skill-check 0.1.0 → 0.1.1

package/README.md

@@ -5,11 +5,12 @@ Linter for agent skill files — validates SKILL.md files against the spec with
 ![skill-check demo](docs/assets/skill-check-demo.gif)
 
 Regenerate with `pnpm run demo:readme` (source: `scripts/readme-demo.tape`).
+The demo runs `npx skill-check .` from repo root and auto-detects skills in tool directories such as `.agents`.
 
 ## Install
 
 ```bash
-npx skill-check check .
+npx skill-check .
 ```
 
 Global install via curl:
@@ -29,6 +30,7 @@ brew install skill-check
 
 | Command | Description |
 |---|---|
+| `skill-check [path]` | Shorthand for `skill-check check [path]` |
 | `skill-check check [path]` | Run validation (and optional security scan) |
 | `skill-check new <name>` | Scaffold a new skill directory with SKILL.md template |
 | `skill-check watch [path]` | Watch for changes and re-run validation on save |
@@ -64,7 +66,7 @@ brew install skill-check
 
 **HTML reports** are written to `skill-check-report.html` (or `output.reportPath`). In an interactive terminal the report opens in your browser automatically; use `--no-open` to skip.
 
-**View locally:** `npx skill-check check . --format html` or open the file directly: `open skill-check-report.html` (macOS).
+**View locally:** `npx skill-check . --format html` or open the file directly: `open skill-check-report.html` (macOS).
 
 The `text` formatter includes quality score bars per skill, colorized severity badges, and boxed summaries.
 An ASCII CLI banner is shown in interactive text mode; set `SKILL_CHECK_NO_BANNER=1` to disable it.
@@ -131,18 +133,18 @@ npx skill-check init --interactive
 `skill-check` can validate repos or direct skills directories:
 
 ```bash
-npx skill-check check /path/to/repo
+npx skill-check /path/to/repo
 npx skill-check check ~/.claude/skills
 ```
 
 `check` runs the security scan by default.
-If dependencies are missing, `skill-check` asks before installing in interactive terminals.
-In non-interactive/CI environments, use `--allow-installs` to permit automatic installs.
+If dependencies are missing, `skill-check` automatically installs scanner dependencies by default.
+Use `--no-installs` to hard-block automatic installs.
 
 Run security scan without UV by forcing `pipx`:
 
 ```bash
-npx skill-check security-scan . --security-scan-runner pipx --allow-installs
+npx skill-check security-scan . --security-scan-runner pipx
 ```
 
 Run validation + security scan in one pipeline step with explicit runner:
@@ -346,7 +348,7 @@ All rules emit actionable `suggestion` text to guide fixes.
 Releases are automated with [semantic-release](https://github.com/semantic-release/semantic-release). Pushing to `main` (after CI passes) runs the release workflow: commits are analyzed for [Conventional Commits](https://www.conventionalcommits.org/) (`fix:`, `feat:`, `BREAKING CHANGE:`), the version is bumped, `CHANGELOG.md` is updated, the package is published to npm, and a GitHub release is created.
 
 - **Commit messages** are validated locally by [commitlint](https://commitlint.js.org/) (enforced by the `commit-msg` hook). Use `fix:`, `feat:`, `docs:`, `chore:`, etc.
-- **Secrets:** In GitHub, set the `NPM_TOKEN` repository secret (npm automation token with publish scope) so the workflow can publish to npm. `GITHUB_TOKEN` is provided automatically.
+- **npm auth:** Use [npm Trusted Publishing (OIDC)](https://docs.npmjs.com/trusted-publishers) so you don’t need `NPM_TOKEN`. On [npmjs.com](https://www.npmjs.com/) go to the **skill-check** package → **Settings** → **Trusted publishing** → add a GitHub Actions publisher with workflow filename **`publish.yml`** (exact name, including extension). Then the workflow can publish without any npm token. Alternatively, set the `NPM_TOKEN` repository secret for token-based publish.
 
 To simulate a release locally (without publishing): `pnpm run release:dry-run`. It will fail `verifyConditions` without `NPM_TOKEN` and `GITHUB_TOKEN`; in CI both are set.
 

package/dist/cli/main.js

@@ -26,6 +26,18 @@ const defaultIO = {
     stdout: (text) => process.stdout.write(text),
     stderr: (text) => process.stderr.write(text),
 };
+const ROOT_COMMANDS = new Set([
+    'check',
+    'report',
+    'security-scan',
+    'rules',
+    'new',
+    'diff',
+    'watch',
+    'init',
+    'help',
+    'version',
+]);
 function collectList(value, previous) {
     const parsed = value
         .split(',')
@@ -89,6 +101,16 @@ function parseCommaSeparated(value) {
         .map((entry) => entry.trim())
         .filter(Boolean);
 }
+function normalizeRootCommandArgs(argv) {
+    if (argv.length === 0) {
+        return argv;
+    }
+    const [first] = argv;
+    if (!first || first.startsWith('-') || ROOT_COMMANDS.has(first)) {
+        return argv;
+    }
+    return ['check', ...argv];
+}
 function normalizeCheckCommandOptions(raw) {
     return {
         fix: raw.fix === true,
@@ -190,7 +212,7 @@ function normalizeAgentScanOptions(raw) {
         mode,
         paths: selectedPaths,
         skills: selectedSkills,
-        installPolicy: denyInstalls ? 'deny' : allowInstalls ? 'allow' : 'ask',
+        installPolicy: denyInstalls ? 'deny' : 'allow',
     };
 }
 function shouldUseInteractiveUi(io) {
@@ -236,34 +258,13 @@ function renderAutoFixSummary(summary) {
     }
     return `${lines.join('\n')}\n\n`;
 }
-function formatInvocation(invocation) {
-    return [invocation.command, ...invocation.args]
-        .map((part) => (part.includes(' ') ? `"${part}"` : part))
-        .join(' ');
-}
-async function ensureSecurityScanInstallConsent(scanOptions, invocation, io, format) {
+async function ensureSecurityScanInstallConsent(scanOptions, invocation) {
     const mayInstallDependency = invocation.command !== 'mcp-scan' && !isCommandAvailable('mcp-scan');
     if (!mayInstallDependency)
         return;
     if (scanOptions.installPolicy === 'allow')
         return;
-    const guidance = 'Re-run with --allow-installs, install mcp-scan manually, or skip scan with --no-security-scan.';
-    if (scanOptions.installPolicy === 'deny') {
-        throw new CliError(`Security scan may install dependencies via ${invocation.command}. ${guidance}`, 2);
-    }
-    const interactivePromptAllowed = shouldUseInteractiveUi(io) &&
-        format === 'text' &&
-        !isTruthyFlag(process.env.CI);
-    if (!interactivePromptAllowed) {
-        throw new CliError(`Security scan may install dependencies via ${invocation.command} but interactive approval is unavailable. ${guidance}`, 2);
-    }
-    const accepted = await confirm({
-        message: `Security scan may install "mcp-scan" with: ${formatInvocation(invocation)}. Continue?`,
-        initialValue: false,
-    });
-    if (isCancel(accepted) || !accepted) {
-        throw new CliError('Security scan install was declined. Re-run with --no-security-scan or --allow-installs.', 2);
-    }
+    throw new CliError(`Security scan may install dependencies via ${invocation.command}. Re-run without --no-installs, install mcp-scan manually, or skip scan with --no-security-scan.`, 2);
 }
 async function runValidationPipeline(cwd, config, interactiveUi) {
     const useTaskUi = interactiveUi && config.output.format === 'text';
@@ -299,7 +300,7 @@ async function runAgentScanWithFeedback(scanOptions, target, io, format) {
     if (format === 'text') {
         io.stdout(`${pc.dim('Security scan engine:')} ${pc.bold('agent-scan (mcp-scan)')} ${pc.dim('via')} ${pc.cyan(invocation.command)}\n`);
     }
-    await ensureSecurityScanInstallConsent(scanOptions, invocation, io, format);
+    await ensureSecurityScanInstallConsent(scanOptions, invocation);
     if (useInteractiveFeedback) {
         ora().info('Running security scan...');
     }
@@ -696,7 +697,8 @@ export async function runCli(argv, io = defaultIO) {
         finalExitCode = 0;
     });
     try {
-        await program.parseAsync(argv, { from: 'user' });
+        const normalizedArgv = normalizeRootCommandArgs(argv);
+        await program.parseAsync(normalizedArgv, { from: 'user' });
         return finalExitCode;
     }
     catch (error) {

package/dist/core/defaults.js

@@ -6,6 +6,7 @@ export const DEFAULT_EXCLUDE = [
     '**/build/**',
     '**/.next/**',
     '**/coverage/**',
+    '**/fixtures/**',
 ];
 export const DEFAULT_LIMITS = {
     maxDescriptionChars: 1024,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skill-check",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Linter for agent skill files",
   "type": "module",
   "private": false,