0
- package/dist/archives/vulnerability-scanner.tar.gz.sig +2 -0
- package/dist/archives/vulnerability-scanner.zip +0 -0
- package/dist/archives/vulnerability-scanner.zip.sig +0 -0
- package/dist/bundles.json +135 -0
- package/dist/catalog.json +645 -0
- package/dist/manifests/api-design.json +294 -0
- package/dist/manifests/architecture.json +293 -0
- package/dist/manifests/brainstorming.json +293 -0
- package/dist/manifests/changelog.json +293 -0
- package/dist/manifests/create-pr.json +293 -0
- package/dist/manifests/database-design.json +293 -0
- package/dist/manifests/debugging.json +293 -0
- package/dist/manifests/documentation.json +293 -0
- package/dist/manifests/find-skills.json +303 -0
- package/dist/manifests/frontend-design.json +294 -0
- package/dist/manifests/omni-figma.json +314 -0
- package/dist/manifests/security-auditor.json +293 -0
- package/dist/manifests/vulnerability-scanner.json +294 -0
- package/dist/signing/omni-skills-public.pem +14 -0
- package/docs/CATALOG.md +74 -0
- package/docs/README.md +206 -0
- package/docs/architecture/adr-0001-agent-native-workspace.md +82 -0
- package/docs/architecture/agent-native-roadmap.md +196 -0
- package/docs/architecture/codebase-analysis.md +275 -0
- package/docs/contributors/quality-bar.md +72 -0
- package/docs/contributors/skill-anatomy.md +120 -0
- package/docs/contributors/skill-template.md +104 -0
- package/docs/operations/runbook.md +485 -0
- package/docs/specs/catalog-api.md +178 -0
- package/docs/specs/local-mcp-sidecar.md +219 -0
- package/docs/specs/security-validation.md +179 -0
- package/docs/specs/skill-classification.md +195 -0
- package/docs/specs/skill-manifest.md +220 -0
- package/docs/users/bundles.md +93 -0
- package/docs/users/getting-started.md +151 -0
- package/docs/users/usage.md +187 -0
- package/metadata.json +323 -0
- package/package.json +101 -0
- package/packages/catalog-core/src/index.js +828 -0
- package/packages/server-a2a/src/server.js +138 -0
- package/packages/server-a2a/src/task-runtime.js +1134 -0
- package/packages/server-api/src/http-runtime.js +141 -0
- package/packages/server-api/src/server.js +246 -0
- package/packages/server-mcp/src/local-sidecar.js +822 -0
- package/packages/server-mcp/src/server.js +684 -0
- package/skills/api-design/SKILL.md +109 -0
- package/skills/api-design/metadata.json +129 -0
- package/skills/architecture/SKILL.md +109 -0
- package/skills/architecture/metadata.json +128 -0
- package/skills/brainstorming/SKILL.md +109 -0
- package/skills/brainstorming/metadata.json +128 -0
- package/skills/changelog/SKILL.md +105 -0
- package/skills/changelog/metadata.json +128 -0
- package/skills/create-pr/SKILL.md +105 -0
- package/skills/create-pr/metadata.json +128 -0
- package/skills/database-design/SKILL.md +109 -0
- package/skills/database-design/metadata.json +128 -0
- package/skills/debugging/SKILL.md +109 -0
- package/skills/debugging/metadata.json +128 -0
- package/skills/documentation/SKILL.md +109 -0
- package/skills/documentation/metadata.json +128 -0
- package/skills/find-skills/SKILL.md +108 -0
- package/skills/find-skills/agents/openai.yaml +4 -0
- package/skills/find-skills/metadata.json +133 -0
- package/skills/frontend-design/SKILL.md +109 -0
- package/skills/frontend-design/metadata.json +129 -0
- package/skills/omni-figma/LICENSE.txt +2 -0
- package/skills/omni-figma/SKILL.md +97 -0
- package/skills/omni-figma/agents/openai.yaml +12 -0
- package/skills/omni-figma/assets/figma-small.svg +3 -0
- package/skills/omni-figma/assets/figma.png +0 -0
- package/skills/omni-figma/assets/icon.svg +28 -0
- package/skills/omni-figma/metadata.json +139 -0
- package/skills/omni-figma/references/figma-best-practices-2026.md +67 -0
- package/skills/omni-figma/references/mcp-setup-and-troubleshooting.md +89 -0
- package/skills/omni-figma/references/tool-routing-and-prompts.md +78 -0
- package/skills/security-auditor/SKILL.md +118 -0
- package/skills/security-auditor/metadata.json +128 -0
- package/skills/vulnerability-scanner/SKILL.md +131 -0
- package/skills/vulnerability-scanner/metadata.json +129 -0
- package/tools/bin/cli.js +1189 -0
- package/tools/bin/install.js +403 -0
- package/tools/lib/catalog-client.js +112 -0
- package/tools/lib/symlink-safety.js +23 -0
- package/tools/scripts/build_catalog.js +97 -0
- package/tools/scripts/generate_index.py +660 -0
- package/tools/scripts/generate_release_notes.py +163 -0
- package/tools/scripts/install_githooks.js +18 -0
- package/tools/scripts/recategorize_skills.py +125 -0
- package/tools/scripts/skill_metadata.py +1650 -0
- package/tools/scripts/tests/run_tests.js +1057 -0
- package/tools/scripts/validate_skills.py +130 -0
- package/tools/scripts/verify_archives.py +175 -0
- package/tools/scripts/verify_security_scanners.py +125 -0
|
@@ -0,0 +1,32 @@
|
|
|
1
|
+
# Contributor Covenant Code of Conduct
|
|
2
|
+
|
|
3
|
+
## Our Pledge
|
|
4
|
+
|
|
5
|
+
We as members, contributors, and maintainers pledge to make participation in this project and community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, caste, color, religion, or sexual identity and orientation.
|
|
6
|
+
|
|
7
|
+
## Our Standards
|
|
8
|
+
|
|
9
|
+
Examples of behavior that contributes to a positive environment:
|
|
10
|
+
|
|
11
|
+
- using welcoming and inclusive language
|
|
12
|
+
- being respectful of differing viewpoints and experiences
|
|
13
|
+
- accepting constructive criticism
|
|
14
|
+
- focusing on what is best for the project and community
|
|
15
|
+
- showing empathy toward other community members
|
|
16
|
+
|
|
17
|
+
Examples of unacceptable behavior:
|
|
18
|
+
|
|
19
|
+
- sexualized language or imagery, and sexual attention or advances
|
|
20
|
+
- trolling, insulting, or derogatory comments
|
|
21
|
+
- personal or political attacks
|
|
22
|
+
- public or private harassment
|
|
23
|
+
- publishing someone else's private information without explicit permission
|
|
24
|
+
- other conduct that could reasonably be considered inappropriate in a professional setting
|
|
25
|
+
|
|
26
|
+
## Enforcement
|
|
27
|
+
|
|
28
|
+
Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the maintainers. Reports will be reviewed and investigated promptly and fairly.
|
|
29
|
+
|
|
30
|
+
## Attribution
|
|
31
|
+
|
|
32
|
+
This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org), version 2.1.
|
package/CONTRIBUTING.md
ADDED
|
@@ -0,0 +1,182 @@
|
|
|
1
|
+
# Contributing to Omni Skills
|
|
2
|
+
|
|
3
|
+
Omni Skills now contains both a skill catalog and the runtime surfaces built on top of that catalog. Contributions can target either area, but both must stay aligned with the generated artifacts and the current CLI behavior.
|
|
4
|
+
|
|
5
|
+
## Before You Start
|
|
6
|
+
|
|
7
|
+
- Skills are authored in `skills/<skill-name>/SKILL.md`.
|
|
8
|
+
- Contributor templates and guidance live in `docs/contributors/`.
|
|
9
|
+
- Runtime and architecture docs live in `docs/`.
|
|
10
|
+
- Repository-standard community files live in the root: `README.md`, `CONTRIBUTING.md`, `SECURITY.md`, and `CODE_OF_CONDUCT.md`.
|
|
11
|
+
|
|
12
|
+
## Common Contribution Types
|
|
13
|
+
|
|
14
|
+
- Add or improve a skill under `skills/`
|
|
15
|
+
- Update contributor guidance under `docs/contributors/`
|
|
16
|
+
- Improve the CLI, installer, or generation scripts under `tools/`
|
|
17
|
+
- Improve the shared catalog runtime or the API, MCP, and A2A packages under `packages/`
|
|
18
|
+
- Tighten tests, smoke checks, packaging, or release docs
|
|
19
|
+
|
|
20
|
+
## Quick Start
|
|
21
|
+
|
|
22
|
+
```bash
|
|
23
|
+
# 1. Fork and clone
|
|
24
|
+
git clone https://github.com/YOUR-USERNAME/omni-skills.git
|
|
25
|
+
cd omni-skills
|
|
26
|
+
|
|
27
|
+
# 2. Install dependencies
|
|
28
|
+
npm install
|
|
29
|
+
npm run hooks:install # optional, enables the repo pre-commit hook
|
|
30
|
+
|
|
31
|
+
# 3. Create or update your change
|
|
32
|
+
# Example: create a new skill
|
|
33
|
+
mkdir -p skills/my-awesome-skill
|
|
34
|
+
cp docs/contributors/skill-template.md skills/my-awesome-skill/SKILL.md
|
|
35
|
+
|
|
36
|
+
# 4. Validate and regenerate artifacts
|
|
37
|
+
npm run build
|
|
38
|
+
|
|
39
|
+
# 5. Run the smoke suite
|
|
40
|
+
npm test
|
|
41
|
+
npm run smoke
|
|
42
|
+
```
|
|
43
|
+
|
|
44
|
+
Open the PR with `Allow edits from maintainers` enabled.
|
|
45
|
+
|
|
46
|
+
## Skill Contributions
|
|
47
|
+
|
|
48
|
+
A good skill should:
|
|
49
|
+
|
|
50
|
+
- solve a specific problem cleanly
|
|
51
|
+
- be reusable across projects
|
|
52
|
+
- include instructions an agent can actually follow
|
|
53
|
+
- avoid vague or redundant content
|
|
54
|
+
- declare accurate frontmatter and compatibility metadata
|
|
55
|
+
- land with generated `metadata.json` classification artifacts
|
|
56
|
+
|
|
57
|
+
Minimal structure:
|
|
58
|
+
|
|
59
|
+
```text
|
|
60
|
+
skills/my-skill/
|
|
61
|
+
└── SKILL.md
|
|
62
|
+
```
|
|
63
|
+
|
|
64
|
+
Larger skills can also include:
|
|
65
|
+
|
|
66
|
+
```text
|
|
67
|
+
skills/my-skill/
|
|
68
|
+
├── SKILL.md
|
|
69
|
+
├── agents/
|
|
70
|
+
├── assets/
|
|
71
|
+
├── references/
|
|
72
|
+
└── LICENSE.txt
|
|
73
|
+
```
|
|
74
|
+
|
|
75
|
+
## Required Validation
|
|
76
|
+
|
|
77
|
+
Before opening a PR, run:
|
|
78
|
+
|
|
79
|
+
```bash
|
|
80
|
+
npm run validate
|
|
81
|
+
npm run taxonomy:report
|
|
82
|
+
npm run build
|
|
83
|
+
npm test
|
|
84
|
+
```
|
|
85
|
+
|
|
86
|
+
`npm run validate` now also regenerates:
|
|
87
|
+
|
|
88
|
+
- `metadata.json`
|
|
89
|
+
- `skills/<skill>/metadata.json`
|
|
90
|
+
|
|
91
|
+
It also computes:
|
|
92
|
+
|
|
93
|
+
- canonical taxonomy mapping
|
|
94
|
+
- maturity, best practices, quality, and security scores
|
|
95
|
+
- static security findings
|
|
96
|
+
- optional ClamAV and VirusTotal scanner status when configured
|
|
97
|
+
|
|
98
|
+
For a release-grade preflight, also run:
|
|
99
|
+
|
|
100
|
+
```bash
|
|
101
|
+
npm run smoke
|
|
102
|
+
```
|
|
103
|
+
|
|
104
|
+
That smoke pass currently validates:
|
|
105
|
+
|
|
106
|
+
- skill validation
|
|
107
|
+
- catalog generation
|
|
108
|
+
- docs catalog generation
|
|
109
|
+
- test suite
|
|
110
|
+
- `npm pack --dry-run`
|
|
111
|
+
- API boot
|
|
112
|
+
- MCP boot in `stdio`, `stream`, and `sse`
|
|
113
|
+
- A2A boot
|
|
114
|
+
|
|
115
|
+
## Skill Frontmatter
|
|
116
|
+
|
|
117
|
+
Every skill must include YAML frontmatter. Use [docs/contributors/skill-template.md](docs/contributors/skill-template.md) as the baseline and keep the `name` aligned with the directory slug.
|
|
118
|
+
|
|
119
|
+
```yaml
|
|
120
|
+
---
|
|
121
|
+
name: my-skill-name
|
|
122
|
+
description: "What it does"
|
|
123
|
+
version: "0.0.1"
|
|
124
|
+
category: development
|
|
125
|
+
tags: [react, typescript]
|
|
126
|
+
complexity: intermediate
|
|
127
|
+
risk: safe
|
|
128
|
+
tools: [claude-code, cursor]
|
|
129
|
+
source: community
|
|
130
|
+
author: "Your Name"
|
|
131
|
+
date_added: "2026-03-26"
|
|
132
|
+
date_updated: "2026-03-26"
|
|
133
|
+
---
|
|
134
|
+
```
|
|
135
|
+
|
|
136
|
+
Use canonical categories in new skills. Current taxonomy:
|
|
137
|
+
|
|
138
|
+
- `development`
|
|
139
|
+
- `frontend`
|
|
140
|
+
- `backend`
|
|
141
|
+
- `fullstack-web`
|
|
142
|
+
- `tools`
|
|
143
|
+
- `cli-automation`
|
|
144
|
+
- `business`
|
|
145
|
+
- `product`
|
|
146
|
+
- `design`
|
|
147
|
+
- `data-ai`
|
|
148
|
+
- `ai-agents`
|
|
149
|
+
- `machine-learning`
|
|
150
|
+
- `devops`
|
|
151
|
+
- `testing-security`
|
|
152
|
+
- `documentation`
|
|
153
|
+
- `content-media`
|
|
154
|
+
- `communication`
|
|
155
|
+
- `uncategorized`
|
|
156
|
+
|
|
157
|
+
## Runtime Contributions
|
|
158
|
+
|
|
159
|
+
If you touch `packages/`, `tools/bin/`, `tools/lib/`, or build scripts:
|
|
160
|
+
|
|
161
|
+
- keep `dist/` and docs aligned with the implementation
|
|
162
|
+
- prefer reusing `packages/catalog-core` instead of duplicating catalog logic
|
|
163
|
+
- keep local-write behavior behind preview or dry-run defaults
|
|
164
|
+
- treat security scanner warnings as part of the review bar for new skills and scripts
|
|
165
|
+
- update tests when changing CLI commands, transport modes, or public endpoints
|
|
166
|
+
|
|
167
|
+
## Commit Conventions
|
|
168
|
+
|
|
169
|
+
Common prefixes:
|
|
170
|
+
|
|
171
|
+
- `feat:` new skill or feature
|
|
172
|
+
- `fix:` bug fix
|
|
173
|
+
- `docs:` documentation changes
|
|
174
|
+
- `refactor:` code cleanup or structure changes
|
|
175
|
+
- `test:` test changes
|
|
176
|
+
- `chore:` maintenance
|
|
177
|
+
|
|
178
|
+
## Need Help?
|
|
179
|
+
|
|
180
|
+
- Questions: open a [Discussion](https://github.com/diegosouzapw/omni-skills/discussions)
|
|
181
|
+
- Bugs: open an [Issue](https://github.com/diegosouzapw/omni-skills/issues)
|
|
182
|
+
- Early feedback: open a [Draft PR](https://github.com/diegosouzapw/omni-skills/pulls)
|
package/LICENSE
ADDED
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2026 Omni Skills Team
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
package/LICENSE-CONTENT
ADDED
|
@@ -0,0 +1,14 @@
|
|
|
1
|
+
Creative Commons Attribution 4.0 International (CC BY 4.0)
|
|
2
|
+
|
|
3
|
+
Original documentation and non-code content in this repository is licensed
|
|
4
|
+
under CC BY 4.0, unless a more specific upstream license applies.
|
|
5
|
+
|
|
6
|
+
You are free to:
|
|
7
|
+
- Share — copy and redistribute the material in any medium or format
|
|
8
|
+
- Adapt — remix, transform, and build upon the material for any purpose
|
|
9
|
+
|
|
10
|
+
Under the following terms:
|
|
11
|
+
- Attribution — You must give appropriate credit, provide a link to the
|
|
12
|
+
license, and indicate if changes were made.
|
|
13
|
+
|
|
14
|
+
Full license text: https://creativecommons.org/licenses/by/4.0/legalcode
|
package/README.md
ADDED
|
@@ -0,0 +1,280 @@
|
|
|
1
|
+
<!-- omni-skills: version=0.0.1; skills=13; updated_at=2026-03-26 -->
|
|
2
|
+
# 🧠 Omni Skills — Agent-Native Skill Catalog and Runtime
|
|
3
|
+
|
|
4
|
+
> **Curated AI coding skills plus a unified runtime for CLI install, catalog API, MCP, and A2A.**
|
|
5
|
+
> Skills are still authored as `SKILL.md`, but the repository now also ships the machine-readable catalog and protocol surfaces agents need to discover, preview, and install them.
|
|
6
|
+
|
|
7
|
+
[](LICENSE)
|
|
8
|
+
[](LICENSE-CONTENT)
|
|
9
|
+
[](https://www.npmjs.com/package/omni-skills)
|
|
10
|
+
[](#quick-start)
|
|
11
|
+
[](#-runtime-surfaces)
|
|
12
|
+
[](#-runtime-surfaces)
|
|
13
|
+
[](#-runtime-surfaces)
|
|
14
|
+
|
|
15
|
+
---
|
|
16
|
+
|
|
17
|
+
## ✨ What Omni Skills Is Now
|
|
18
|
+
|
|
19
|
+
Omni Skills is no longer only an installer.
|
|
20
|
+
|
|
21
|
+
- 📦 **Unified package**: the published `omni-skills` binary now handles install, diagnostics, MCP, API, A2A, and release smoke checks.
|
|
22
|
+
- 🖥️ **Operator-friendly CLI**: the package exposes `doctor`, `ui`, `smoke`, and `publish-check` in the same binary.
|
|
23
|
+
- 🔎 **Catalog discovery**: `npx omni-skills find <query>` now searches the published catalog and suggests install commands.
|
|
24
|
+
- 🧭 **Shared catalog contract**: `skills_index.json`, `dist/catalog.json`, `dist/bundles.json`, and `dist/manifests/*.json` drive the runtime.
|
|
25
|
+
- 🧪 **Skill classification**: validation now parses frontmatter, normalizes categories to a canonical taxonomy, and computes maturity level, best practices, and quality scores.
|
|
26
|
+
- 🛡️ **Security validation**: the validator now runs a static content and script scanner, emits security scores, and can optionally enrich results with ClamAV and VirusTotal hash lookups.
|
|
27
|
+
- 🎯 **Selective install**: `--skill` and `--bundle` now install only the relevant published artifacts.
|
|
28
|
+
- 📦 **Per-skill archives**: the build now emits `zip`, `tar.gz`, and checksum manifests per skill, with detached signatures when signing keys are configured.
|
|
29
|
+
- 🔌 **Protocol-native runtime**: the repo ships a read-only HTTP API, an MCP server with three transports, and an A2A runtime with task lifecycle, SSE streaming, cancelation, push notification hooks, and file-backed restart recovery.
|
|
30
|
+
- 🛠️ **Local sidecar mode**: MCP local mode can detect clients, preview writes, install or remove skills, and write client-aware MCP configs under an allowlist.
|
|
31
|
+
- 🔐 **Hosted hardening**: API and MCP HTTP transports now support optional bearer/API-key auth, in-memory rate limiting, and audit logging.
|
|
32
|
+
- 🚢 **Release automation**: GitHub Actions now verifies version tags, runs ClamAV and VirusTotal-gated release builds, requires detached archive signing in CI, publishes the exact tarball to npm, and creates a GitHub Release with custom notes.
|
|
33
|
+
- ✅ **Release preflight**: `smoke` and `publish-check` validate build output, tests, package contents, service boots, and scanner coverage.
|
|
34
|
+
|
|
35
|
+
---
|
|
36
|
+
|
|
37
|
+
## 📌 Current Status
|
|
38
|
+
|
|
39
|
+
The runtime foundation is in place and the public catalog is now broad enough to back the main starter bundles with real skills.
|
|
40
|
+
|
|
41
|
+
- Published skills currently available: **13**
|
|
42
|
+
- Current published skills: `api-design`, `architecture`, `brainstorming`, `changelog`, `create-pr`, `database-design`, `debugging`, `documentation`, `find-skills`, `frontend-design`, `omni-figma`, `security-auditor`, and `vulnerability-scanner`
|
|
43
|
+
- Fully backed bundles: **`essentials`**, **`full-stack`**, **`security`**, and **`oss-maintainer`**
|
|
44
|
+
- Roadmap-heavy bundles still pending publication: **`devops`** and **`ai-engineer`**
|
|
45
|
+
|
|
46
|
+
The docs below reflect that split directly: four bundles are installable end-to-end today, while the remaining domain bundles still surface warnings for unpublished members.
|
|
47
|
+
|
|
48
|
+
---
|
|
49
|
+
|
|
50
|
+
## 🚀 Quick Start
|
|
51
|
+
|
|
52
|
+
### Install the default target
|
|
53
|
+
|
|
54
|
+
```bash
|
|
55
|
+
npx omni-skills
|
|
56
|
+
```
|
|
57
|
+
|
|
58
|
+
### Install the published skill into a specific client
|
|
59
|
+
|
|
60
|
+
```bash
|
|
61
|
+
npx omni-skills --cursor --skill omni-figma
|
|
62
|
+
```
|
|
63
|
+
|
|
64
|
+
### Search the catalog before installing
|
|
65
|
+
|
|
66
|
+
```bash
|
|
67
|
+
npx omni-skills find figma
|
|
68
|
+
npx omni-skills find discovery --tool codex-cli
|
|
69
|
+
npx omni-skills find mcp --sort quality --min-quality 80 --min-security 90
|
|
70
|
+
npx omni-skills find figma --tool cursor --install --yes
|
|
71
|
+
npx omni-skills find foundation --bundle essentials --install --yes
|
|
72
|
+
|
|
73
|
+
# Audit taxonomy drift and optionally rewrite SKILL.md categories
|
|
74
|
+
npx omni-skills recategorize
|
|
75
|
+
npx omni-skills recategorize --write
|
|
76
|
+
```
|
|
77
|
+
|
|
78
|
+
### Start the local MCP sidecar
|
|
79
|
+
|
|
80
|
+
```bash
|
|
81
|
+
npx omni-skills mcp stream --local
|
|
82
|
+
```
|
|
83
|
+
|
|
84
|
+
### Start the catalog API and A2A surface
|
|
85
|
+
|
|
86
|
+
```bash
|
|
87
|
+
npx omni-skills api --port 3333
|
|
88
|
+
npx omni-skills a2a --port 3335
|
|
89
|
+
```
|
|
90
|
+
|
|
91
|
+
### Run the release preflight
|
|
92
|
+
|
|
93
|
+
```bash
|
|
94
|
+
npx omni-skills smoke
|
|
95
|
+
npx omni-skills publish-check
|
|
96
|
+
```
|
|
97
|
+
|
|
98
|
+
### Publish a release through GitHub Actions
|
|
99
|
+
|
|
100
|
+
```bash
|
|
101
|
+
npm version patch
|
|
102
|
+
git push origin main --follow-tags
|
|
103
|
+
```
|
|
104
|
+
|
|
105
|
+
The `v*` tag workflow rebuilds the release with required antivirus gates, signs archives in CI, publishes the verified tarball to npm, and creates a GitHub Release with custom notes plus attached verification assets.
|
|
106
|
+
|
|
107
|
+
---
|
|
108
|
+
|
|
109
|
+
## 🔌 Runtime Surfaces
|
|
110
|
+
|
|
111
|
+
| Surface | Status | What it does | Example |
|
|
112
|
+
| :------ | :----- | :----------- | :------ |
|
|
113
|
+
| **CLI** | Implemented | Find and install skills, run diagnostics, open the terminal UI, boot services, run smoke checks | `npx omni-skills doctor` |
|
|
114
|
+
| **Catalog API** | Implemented | Read-only catalog, search, bundles, install plans, artifact downloads | `npx omni-skills api --port 3333` |
|
|
115
|
+
| **MCP** | Implemented | Discovery, recommendation, install preview, optional local sidecar mode | `npx omni-skills mcp stream --local` |
|
|
116
|
+
| **A2A** | Implemented | Task-aware discovery, install-plan handoff, polling, streaming, cancelation, and push notifications | `npx omni-skills a2a --port 3335` |
|
|
117
|
+
|
|
118
|
+
### MCP Transports
|
|
119
|
+
|
|
120
|
+
The MCP runtime supports:
|
|
121
|
+
|
|
122
|
+
- `stdio`
|
|
123
|
+
- `stream`
|
|
124
|
+
- `sse`
|
|
125
|
+
|
|
126
|
+
Examples:
|
|
127
|
+
|
|
128
|
+
```bash
|
|
129
|
+
npx omni-skills mcp stdio
|
|
130
|
+
npx omni-skills mcp stream
|
|
131
|
+
npx omni-skills mcp sse
|
|
132
|
+
```
|
|
133
|
+
|
|
134
|
+
### Generated Catalog Artifacts
|
|
135
|
+
|
|
136
|
+
The build pipeline emits:
|
|
137
|
+
|
|
138
|
+
- `metadata.json`
|
|
139
|
+
- `skills_index.json`
|
|
140
|
+
- `dist/catalog.json`
|
|
141
|
+
- `dist/bundles.json`
|
|
142
|
+
- `dist/manifests/<skill>.json`
|
|
143
|
+
- `dist/archives/<skill>.zip`
|
|
144
|
+
- `dist/archives/<skill>.tar.gz`
|
|
145
|
+
- `dist/archives/<skill>.checksums.txt`
|
|
146
|
+
- `skills/<skill>/metadata.json`
|
|
147
|
+
|
|
148
|
+
These generated artifacts are the shared source of truth for CLI, API, MCP, and A2A behavior.
|
|
149
|
+
|
|
150
|
+
Each skill also gets a generated `skills/<skill>/metadata.json` with:
|
|
151
|
+
|
|
152
|
+
- canonical taxonomy classification
|
|
153
|
+
- maturity level (`L1`/`L2`/`L3`)
|
|
154
|
+
- best practices score (`0-100`)
|
|
155
|
+
- quality score (`0-100`)
|
|
156
|
+
- security score (`0-100`)
|
|
157
|
+
- static security findings plus optional ClamAV and VirusTotal scanner status
|
|
158
|
+
- validation status and supporting metadata
|
|
159
|
+
|
|
160
|
+
---
|
|
161
|
+
|
|
162
|
+
## 📦 Catalog Reality
|
|
163
|
+
|
|
164
|
+
The current generated catalog contains:
|
|
165
|
+
|
|
166
|
+
- `13` published skills in `dist/catalog.json`
|
|
167
|
+
- installable skill bundles for planning, download, MCP, and A2A handoff
|
|
168
|
+
- curated bundle definitions in `dist/bundles.json`
|
|
169
|
+
|
|
170
|
+
Current bundle availability:
|
|
171
|
+
|
|
172
|
+
| Bundle | Available now | Notes |
|
|
173
|
+
| :----- | :------------ | :---- |
|
|
174
|
+
| `essentials` | `4/4` | `find-skills`, `brainstorming`, `architecture`, `debugging` |
|
|
175
|
+
| `full-stack` | `4/4` | `frontend-design`, `api-design`, `database-design`, `omni-figma` |
|
|
176
|
+
| `security` | `2/2` | `security-auditor`, `vulnerability-scanner` |
|
|
177
|
+
| `devops` | `0/3` | Metadata only for now |
|
|
178
|
+
| `ai-engineer` | `0/3` | Metadata only for now |
|
|
179
|
+
| `oss-maintainer` | `4/4` | `find-skills`, `create-pr`, `changelog`, `documentation` |
|
|
180
|
+
|
|
181
|
+
This is why `--bundle` is already useful both for real installs and for roadmap-aware planning. Four bundles install cleanly today, and the remaining two still surface warnings for unpublished members.
|
|
182
|
+
|
|
183
|
+
---
|
|
184
|
+
|
|
185
|
+
## 🧭 Documentation Map
|
|
186
|
+
|
|
187
|
+
### Start Here
|
|
188
|
+
|
|
189
|
+
- [Documentation Hub](docs/README.md)
|
|
190
|
+
- [Getting Started](docs/users/getting-started.md)
|
|
191
|
+
- [Usage Guide](docs/users/usage.md)
|
|
192
|
+
- [Bundles](docs/users/bundles.md)
|
|
193
|
+
- [Catalog](docs/CATALOG.md)
|
|
194
|
+
- [System Runbook](docs/operations/runbook.md)
|
|
195
|
+
|
|
196
|
+
### Architecture and Specs
|
|
197
|
+
|
|
198
|
+
- [Agent-Native Roadmap](docs/architecture/agent-native-roadmap.md)
|
|
199
|
+
- [ADR-0001: Agent-Native Workspace Foundation](docs/architecture/adr-0001-agent-native-workspace.md)
|
|
200
|
+
- [Catalog API Surface](docs/specs/catalog-api.md)
|
|
201
|
+
- [Local MCP Sidecar](docs/specs/local-mcp-sidecar.md)
|
|
202
|
+
- [Skill Classification and Metadata](docs/specs/skill-classification.md)
|
|
203
|
+
- [Security Validation and Distribution](docs/specs/security-validation.md)
|
|
204
|
+
- [Skill Manifest Specification](docs/specs/skill-manifest.md)
|
|
205
|
+
|
|
206
|
+
### Community and Contribution
|
|
207
|
+
|
|
208
|
+
- [Contributing Guide](CONTRIBUTING.md)
|
|
209
|
+
- [Security Policy](SECURITY.md)
|
|
210
|
+
- [Code of Conduct](CODE_OF_CONDUCT.md)
|
|
211
|
+
- [Skill Template](docs/contributors/skill-template.md)
|
|
212
|
+
- [Skill Anatomy](docs/contributors/skill-anatomy.md)
|
|
213
|
+
- [Quality Bar](docs/contributors/quality-bar.md)
|
|
214
|
+
|
|
215
|
+
---
|
|
216
|
+
|
|
217
|
+
## 🗂️ Repository Layout
|
|
218
|
+
|
|
219
|
+
| Path | Purpose |
|
|
220
|
+
| :--- | :------ |
|
|
221
|
+
| `skills/` | Canonical authored skills |
|
|
222
|
+
| `docs/` | User, contributor, architecture, and spec documentation |
|
|
223
|
+
| `docs/operations/` | Operational runbooks and deployment workflows |
|
|
224
|
+
| `dist/` | Generated machine-readable catalog and manifests |
|
|
225
|
+
| `packages/catalog-core/` | Shared catalog runtime |
|
|
226
|
+
| `packages/server-api/` | Read-only HTTP API |
|
|
227
|
+
| `packages/server-mcp/` | MCP server with local sidecar mode |
|
|
228
|
+
| `packages/server-a2a/` | A2A server with task runtime, SSE streaming, and push config |
|
|
229
|
+
| `tools/bin/` | Published CLI entrypoints |
|
|
230
|
+
| `tools/lib/` | Shared installer libraries |
|
|
231
|
+
| `tools/scripts/` | Validation, generation, tests, and catalog build scripts |
|
|
232
|
+
|
|
233
|
+
---
|
|
234
|
+
|
|
235
|
+
## 🧪 Validation and Release Checks
|
|
236
|
+
|
|
237
|
+
Recommended local preflight:
|
|
238
|
+
|
|
239
|
+
```bash
|
|
240
|
+
npm run smoke
|
|
241
|
+
```
|
|
242
|
+
|
|
243
|
+
The smoke run currently validates:
|
|
244
|
+
|
|
245
|
+
- skill validation
|
|
246
|
+
- security scanner verification
|
|
247
|
+
- taxonomy recategorization tooling
|
|
248
|
+
- catalog generation
|
|
249
|
+
- generated catalog markdown
|
|
250
|
+
- automated tests
|
|
251
|
+
- `npm pack --dry-run`
|
|
252
|
+
- API boot
|
|
253
|
+
- MCP boot in `stdio`, `stream`, and `sse`
|
|
254
|
+
- A2A boot, polling, streaming, cancelation, and push-config lifecycle
|
|
255
|
+
|
|
256
|
+
Tag-based release automation now also validates:
|
|
257
|
+
|
|
258
|
+
- Git tag version matches `package.json`
|
|
259
|
+
- ClamAV scanning is enabled and completed for every skill
|
|
260
|
+
- VirusTotal hash lookup is enabled and completed for every skill
|
|
261
|
+
- archive signatures are required and verified in CI
|
|
262
|
+
- the exact verified tarball is what gets published to npm
|
|
263
|
+
- a GitHub Release is created automatically with custom notes and attached catalog or checksum artifacts
|
|
264
|
+
|
|
265
|
+
---
|
|
266
|
+
|
|
267
|
+
## 🛣️ What Is Still Pending
|
|
268
|
+
|
|
269
|
+
- stronger governance for hosted API or remote MCP deployments beyond the current auth, rate limit, and audit-log baseline
|
|
270
|
+
- broader client coverage and export recipes beyond the current known JSON and TOML MCP config targets
|
|
271
|
+
- external executor integration and stronger multi-node durability beyond the current file-backed A2A store
|
|
272
|
+
- expansion of the public catalog for the remaining roadmap bundles: `devops` and `ai-engineer`
|
|
273
|
+
|
|
274
|
+
---
|
|
275
|
+
|
|
276
|
+
## ⚖️ License
|
|
277
|
+
|
|
278
|
+
Code and tooling are licensed under the [MIT License](LICENSE).
|
|
279
|
+
|
|
280
|
+
Documentation and skill content are licensed under [CC BY 4.0](LICENSE-CONTENT).
|
package/SECURITY.md
ADDED
|
@@ -0,0 +1,59 @@
|
|
|
1
|
+
# Security Policy
|
|
2
|
+
|
|
3
|
+
## Reporting a Vulnerability
|
|
4
|
+
|
|
5
|
+
If you discover a security issue in Omni Skills, do not open a public issue first.
|
|
6
|
+
|
|
7
|
+
Please report it through one of these private channels:
|
|
8
|
+
|
|
9
|
+
1. GitHub private security advisory
|
|
10
|
+
2. Direct contact with the maintainers
|
|
11
|
+
|
|
12
|
+
Include:
|
|
13
|
+
|
|
14
|
+
- affected component or path
|
|
15
|
+
- reproduction steps
|
|
16
|
+
- impact assessment
|
|
17
|
+
- any proof-of-concept material needed to verify the issue
|
|
18
|
+
|
|
19
|
+
We aim to acknowledge reports within 48 hours and prioritize fixes according to impact.
|
|
20
|
+
|
|
21
|
+
## Scope
|
|
22
|
+
|
|
23
|
+
This policy covers the repository runtime and content surfaces, including:
|
|
24
|
+
|
|
25
|
+
- the published CLI and installer under `tools/bin/`
|
|
26
|
+
- shared libraries under `tools/lib/`
|
|
27
|
+
- build and validation scripts under `tools/scripts/`
|
|
28
|
+
- generated catalog artifacts under `dist/`
|
|
29
|
+
- the API, MCP, and A2A packages under `packages/`
|
|
30
|
+
- skill content under `skills/`, especially when it contains shell commands, network access, credential flows, or security-sensitive guidance
|
|
31
|
+
|
|
32
|
+
## Current Security Model
|
|
33
|
+
|
|
34
|
+
The project currently relies on these guardrails:
|
|
35
|
+
|
|
36
|
+
- skill metadata includes a `risk` field
|
|
37
|
+
- validation scripts inspect skill structure and metadata
|
|
38
|
+
- install flows use path safety checks
|
|
39
|
+
- local MCP sidecar writes are constrained by an allowlist
|
|
40
|
+
- write-oriented local tools default to dry-run behavior unless explicitly disabled
|
|
41
|
+
- smoke checks exercise the shipped runtime surfaces before release
|
|
42
|
+
|
|
43
|
+
## Current Limitations
|
|
44
|
+
|
|
45
|
+
The following hardening steps are still pending:
|
|
46
|
+
|
|
47
|
+
- signed release artifacts or per-skill archives
|
|
48
|
+
- auth and rate limiting for hosted API or MCP deployments
|
|
49
|
+
- more specialized client-specific MCP config writers
|
|
50
|
+
- stronger remote governance around hosted catalog usage
|
|
51
|
+
|
|
52
|
+
## Risk Levels in Skills
|
|
53
|
+
|
|
54
|
+
Each skill declares one of these `risk` levels:
|
|
55
|
+
|
|
56
|
+
- `safe`: no destructive operations expected
|
|
57
|
+
- `caution`: may modify files or interact with external systems
|
|
58
|
+
- `offensive`: security-testing or adversarial workflows that require explicit authorization
|
|
59
|
+
- `critical`: high-impact or system-level operations
|
|
@@ -0,0 +1,44 @@
|
|
|
1
|
+
[
|
|
2
|
+
{
|
|
3
|
+
"id": "essentials",
|
|
4
|
+
"name": "Essentials",
|
|
5
|
+
"description": "Recommended starting point for general developer workflows.",
|
|
6
|
+
"intended_for": "Every developer",
|
|
7
|
+
"skill_ids": ["find-skills", "brainstorming", "architecture", "debugging"]
|
|
8
|
+
},
|
|
9
|
+
{
|
|
10
|
+
"id": "full-stack",
|
|
11
|
+
"name": "Full-Stack",
|
|
12
|
+
"description": "Application design and implementation workflows.",
|
|
13
|
+
"intended_for": "Web and app developers",
|
|
14
|
+
"skill_ids": ["frontend-design", "api-design", "database-design", "omni-figma"]
|
|
15
|
+
},
|
|
16
|
+
{
|
|
17
|
+
"id": "security",
|
|
18
|
+
"name": "Security",
|
|
19
|
+
"description": "Security review and vulnerability-oriented workflows.",
|
|
20
|
+
"intended_for": "Security engineers",
|
|
21
|
+
"skill_ids": ["security-auditor", "vulnerability-scanner"]
|
|
22
|
+
},
|
|
23
|
+
{
|
|
24
|
+
"id": "devops",
|
|
25
|
+
"name": "DevOps",
|
|
26
|
+
"description": "Infrastructure and deployment workflows.",
|
|
27
|
+
"intended_for": "Infrastructure and platform teams",
|
|
28
|
+
"skill_ids": ["docker-expert", "kubernetes", "terraform"]
|
|
29
|
+
},
|
|
30
|
+
{
|
|
31
|
+
"id": "ai-engineer",
|
|
32
|
+
"name": "AI Engineer",
|
|
33
|
+
"description": "RAG, prompting, and AI application workflows.",
|
|
34
|
+
"intended_for": "LLM and ML developers",
|
|
35
|
+
"skill_ids": ["rag-engineer", "prompt-engineer", "llm-patterns"]
|
|
36
|
+
},
|
|
37
|
+
{
|
|
38
|
+
"id": "oss-maintainer",
|
|
39
|
+
"name": "OSS Maintainer",
|
|
40
|
+
"description": "Open source maintenance workflows.",
|
|
41
|
+
"intended_for": "Open source maintainers",
|
|
42
|
+
"skill_ids": ["find-skills", "create-pr", "changelog", "documentation"]
|
|
43
|
+
}
|
|
44
|
+
]
|
|
Binary file
|
|
Binary file
|
|
@@ -0,0 +1,5 @@
|
|
|
1
|
+
͵k-6[��[�V�����GN>��$!��!l�Z��1�P!��:q�`�����#��u�V����gu��&��J(�QRZ]�hk�������Z͈{+d�1�)��[��;�nX��G���HX
|
|
2
|
+
�⒆���n�uI$���-�b����Q[���K��o��Q�/�Y��
|
|
3
|
+
?s
|
|
4
|
+
�A�b$�9)1�W���L�m�=+���$IK8w�2��"^�\��/)T�F�T�²\S(�,�v�6�û��i�w;,!�Q��t;w-�Z�U�Y����ɧ��N�X��B���.���6����"=�Ȃb2;!Q�9�y�?�y����?6�sfF�4��vZ͚���*�
|
|
5
|
+
���x=���/ƞQ@�]�C/Nװ�La�����36��r�'�)��AS=н��x��e>o�F�2��_D8�R��Ã}q�N4y�|
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|