proskills-cli 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,83 @@
-# Temporary Holding Version
+# proskills-cli
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Install [ProSkills](https://proskills.dev) agent skills in one command, and scan any `SKILL.md` folder in CI.
+
+Node 18 or newer. One dependency (`jszip`).
+
+## Use it
+
+No install needed:
+
+```sh
+npx proskills-cli list                      # every skill, price and scan score
+npx proskills-cli add humanizer             # install a free skill into this project
+npx proskills-cli add grill-me hook-lab     # several at once
+npx proskills-cli scan                      # score the skills already in this repo
+```
+
+Or install it: `npm i -g proskills`.
+
+### `proskills list [--collection <slug>]`
+
+Prints a table of skills with price (or `Free`) and scan score.
+
+### `proskills add <skill-id...>`
+
+| Flag | Meaning |
+|---|---|
+| `--agent claude\|cursor\|codex\|gemini\|all` | Which agent to install for. Default: `.claude/` found, then Claude Code; else `.agents/` found, then `.agents/skills`; else Claude Code. |
+| `--global` | Install for every project (your home folder) instead of this one. |
+| `--order <id>` | Order id from your receipt (`cs_live_...`). Also read from env `PROSKILLS_ORDER`. Required for paid skills. |
+| `--dir <path>` | Use this folder instead of the current one (instead of your home folder with `--global`). |
+| `--force` | Replace a skill folder that already exists. Without it, nothing is overwritten. |
+| `--answers file.json` | Send your saved answers so `profile.md` is filled in. Optional. |
+
+Paid skill without an order id: the command stops and prints the link to buy it (`https://proskills.dev/library/<collection>`).
+
+### `proskills scan [paths...] [--min 80] [--json]`
+
+Scores skill folders against the Agent Skills spec, token budget, clarity and security. A path is a skill folder (has `SKILL.md`) or a folder of skill folders. Default: `.claude/skills` and `.agents/skills`. Exits `1` when any skill is grade F (any critical finding) or scores under `--min`, `2` on usage errors. Scanning runs locally; nothing is uploaded.
+
+### Everywhere
+
+`--base <url>` (or env `PROSKILLS_URL`) points at another host. Default `https://proskills.dev`. `--help`, `--version`.
+
+## CI
+
+Block a pull request that adds a weak or unsafe skill:
+
+```yaml
+name: skills
+on: [pull_request]
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: 20 }
+      - run: npx proskills-cli scan --min 80
+```
+
+Add paths to scan something else: `npx proskills-cli scan ./skills --min 90 --json`.
+
+## What it writes, and where
+
+Each skill becomes one folder, with `SKILL.md`, `profile.md` and any files the skill reads:
+
+| Agent | This project | With `--global` |
+|---|---|---|
+| Claude Code | `.claude/skills/<id>/` | `~/.claude/skills/<id>/` |
+| Cursor | `.agents/skills/<id>/` | `~/.cursor/skills/<id>/` |
+| Codex | `.agents/skills/<id>/` | `~/.agents/skills/<id>/` |
+| Gemini CLI | `.agents/skills/<id>/` | `~/.gemini/skills/<id>/` |
+
+It writes only inside that skills folder. Archive entries with `..`, absolute paths or drive letters are rejected before anything is written. Restart your agent afterwards.
+
+## Privacy
+
+`list` and `add` send only the skill ids you ask for, plus the order id if you give one. Your saved answers are not sent unless you pass `--answers file.json`. No telemetry, no accounts, no other network calls. `scan` makes none at all.
+
+## License
+
+MIT

package/dist/api.js

@@ -0,0 +1,103 @@
+import JSZip from "jszip";
+import { safeRelPath } from "./paths.js";
+export class CliError extends Error {
+    code;
+    constructor(message, code = 1) {
+        super(message);
+        this.code = code;
+    }
+}
+const MAX_ZIP_BYTES = 50 * 1024 * 1024;
+const MAX_ENTRIES = 2000;
+const MAX_UNPACKED_BYTES = 100 * 1024 * 1024;
+function headers(version, json) {
+    return { "User-Agent": `proskills-cli/${version}`, ...(json ? { "Content-Type": "application/json" } : {}) };
+}
+async function request(f, url, init) {
+    try {
+        return await f(url, { ...init, signal: AbortSignal.timeout(30_000) });
+    }
+    catch (e) {
+        throw new CliError(`Could not reach ${new URL(url).origin}: ${e instanceof Error ? e.message : String(e)}`);
+    }
+}
+export async function fetchCatalog(f, base, version) {
+    const res = await request(f, `${base}/api/catalog`, { headers: headers(version, false) });
+    if (!res.ok)
+        throw new CliError(`Catalog request failed (${res.status}) at ${base}/api/catalog`);
+    let data;
+    try {
+        data = (await res.json());
+    }
+    catch {
+        throw new CliError(`${base}/api/catalog did not return JSON. Is --base correct?`);
+    }
+    if (!data || !Array.isArray(data.skills) || !Array.isArray(data.collections))
+        throw new CliError(`Unexpected catalog format from ${base}.`);
+    return data;
+}
+export async function downloadZip(f, base, version, body) {
+    const res = await request(f, `${base}/api/download`, { method: "POST", headers: headers(version, true), body: JSON.stringify(body) });
+    if (!res.ok) {
+        let msg = "";
+        try {
+            msg = (await res.json()).error ?? "";
+        }
+        catch {
+            /* not JSON */
+        }
+        if (res.status === 402)
+            throw new CliError(`${msg || "Payment required."} Buy at ${base}/library/${body.slug} and pass the order id with --order or PROSKILLS_ORDER.`);
+        throw new CliError(`Download failed (${res.status})${msg ? `: ${msg}` : ""}`);
+    }
+    const buf = new Uint8Array(await res.arrayBuffer());
+    if (buf.length > MAX_ZIP_BYTES)
+        throw new CliError("Download is unexpectedly large; refusing to unpack it.");
+    return buf;
+}
+/**
+ * Reads a /api/download zip into `skill id -> files`. Handles both layouts
+ * (single skill: files at the zip root; several: `proskills-<slug>/<id>/…`).
+ * Throws before returning anything when any entry name is unsafe.
+ */
+export async function readSkills(zipData, slug, ids) {
+    const zip = await JSZip.loadAsync(zipData);
+    const entries = Object.values(zip.files);
+    if (entries.length > MAX_ENTRIES)
+        throw new CliError("Archive has too many entries.");
+    const names = entries.map((e) => ({ e, rel: safeRelPath(e.name) })).filter((x) => x.rel !== "");
+    const flat = names.some((x) => x.rel === "SKILL.md") && ids.length === 1;
+    const prefix = `proskills-${slug}`;
+    const out = new Map(ids.map((id) => [id, []]));
+    let total = 0;
+    for (const { e, rel } of names) {
+        if (e.dir)
+            continue;
+        let parts = rel.split("/");
+        let id;
+        if (flat) {
+            if (rel === "INSTALL.md")
+                continue;
+            id = ids[0];
+        }
+        else {
+            if (parts[0] === prefix)
+                parts = parts.slice(1);
+            if (parts.length < 2)
+                continue; // bundle-level README.md
+            id = parts[0];
+            parts = parts.slice(1);
+            if (!out.has(id))
+                continue;
+        }
+        const data = await e.async("uint8array");
+        total += data.length;
+        if (total > MAX_UNPACKED_BYTES)
+            throw new CliError("Archive unpacks to an unexpected size; refusing.");
+        out.get(id).push({ path: parts.join("/"), data });
+    }
+    for (const [id, files] of out)
+        if (!files.some((f) => f.path === "SKILL.md"))
+            throw new CliError(`The download for "${id}" did not contain a SKILL.md.`);
+    return out;
+}

package/dist/cli.js

@@ -0,0 +1,163 @@
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { isAbsolute, relative, resolve } from "node:path";
+import { parseArgs } from "node:util";
+import { CliError, fetchCatalog } from "./api.js";
+import { install } from "./install.js";
+import { pickAgents, resolveTargets } from "./paths.js";
+import { DEFAULT_SCAN_DIRS, isFailing, scanDirs } from "./scancmd.js";
+export const DEFAULT_BASE = "https://proskills.dev";
+export const HELP = `proskills - install ProSkills agent skills and scan any skill folder
+
+Usage
+  proskills list [--collection <slug>]
+  proskills add <skill-id...> [--agent claude|cursor|codex|gemini|all] [--global]
+                [--order <id>] [--dir <path>] [--force] [--answers file.json]
+  proskills scan [paths...] [--min 80] [--json]
+
+Options
+  --base <url>   Another host (default ${DEFAULT_BASE}, or env PROSKILLS_URL)
+  --order <id>   Order id from your receipt (or env PROSKILLS_ORDER)
+  --dir <path>   Base folder instead of the current one (home folder with --global)
+  --help         Show this help
+  --version      Show the version
+
+Examples
+  npx proskills-cli add humanizer
+  npx proskills-cli add grill-me --agent all --global
+  npx proskills-cli scan --min 80
+`;
+const OPTIONS = {
+    help: { type: "boolean", short: "h" },
+    version: { type: "boolean", short: "v" },
+    base: { type: "string" },
+    agent: { type: "string" },
+    global: { type: "boolean" },
+    order: { type: "string" },
+    dir: { type: "string" },
+    force: { type: "boolean" },
+    answers: { type: "string" },
+    collection: { type: "string" },
+    min: { type: "string" },
+    json: { type: "boolean" },
+};
+export function parseCli(argv) {
+    const { values, positionals } = parseArgs({ args: argv, options: OPTIONS, allowPositionals: true, strict: true });
+    return { command: positionals[0], args: positionals.slice(1), values };
+}
+export function defaultEnv(version) {
+    return {
+        fetch: globalThis.fetch,
+        cwd: process.cwd(),
+        home: homedir(),
+        env: process.env,
+        out: (s) => process.stdout.write(s + "\n"),
+        err: (s) => process.stderr.write(s + "\n"),
+        version,
+    };
+}
+const money = (n) => (n === 0 ? "Free" : `$${n}`);
+function table(rows) {
+    const widths = rows[0].map((_, i) => Math.max(...rows.map((r) => r[i].length)));
+    return rows.map((r) => r.map((c, i) => (i === r.length - 1 ? c : c.padEnd(widths[i]))).join("  ")).join("\n");
+}
+function readAnswers(file, cwd) {
+    try {
+        const data = JSON.parse(readFileSync(resolve(cwd, file), "utf8"));
+        if (!data || typeof data !== "object" || Array.isArray(data))
+            throw new Error("expected a JSON object");
+        return data;
+    }
+    catch (e) {
+        throw new CliError(`Could not read --answers ${file}: ${e instanceof Error ? e.message : String(e)}`, 2);
+    }
+}
+/** Runs the CLI and returns the exit code. Never calls process.exit, so tests can drive it. */
+export async function run(argv, io) {
+    try {
+        let parsed;
+        try {
+            parsed = parseCli(argv);
+        }
+        catch (e) {
+            throw new CliError(`${e instanceof Error ? e.message : String(e)}\nRun \`proskills --help\` for usage.`, 2);
+        }
+        const { command, args, values } = parsed;
+        if (values.version) {
+            io.out(io.version);
+            return 0;
+        }
+        if (values.help || !command || command === "help") {
+            io.out(HELP);
+            return command || values.help ? 0 : 2;
+        }
+        const base = (values.base ?? io.env.PROSKILLS_URL ?? DEFAULT_BASE).replace(/\/+$/, "");
+        if (command === "list") {
+            const cat = await fetchCatalog(io.fetch, base, io.version);
+            if (values.collection && !cat.collections.some((c) => c.slug === values.collection)) {
+                throw new CliError(`Unknown collection "${values.collection}". Collections: ${cat.collections.map((c) => c.slug).join(", ")}`);
+            }
+            const skills = cat.skills.filter((s) => !values.collection || s.slug === values.collection);
+            const rows = [["ID", "COLLECTION", "PRICE", "SCAN", "NAME"], ...skills.map((s) => [s.id, s.slug, money(s.price), s.quality ? `${s.quality.score} ${s.quality.grade}` : "-", s.name])];
+            io.out(table(rows));
+            io.out(`\n${skills.length} skills. Install with: npx proskills-cli add <id>`);
+            return 0;
+        }
+        if (command === "add") {
+            if (!args.length)
+                throw new CliError("Name at least one skill, e.g. `proskills add humanizer`. See `proskills list`.", 2);
+            const global = !!values.global;
+            const baseDir = resolve(io.cwd, values.dir ?? (global ? io.home : "."));
+            let agents;
+            try {
+                agents = pickAgents(values.agent, baseDir, global);
+            }
+            catch (e) {
+                throw new CliError(e.message, 2);
+            }
+            const targets = resolveTargets(agents, baseDir, global);
+            const order = values.order ?? io.env.PROSKILLS_ORDER ?? undefined;
+            const answers = values.answers ? readAnswers(values.answers, io.cwd) : {};
+            const catalog = await fetchCatalog(io.fetch, base, io.version);
+            const written = await install({ ids: args, catalog, base, version: io.version, fetch: io.fetch, targets, order: order || undefined, answers, force: !!values.force });
+            for (const w of written) {
+                const rel = relative(io.cwd, w.dir);
+                const shown = rel && !rel.startsWith("..") && !isAbsolute(rel) ? rel : w.dir;
+                io.out(`wrote ${shown.replace(/\\/g, "/")}/  (${w.files} files, ${w.target.label})`);
+            }
+            io.out("\nRestart your agent (or start a new session) to load the skill.");
+            return 0;
+        }
+        if (command === "scan") {
+            const min = values.min === undefined ? 80 : Number(values.min);
+            if (!Number.isFinite(min) || min < 0 || min > 100)
+                throw new CliError("--min must be a number from 0 to 100.", 2);
+            const explicit = args.length > 0;
+            const results = scanDirs(explicit ? args : DEFAULT_SCAN_DIRS, io.cwd);
+            if (!results.length)
+                throw new CliError(explicit ? "No skill folders (containing SKILL.md) found in the given paths." : `No skills found in ${DEFAULT_SCAN_DIRS.join(" or ")}. Pass a path: proskills scan ./my-skill`, 2);
+            const failed = results.filter((r) => isFailing(r, min));
+            if (values.json) {
+                io.out(JSON.stringify({ min, ok: failed.length === 0, skills: results.map((r) => ({ dir: r.dir.replace(/\\/g, "/"), failed: isFailing(r, min), ...r.report })) }, null, 2));
+            }
+            else {
+                for (const { dir, report: r } of results) {
+                    io.out(`\n${r.grade}  ${String(r.score).padStart(3)}  ${dir.replace(/\\/g, "/")}   spec ${r.pillars.spec} · eff ${r.pillars.efficiency} · clarity ${r.pillars.clarity} · sec ${r.pillars.security}`);
+                    for (const f of r.findings.filter((f) => f.severity !== "info"))
+                        io.out(`     ${f.severity.padEnd(8)} ${f.rule.padEnd(24)} ${f.file ?? ""}${f.line ? ":" + f.line : ""}  ${f.message}`);
+                }
+                io.out(`\n${results.length} skills scanned, ${failed.length} below the gate (min ${min}, grade F always fails).`);
+            }
+            return failed.length ? 1 : 0;
+        }
+        throw new CliError(`Unknown command "${command}". Run \`proskills --help\`.`, 2);
+    }
+    catch (e) {
+        if (e instanceof CliError) {
+            io.err(`proskills: ${e.message}`);
+            return e.code;
+        }
+        io.err(`proskills: ${e instanceof Error ? e.message : String(e)}`);
+        return 1;
+    }
+}

package/dist/index.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import { readFileSync } from "node:fs";
+import { defaultEnv, run } from "./cli.js";
+const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+process.exitCode = await run(process.argv.slice(2), defaultEnv(pkg.version));

package/dist/install.js

@@ -0,0 +1,61 @@
+import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { CliError, downloadZip, readSkills } from "./api.js";
+import { insideRoot, safeRelPath } from "./paths.js";
+export const ID_RE = /^[a-z0-9][a-z0-9-]{0,60}$/;
+export const ORDER_RE = /^cs_(test|live)_[A-Za-z0-9]{10,200}$/;
+/** Resolves ids against the catalog and checks purchase state. Throws CliError with the next step. */
+export function plan(ids, catalog, base, order) {
+    const unique = [...new Set(ids)];
+    for (const id of unique)
+        if (!ID_RE.test(id))
+            throw new CliError(`"${id}" is not a valid skill id.`, 2);
+    const unknown = unique.filter((id) => !catalog.skills.some((s) => s.id === id));
+    if (unknown.length)
+        throw new CliError(`Unknown skill${unknown.length > 1 ? "s" : ""}: ${unknown.join(", ")}. Run \`proskills list\` to see every id.`);
+    if (order && !ORDER_RE.test(order))
+        throw new CliError("That order id doesn't look right. It starts with cs_live_ or cs_test_ and is on your receipt.", 2);
+    const groups = new Map();
+    const locked = [];
+    for (const id of unique) {
+        const s = catalog.skills.find((k) => k.id === id);
+        if (!s.free && !order)
+            locked.push(`  ${id}  ($${s.price})  ${base}/library/${s.slug}`);
+        groups.set(s.slug, [...(groups.get(s.slug) ?? []), id]);
+    }
+    if (locked.length) {
+        throw new CliError(`These skills are paid and need an order id:\n${locked.join("\n")}\nBuy at the link, then rerun with --order <id> (or set PROSKILLS_ORDER).`);
+    }
+    return groups;
+}
+export async function install(o) {
+    const groups = plan(o.ids, o.catalog, o.base, o.order);
+    const ids = [...groups.values()].flat();
+    if (!o.force) {
+        const clashes = o.targets.flatMap((t) => ids.map((id) => insideRoot(t.dir, id)).filter((p) => existsSync(p)));
+        if (clashes.length)
+            throw new CliError(`Already installed, not overwriting:\n${clashes.map((c) => "  " + c).join("\n")}\nUse --force to replace.`);
+    }
+    // Download and validate everything before touching the disk.
+    const staged = new Map();
+    for (const [slug, groupIds] of groups) {
+        const zip = await downloadZip(o.fetch, o.base, o.version, { slug, skills: groupIds, answers: o.answers, ...(o.order ? { order: o.order } : {}) });
+        for (const [id, files] of await readSkills(zip, slug, groupIds))
+            staged.set(id, files);
+    }
+    const written = [];
+    for (const t of o.targets) {
+        for (const [id, files] of staged) {
+            const dir = insideRoot(t.dir, id);
+            if (o.force && existsSync(dir))
+                rmSync(dir, { recursive: true, force: true });
+            for (const f of files) {
+                const dest = insideRoot(dir, safeRelPath(f.path));
+                mkdirSync(dirname(dest), { recursive: true });
+                writeFileSync(dest, f.data);
+            }
+            written.push({ id, target: t, dir, files: files.length });
+        }
+    }
+    return written;
+}

package/dist/paths.js

@@ -0,0 +1,79 @@
+import { existsSync } from "node:fs";
+import { join, resolve, sep } from "node:path";
+export const AGENTS = ["claude", "cursor", "codex", "gemini"];
+/** Project-level skills directory per agent (relative to the project root). */
+const PROJECT_DIR = {
+    claude: ".claude/skills",
+    cursor: ".agents/skills",
+    codex: ".agents/skills",
+    gemini: ".agents/skills",
+};
+/** User-level skills directory per agent (relative to the home directory). */
+const USER_DIR = {
+    claude: ".claude/skills",
+    cursor: ".cursor/skills",
+    codex: ".agents/skills",
+    gemini: ".gemini/skills",
+};
+export function isAgent(v) {
+    return AGENTS.includes(v);
+}
+/**
+ * Which agents to install for. With no --agent: `.claude/` present → claude,
+ * else `.agents/` present → the shared .agents folder (Cursor, Codex, Gemini),
+ * else claude. `all` installs for every agent (deduplicated by folder).
+ */
+export function pickAgents(agent, base, global) {
+    if (agent === "all")
+        return AGENTS;
+    if (agent) {
+        if (!isAgent(agent))
+            throw new Error(`Unknown agent "${agent}". Use claude, cursor, codex, gemini or all.`);
+        return [agent];
+    }
+    if (global)
+        return ["claude"];
+    if (existsSync(join(base, ".claude")))
+        return ["claude"];
+    if (existsSync(join(base, ".agents")))
+        return ["codex"];
+    return ["claude"];
+}
+/** Skills directories for the chosen agents. `base` is the project root, or the home directory with --global. */
+export function resolveTargets(agents, base, global) {
+    const seen = new Map();
+    for (const a of agents) {
+        const dir = resolve(base, (global ? USER_DIR : PROJECT_DIR)[a]);
+        const prev = seen.get(dir);
+        if (prev) {
+            prev.label += `, ${a}`;
+        }
+        else {
+            seen.set(dir, { label: a, dir });
+        }
+    }
+    return [...seen.values()];
+}
+/**
+ * Normalises a zip entry name to a relative POSIX path, or throws when it
+ * could escape the destination (absolute path, drive letter, `..`, NUL).
+ */
+export function safeRelPath(name) {
+    if (name.includes("\0"))
+        throw new Error(`Unsafe path in archive: ${JSON.stringify(name)}`);
+    const n = name.replace(/\\/g, "/");
+    if (n.startsWith("/") || /^[A-Za-z]:/.test(n))
+        throw new Error(`Unsafe path in archive: ${name}`);
+    const parts = n.split("/").filter((p) => p !== "" && p !== ".");
+    if (parts.some((p) => p === ".."))
+        throw new Error(`Unsafe path in archive: ${name}`);
+    return parts.join("/");
+}
+/** Joins and verifies the result stays inside `root`. */
+export function insideRoot(root, rel) {
+    const full = resolve(root, rel);
+    const r = resolve(root);
+    if (full !== r && !full.startsWith(r.endsWith(sep) ? r : r + sep))
+        throw new Error(`Refusing to write outside ${r}: ${rel}`);
+    return full;
+}

package/dist/scan.js

@@ -0,0 +1,261 @@
+/**
+ * Skill Scanner: scores an Agent Skill (SKILL.md plus any files beside it)
+ * against the open Agent Skills spec, progressive-disclosure and token
+ * budgets, clarity, and security. Pure TypeScript with no Node or DOM APIs,
+ * so the same code gates our catalog at build time (scripts/scan.ts) and
+ * runs in the visitor's browser on /scan, where nothing is uploaded.
+ *
+ * Every finding names its rule, so a score is always explainable. Four
+ * pillars of 25 points each make the 0–100 score; any critical security
+ * finding caps the grade at F regardless of the rest.
+ */
+export const PILLAR_MAX = 25;
+/** Rough token count; within ~10% of real tokenizers for English and code. */
+export function tokens(text) {
+    return Math.ceil(text.length / 4);
+}
+/** Minimal frontmatter reader: top-level `key: value` pairs, folded/quoted values. */
+export function parseFrontmatter(src) {
+    const text = src.replace(/^/, "").replace(/\r\n/g, "\n");
+    if (!text.startsWith("---\n"))
+        return { data: {}, body: text, bodyStart: 1, error: "missing", raw: "" };
+    const end = text.indexOf("\n---", 4);
+    if (end < 0)
+        return { data: {}, body: text, bodyStart: 1, error: "unterminated", raw: "" };
+    const raw = text.slice(4, end);
+    const after = text.indexOf("\n", end + 4);
+    const body = after < 0 ? "" : text.slice(after + 1);
+    const data = {};
+    let error;
+    let key = null;
+    let block = false;
+    for (const line of raw.split("\n")) {
+        const m = /^([A-Za-z][\w-]*):\s?(.*)$/.exec(line);
+        if (m && !line.startsWith(" ")) {
+            key = m[1];
+            let v = m[2].trim();
+            block = v === "|" || v === ">" || v === "|-" || v === ">-";
+            if (block)
+                v = "";
+            else if (/^(['"]).*\1$/.test(v))
+                v = v.slice(1, -1);
+            else if (/:\s/.test(v) && !/^[[{]/.test(v))
+                error = `"${key}" has an unquoted ": " — YAML parsers will reject or mangle it`;
+            data[key] = v;
+        }
+        else if (key && (line.startsWith(" ") || line.startsWith("\t"))) {
+            data[key] = (data[key] ? data[key] + (block ? "\n" : " ") : "") + line.trim();
+        }
+    }
+    return { data, body, bodyStart: raw.split("\n").length + 3, error, raw };
+}
+const NAME_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+const RESERVED = ["anthropic", "claude"];
+/** Security patterns. Matched per line across every text file in the skill. */
+const SECURITY = [
+    { rule: "sec/prompt-injection", severity: "critical", cost: 25, re: /\b(ignore|disregard|forget)\s+(all\s+)?(the\s+)?(previous|prior|above|earlier|system)\s+(instructions|prompts?|rules|messages)/i, message: "Tries to override the agent's instructions." },
+    { rule: "sec/prompt-injection", severity: "critical", cost: 25, re: /\b(you are now|new system prompt|developer mode|jailbreak|DAN mode)\b/i, message: "Role-hijack phrasing." },
+    { rule: "sec/conceal", severity: "critical", cost: 25, re: /\b(do not|don't|never)\s+(tell|inform|mention|reveal|show)\s+(this\s+to\s+)?(the\s+)?user\b/i, message: "Asks the agent to hide actions from the user." },
+    { rule: "sec/remote-exec", severity: "critical", cost: 25, re: /\b(curl|wget|iwr|Invoke-WebRequest)\b[^\n|]*\|\s*(ba|z)?sh\b|\b(curl|wget)\b[^\n|]*\|\s*(python|node|iex)\b|\biex\s*\(\s*(New-Object|iwr|irm)/i, message: "Downloads and executes remote code." },
+    { rule: "sec/exfiltration", severity: "critical", cost: 25, re: /\b(curl|wget|fetch|requests\.(post|get)|axios|http\.request)\b[^\n]*(\$\{?[A-Z_]*(KEY|TOKEN|SECRET|PASSWORD)|\.env\b|id_rsa|\.ssh|\.aws\/credentials|process\.env|os\.environ)/i, message: "Sends secrets or credentials over the network." },
+    { rule: "sec/secret-read", severity: "warn", cost: 10, re: /(~|\$HOME|%USERPROFILE%)?[\\/]\.(ssh|aws|gnupg|kube|docker)[\\/]|\bid_(rsa|ed25519)\b|\.npmrc|\.netrc|\bkeychain\b/i, message: "Touches credential files." },
+    { rule: "sec/destructive", severity: "critical", cost: 20, re: /\brm\s+-[a-z]*r[a-z]*f?[a-z]*\s+(\/|~|\$HOME|\*|\.\s*$)|\bmkfs\b|\bdd\s+if=.*of=\/dev\/|:\(\)\s*\{\s*:\|:&\s*\};:|\bformat\s+[a-z]:/i, message: "Destructive filesystem command." },
+    { rule: "sec/destructive", severity: "warn", cost: 8, re: /\bgit\s+push\s+(-f|--force)\b|\bgit\s+reset\s+--hard\b|\bDROP\s+(TABLE|DATABASE)\b|--no-verify\b|--dangerously/i, message: "Risky command; make sure the skill asks before running it." },
+    { rule: "sec/obfuscation", severity: "critical", cost: 20, re: /\b(base64\s+(-d|--decode)|atob\(|FromBase64String|eval\s*\(|exec\s*\(\s*(compile|base64|bytes))/i, message: "Decodes or evaluates hidden code." },
+    { rule: "sec/obfuscation", severity: "warn", cost: 6, re: /[A-Za-z0-9+/]{120,}={0,2}/, message: "Long encoded blob; reviewers can't read what it does." },
+    { rule: "sec/fake-prerequisite", severity: "critical", cost: 25, re: /\b(download|install|run)\b[^\n]{0,60}\bhttps?:\/\/[^\s)]+\.(dmg|pkg|exe|msi|zip|tar\.gz|sh|ps1|bin|AppImage)\b/i, message: "Tells the user or agent to fetch and run a binary, the pattern behind the ClawHavoc malware campaign." },
+    { rule: "sec/remote-instructions", severity: "warn", cost: 10, re: /\b(fetch|download|curl|read|load|get)\b[^\n]{0,40}\bhttps?:\/\/[^\s)]+[^\n]{0,60}\b(follow|apply|execute|obey)\b[^\n]{0,20}\b(instructions|rules|steps|prompt)/i, message: "Pulls instructions from a URL at runtime, so the skill can change after it was reviewed." },
+    { rule: "sec/persistence", severity: "warn", cost: 10, re: /\b(crontab|launchctl|systemctl\s+enable|schtasks|reg\s+add|\.bashrc|\.zshrc|\.profile|settings\.json.*hooks|Startup folder)\b/i, message: "Installs persistence or edits shell/agent config." },
+    { rule: "sec/permissions", severity: "warn", cost: 8, re: /--dangerously-skip-permissions|bypassPermissions|allowed-tools:\s*["']?\*|chmod\s+(-R\s+)?777|\bsudo\b/i, message: "Escalates permissions." },
+];
+const HIDDEN = /[​-‏‪-‮⁠-⁤⁦-⁩\u{E0000}-\u{E007F}]/u;
+const URL_RE = /\bhttps?:\/\/[^\s)<>"'`\]]+/g;
+const VAGUE = /\b(as needed|if appropriate|when relevant|try to|you might|you may want to|consider (?:possibly)?|etc\.?|and so on|best practices|high[- ]quality|make sure it'?s good)\b/gi;
+/** A referenced file is read by the skill (so must ship with it), not written by it. */
+const READS = /\b(read|open|see|consult|load|follow|template|in this folder|bundled)\b/i;
+const WRITES = /\b(write|writes|written|writing|read by|create|save|keep|update|generate|produce|look for|if it exists)\b/i;
+/** Unfinished markers, skipping lines that ban them ("No lorem ipsum"). */
+const TODO_RE = /^(?!.*\b(no|never|ban|avoid|don't|not)\b).*\b(TODO|FIXME|TBD|lorem ipsum)\b/im;
+function lineAt(text, index) {
+    const start = text.lastIndexOf("\n", index) + 1;
+    const stop = text.indexOf("\n", index);
+    return text.slice(start, stop < 0 ? undefined : stop);
+}
+function lineOf(text, index) {
+    let n = 1;
+    for (let i = 0; i < index && i < text.length; i++)
+        if (text.charCodeAt(i) === 10)
+            n++;
+    return n;
+}
+function isText(path) {
+    return !/\.(png|jpe?g|gif|webp|mp4|mov|webm|pdf|zip|woff2?|ttf|ico|mp3|wav)$/i.test(path);
+}
+/** Folder the SKILL.md sits in, so "x/SKILL.md" and "SKILL.md" both work. */
+function rootOf(files) {
+    const skill = [...files].sort((a, b) => a.path.length - b.path.length).find((f) => /(^|\/)SKILL\.md$/i.test(f.path));
+    const dir = skill ? skill.path.slice(0, skill.path.length - "SKILL.md".length) : "";
+    return { skill, dir };
+}
+export function scanSkill(input) {
+    const files = (typeof input === "string" ? [{ path: "SKILL.md", content: input }] : input).map((f) => ({ path: f.path.replace(/\\/g, "/"), content: f.content }));
+    const findings = [];
+    const add = (f) => findings.push(f);
+    const { skill, dir } = rootOf(files);
+    const rel = (p) => (p.startsWith(dir) ? p.slice(dir.length) : p);
+    if (!skill) {
+        add({ rule: "spec/no-skill-md", pillar: "spec", severity: "critical", cost: 25, message: "No SKILL.md found. Every skill needs one at its root." });
+        return finish(null, null, findings, { files: files.length, bodyLines: 0, bodyTokens: 0, metaTokens: 0, referenceTokens: 0, scripts: 0, links: [] });
+    }
+    const fm = parseFrontmatter(skill.content);
+    const name = fm.data.name ?? null;
+    const description = fm.data.description ?? null;
+    const body = fm.body;
+    const bodyLines = body.split("\n").length;
+    const others = files.filter((f) => f !== skill);
+    // ---- spec -------------------------------------------------------------
+    if (fm.error === "missing")
+        add({ rule: "spec/frontmatter", pillar: "spec", severity: "critical", cost: 25, message: "SKILL.md must start with YAML frontmatter (--- name, description ---).", file: "SKILL.md", line: 1 });
+    else if (fm.error === "unterminated")
+        add({ rule: "spec/frontmatter", pillar: "spec", severity: "critical", cost: 25, message: "Frontmatter is never closed with ---.", file: "SKILL.md", line: 1 });
+    else if (fm.error)
+        add({ rule: "spec/yaml", pillar: "spec", severity: "warn", cost: 8, message: `Frontmatter: ${fm.error}. Wrap the value in quotes.`, file: "SKILL.md", line: 2 });
+    if (!fm.error || fm.error.startsWith('"')) {
+        if (!name)
+            add({ rule: "spec/name", pillar: "spec", severity: "critical", cost: 12, message: "Missing required `name`.", file: "SKILL.md" });
+        else {
+            if (!NAME_RE.test(name))
+                add({ rule: "spec/name-format", pillar: "spec", severity: "warn", cost: 6, message: `name "${name}" must be lowercase letters, numbers and single hyphens.`, file: "SKILL.md" });
+            if (name.length > 64)
+                add({ rule: "spec/name-length", pillar: "spec", severity: "warn", cost: 4, message: `name is ${name.length} characters; the limit is 64.`, file: "SKILL.md" });
+            if (RESERVED.some((r) => name.includes(r)))
+                add({ rule: "spec/name-reserved", pillar: "spec", severity: "warn", cost: 4, message: `name contains a reserved word (${RESERVED.join(", ")}).`, file: "SKILL.md" });
+            const folder = dir.replace(/\/$/, "").split("/").pop();
+            if (folder && folder !== name)
+                add({ rule: "spec/name-folder", pillar: "spec", severity: "info", cost: 2, message: `name "${name}" doesn't match its folder "${folder}"; some agents key on the folder.`, file: "SKILL.md" });
+        }
+        if (!description)
+            add({ rule: "spec/description", pillar: "spec", severity: "critical", cost: 12, message: "Missing required `description`; agents can't know when to load the skill.", file: "SKILL.md" });
+        else {
+            if (description.length > 1024)
+                add({ rule: "spec/description-length", pillar: "spec", severity: "warn", cost: 6, message: `description is ${description.length} characters; the limit is 1024 and most agents truncate it.`, file: "SKILL.md" });
+            if (/<[a-z][^>]*>/i.test(description))
+                add({ rule: "spec/description-xml", pillar: "spec", severity: "warn", cost: 4, message: "description contains XML/HTML tags, which the spec forbids.", file: "SKILL.md" });
+        }
+        // The open spec's six fields. Claude Code ignores others, but claude.ai and the Skills API reject them.
+        const known = new Set(["name", "description", "license", "allowed-tools", "metadata", "compatibility"]);
+        const extra = Object.keys(fm.data).filter((k) => !known.has(k));
+        if (extra.length)
+            add({ rule: "spec/non-portable-keys", pillar: "spec", severity: "warn", cost: 4, message: `Non-spec frontmatter (${extra.join(", ")}). claude.ai and the Skills API reject the upload; move them under \`metadata\` or drop them.`, file: "SKILL.md" });
+    }
+    // Links inside SKILL.md must resolve to bundled files.
+    const present = new Set(others.map((f) => rel(f.path)));
+    const refRe = /(?:\]\(|`)((?:\.\/)?(?:[\w.-]+\/)*[\w.-]+\.(?:md|py|sh|js|mjs|ts|json|ya?ml|txt|csv|html))(?:\)|`)/g;
+    const referenced = new Set();
+    for (const m of body.matchAll(refRe)) {
+        const p = m[1].replace(/^\.\//, "");
+        if (p === "SKILL.md" || p === "profile.md" || /^(package|tsconfig)\.json$/.test(p))
+            continue;
+        if (/^[\w-]+\.(json|ya?ml|html|ts|js)$/.test(p) && !present.has(p))
+            continue; // likely a user-project file, not a bundled one
+        referenced.add(p);
+        // Only files the skill reads must ship with it; files it writes (decisions.md, storyboard.md) won't exist yet.
+        const ln = lineAt(body, m.index ?? 0);
+        const reads = READS.test(ln) && !WRITES.test(ln);
+        if (!present.has(p) && reads)
+            add({ rule: "spec/broken-ref", pillar: "spec", severity: "warn", cost: 4, message: `References ${p}, which isn't in the skill folder.`, file: "SKILL.md", line: fm.bodyStart + lineOf(body, m.index ?? 0) - 1 });
+    }
+    // ---- efficiency / progressive disclosure -------------------------------
+    const metaTokens = tokens(`${name ?? ""} ${description ?? ""}`);
+    const bodyTokens = tokens(body);
+    const referenceTokens = others.filter((f) => isText(f.path)).reduce((a, f) => a + tokens(f.content), 0);
+    const scripts = others.filter((f) => /\.(py|sh|js|mjs|ts|ps1|rb)$/i.test(f.path)).length;
+    if (description) {
+        if (description.length < 60)
+            add({ rule: "eff/description-thin", pillar: "efficiency", severity: "warn", cost: 6, message: "description is too short to trigger reliably. Say what it does and when to use it.", file: "SKILL.md" });
+        if (!/\b(use (it )?when|use for|use this|when the user|whenever|trigger|asks? (for|to))\b/i.test(description))
+            add({ rule: "eff/description-trigger", pillar: "efficiency", severity: "warn", cost: 6, message: "description doesn't say *when* to use the skill (\"Use when …\"). Agents decide from this line alone.", file: "SKILL.md" });
+        if (/^(this skill|a skill|i |i'm|you )/i.test(description))
+            add({ rule: "eff/description-voice", pillar: "efficiency", severity: "info", cost: 2, message: "Write the description in third person (\"Reviews…\", \"Use when…\"), not \"This skill…\" or \"I…\".", file: "SKILL.md" });
+    }
+    if (bodyLines > 500)
+        add({ rule: "eff/body-lines", pillar: "efficiency", severity: "warn", cost: 8, message: `SKILL.md body is ${bodyLines} lines; keep it under 500 and move detail into reference files.`, file: "SKILL.md" });
+    if (bodyTokens > 5000)
+        add({ rule: "eff/body-tokens", pillar: "efficiency", severity: "warn", cost: Math.min(12, Math.round((bodyTokens - 5000) / 500) + 4), message: `~${bodyTokens} tokens load every time this triggers. Aim for under 5,000; split into reference files read on demand.`, file: "SKILL.md" });
+    else if (bodyTokens > 3000 && others.length === 0)
+        add({ rule: "eff/no-disclosure", pillar: "efficiency", severity: "info", cost: 3, message: `~${bodyTokens} tokens in one file. Long tables, examples or catalogues belong in reference files.`, file: "SKILL.md" });
+    // Depth: a handful of one-line rules restates what a capable agent already does.
+    if (bodyTokens < 120)
+        add({ rule: "eff/body-thin", pillar: "efficiency", severity: "warn", cost: 10, message: "The body is very thin. A skill should carry knowledge the agent doesn't already have.", file: "SKILL.md" });
+    else if (bodyTokens + referenceTokens < 450)
+        add({ rule: "eff/body-light", pillar: "efficiency", severity: "warn", cost: 6, message: `Only ~${bodyTokens + referenceTokens} tokens of guidance. Add the specifics an agent can't guess: thresholds, checklists, worked examples.`, file: "SKILL.md" });
+    for (const f of others.filter((f) => isText(f.path) && /\.md$/i.test(f.path))) {
+        const r = rel(f.path);
+        if (!referenced.has(r) && !/readme|license|changelog/i.test(r))
+            add({ rule: "eff/orphan-file", pillar: "efficiency", severity: "info", cost: 2, message: `${r} is never mentioned in SKILL.md, so the agent won't know to read it.`, file: r });
+        if (tokens(f.content) > 2500 && !/^#{1,3} /m.test(f.content.slice(0, 600)) && !/contents|toc/i.test(f.content.slice(0, 800)))
+            add({ rule: "eff/reference-toc", pillar: "efficiency", severity: "info", cost: 1, message: `${r} is long; open it with a heading or contents list so the agent can jump to what it needs.`, file: r });
+        if (/\/[^/]+\/[^/]+\/[^/]+\.md$/.test("/" + r))
+            add({ rule: "eff/nested-refs", pillar: "efficiency", severity: "info", cost: 1, message: `${r} is nested deeply; keep references one level below SKILL.md.`, file: r });
+    }
+    // ---- clarity ----------------------------------------------------------
+    const headings = body.match(/^#{1,3} .+$/gm) ?? [];
+    if (headings.length < 2 && bodyLines > 25)
+        add({ rule: "clarity/structure", pillar: "clarity", severity: "warn", cost: 5, message: "Few headings; break the body into sections (workflow, rules, output).", file: "SKILL.md" });
+    if (!/(^#{1,3} .*\b(examples?|samples?|before\s*(\/|and|&|vs\.?|→)\s*after|good\s*(\/|and|&|vs\.?)\s*bad|do\s*(\/|and|&)\s*don't)\b)|```|^\s*\|.*\|.*\|\s*$/im.test(body))
+        add({ rule: "clarity/examples", pillar: "clarity", severity: "warn", cost: 5, message: "No examples or code blocks. One concrete input → output example improves consistency more than extra rules.", file: "SKILL.md" });
+    if (!/^#{1,3} .*(output|deliver|return|format|result|report)/im.test(body) && !/\b(output|return|respond with|reply with|deliver)\b/i.test(body))
+        add({ rule: "clarity/output", pillar: "clarity", severity: "warn", cost: 4, message: "Doesn't say what the result should look like. Add an Output section.", file: "SKILL.md" });
+    if (bodyLines > 40 && !/^\s*(\d+[.)]|- \[ \]|#{1,3} .*(workflow|steps|process|procedure|how to|modes?))/im.test(body))
+        add({ rule: "clarity/workflow", pillar: "clarity", severity: "info", cost: 3, message: "No numbered workflow. Ordered steps make agents more reliable than prose.", file: "SKILL.md" });
+    const vague = body.match(VAGUE) ?? [];
+    if (vague.length >= 4)
+        add({ rule: "clarity/vague", pillar: "clarity", severity: "info", cost: Math.min(5, vague.length - 2), message: `${vague.length} vague phrases (${[...new Set(vague.map((v) => v.toLowerCase()))].slice(0, 4).join(", ")}). Replace with concrete thresholds.`, file: "SKILL.md" });
+    const todo = TODO_RE.exec(body);
+    if (todo)
+        add({ rule: "clarity/unfinished", pillar: "clarity", severity: "warn", cost: 4, message: `Unfinished marker "${todo[2]}".`, file: "SKILL.md", line: fm.bodyStart + lineOf(body, todo.index) - 1 });
+    // ---- security ---------------------------------------------------------
+    const links = new Set();
+    for (const f of files.filter((f) => isText(f.path))) {
+        const r = rel(f.path);
+        const lines = f.content.split(/\r?\n/);
+        const seen = new Set();
+        lines.forEach((ln, i) => {
+            for (const p of SECURITY) {
+                if (seen.has(p.rule + p.message))
+                    continue;
+                if (p.re.test(ln)) {
+                    seen.add(p.rule + p.message);
+                    add({ rule: p.rule, pillar: "security", severity: p.severity, cost: p.cost, message: p.message, file: r, line: i + 1 });
+                }
+            }
+            if (HIDDEN.test(ln) && !seen.has("hidden")) {
+                seen.add("hidden");
+                add({ rule: "sec/hidden-unicode", pillar: "security", severity: "critical", cost: 25, message: "Invisible or bidirectional Unicode characters can hide instructions from reviewers.", file: r, line: i + 1 });
+            }
+            for (const u of ln.match(URL_RE) ?? [])
+                links.add(u.replace(/[.,;:]+$/, ""));
+        });
+        if (/<!--[\s\S]*?(instruction|ignore|assistant|system|agent|you must)[\s\S]*?-->/i.test(f.content))
+            add({ rule: "sec/hidden-comment", pillar: "security", severity: "warn", cost: 10, message: "HTML comment carries instructions the user won't see rendered.", file: r });
+    }
+    const external = [...links].filter((u) => !/^https?:\/\/(localhost|127\.0\.0\.1|example\.(com|org))/i.test(u));
+    if (external.some((u) => /\b(pastebin|ngrok|webhook\.site|requestbin|transfer\.sh|discord(app)?\.com\/api\/webhooks|bit\.ly|tinyurl)\b/i.test(u)))
+        add({ rule: "sec/suspicious-host", pillar: "security", severity: "critical", cost: 20, message: "Links to a paste, tunnel, webhook or shortener host often used for exfiltration.", file: "SKILL.md" });
+    else if (external.some((u) => /^http:\/\//i.test(u)))
+        add({ rule: "sec/plain-http", pillar: "security", severity: "info", cost: 2, message: "Links over plain http.", file: "SKILL.md" });
+    if (scripts && !/^#{1,3} .*(script|run|tool)/im.test(body) && !others.some((f) => /\.(py|sh|js|mjs|ts)$/.test(f.path) && body.includes(rel(f.path).split("/").pop())))
+        add({ rule: "sec/undocumented-script", pillar: "security", severity: "warn", cost: 5, message: "Bundles scripts that SKILL.md never explains. Say what each script does and when it runs.", file: "SKILL.md" });
+    return finish(name, description, findings, { files: files.length, bodyLines, bodyTokens, metaTokens, referenceTokens, scripts, links: external.slice(0, 50) });
+}
+function finish(name, description, findings, stats) {
+    const pillars = { spec: PILLAR_MAX, efficiency: PILLAR_MAX, clarity: PILLAR_MAX, security: PILLAR_MAX };
+    for (const f of findings)
+        pillars[f.pillar] = Math.max(0, pillars[f.pillar] - f.cost);
+    const score = Math.round(pillars.spec + pillars.efficiency + pillars.clarity + pillars.security);
+    const critical = findings.some((f) => f.severity === "critical");
+    const grade = critical ? "F" : score >= 90 ? "A" : score >= 80 ? "B" : score >= 70 ? "C" : score >= 60 ? "D" : "F";
+    const order = { critical: 0, warn: 1, info: 2 };
+    findings.sort((a, b) => order[a.severity] - order[b.severity] || b.cost - a.cost);
+    return { name, description, score, grade, pillars, findings, stats };
+}

package/dist/scancmd.js

@@ -0,0 +1,50 @@
+import { existsSync, lstatSync, readdirSync, readFileSync } from "node:fs";
+import { join, relative, resolve } from "node:path";
+import { scanSkill } from "./scan.js";
+export const DEFAULT_SCAN_DIRS = [".claude/skills", ".agents/skills"];
+function walk(dir, base, out) {
+    for (const name of readdirSync(dir)) {
+        if (name === "node_modules" || name.startsWith("."))
+            continue;
+        const p = join(dir, name);
+        const st = lstatSync(p);
+        if (st.isSymbolicLink())
+            continue;
+        if (st.isDirectory())
+            walk(p, base, out);
+        else if (st.size < 2_000_000)
+            out.push({ path: relative(base, p).replace(/\\/g, "/"), content: readFileSync(p, "utf8") });
+    }
+}
+/** A skill folder itself, or the skill folders directly inside a folder. */
+export function skillDirs(root) {
+    if (!existsSync(root) || !lstatSync(root).isDirectory())
+        return [];
+    if (existsSync(join(root, "SKILL.md")))
+        return [root];
+    return readdirSync(root)
+        .filter((n) => !n.startsWith("."))
+        .map((n) => join(root, n))
+        .filter((p) => {
+        const st = lstatSync(p);
+        return st.isDirectory() && !st.isSymbolicLink() && existsSync(join(p, "SKILL.md"));
+    });
+}
+export function scanDirs(roots, cwd) {
+    const seen = new Set();
+    const results = [];
+    for (const root of roots) {
+        for (const dir of skillDirs(resolve(cwd, root))) {
+            if (seen.has(dir))
+                continue;
+            seen.add(dir);
+            const files = [];
+            walk(dir, join(dir, ".."), files);
+            results.push({ dir: relative(cwd, dir) || ".", report: scanSkill(files) });
+        }
+    }
+    return results;
+}
+export function isFailing(r, min) {
+    return r.report.grade === "F" || r.report.score < min;
+}

package/package.json

@@ -1,6 +1,49 @@
 {
   "name": "proskills-cli",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Install ProSkills agent skills in one command and scan any SKILL.md folder in CI.",
+  "keywords": [
+    "agent-skills",
+    "skill.md",
+    "claude-code",
+    "cursor",
+    "codex",
+    "gemini-cli",
+    "cli"
+  ],
+  "homepage": "https://proskills.dev",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/yungprimer/proskills.git",
+    "directory": "cli"
+  },
+  "bugs": {
+    "url": "https://github.com/yungprimer/proskills/issues"
+  },
+  "author": "ProSkills (https://proskills.dev)",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "proskills": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "prebuild": "node scripts/copy-scan.mjs",
+    "build": "tsc -p tsconfig.json",
+    "test": "node --test test/cli.test.mjs",
+    "prepublishOnly": "npm run build && npm test"
+  },
+  "dependencies": {
+    "jszip": "^3.10.1"
+  },
+  "devDependencies": {
+    "@types/node": "^20",
+    "typescript": "^5"
+  }
+}