skillcask 0.10.5 → 0.10.6

package/README.md

@@ -47,7 +47,8 @@ The tap was `puniserv/tap` before 0.10.5. If you installed from it, move to the
 (your app settings stay):
 
 ```sh
-brew uninstall skillcask-app skillcask   # skillcask alone if you have no app
+brew uninstall --cask puniserv/tap/skillcask-app   # skip if you have no app
+brew uninstall puniserv/tap/skillcask
 brew untap puniserv/tap
 brew install getresponse/tap/skillcask getresponse/tap/skillcask-app
 ```
@@ -189,7 +190,8 @@ allow-ranges = true      # false: every version must be exact
 packagist = true         # false: drop the implicit Packagist repository
 github-requires = false  # true: dependencies may come from GitHub or git URLs
 allow-sources = ["acme", "own", "packagist", "github"]   # only these sources; default: all
-deny-patterns = false    # true: risky patterns in new skill text fail instead of warning
+deny-patterns = false    # true: risky patterns and invisible characters in new skill text fail instead of warning
+deny-packages = ["evil/*"]   # refused by name from any source, also in a lock; default: none
 ```
 
 ### Agents
@@ -227,18 +229,28 @@ Constraints follow Composer semantics: `^0.3` means `>=0.3.0 <0.4.0`, `~1.2` mea
 
 ### Allowed sources and policy for every project
 
-`allow-sources` lists the only places skills may come from: repository names, `packagist`,
-`github`, or `https://` URL prefixes (`https://api.github.com/repos/acme/` allows one GitHub
-organisation). Other repositories get no request, and `install` refuses a lock entry from them,
-also with `--frozen`, so a committed lock cannot bring them back. Dependencies follow the same
-rule.
+`allow-sources` lists the only places skills may come from: repository names, `packagist`, `github`,
+or `https://` URL prefixes (`https://api.github.com/repos/acme/` allows one GitHub organisation).
+End a prefix with `/` (`https://gitlab.example.com/`): an entry without one also names a registry
+declared at exactly that URL, whose archives may then come from any host. Other repositories get no
+request, and `install` refuses a lock entry from them, also with `--frozen`, so a committed lock
+cannot bring them back. Dependencies follow the same rule.
+
+`deny-packages` refuses packages by name, `vendor/name` or a whole `vendor/*`, whatever source
+serves them (a GitHub `owner/repo` counts as `owner/repo`). A plain git entry is matched by its key
+in `skills.toml`, which the project picks, so limit git URLs with `allow-sources`. It is checked
+before any download and again on every lock entry, so it also stops a dependency or a committed
+lock. Enforced in `config.toml`, the list is a floor: a project may add packages to it, not drop
+any.
 
 Policy can also come from `config.toml` next to the global manifest (`~/.config/skillcask`) and
 from the environment. The first layer that sets a key wins:
 
 1. `SKILLCASK_ALLOW_SOURCES`, `SKILLCASK_MIN_RELEASE_AGE`, `SKILLCASK_ALLOW_RANGES`,
-   `SKILLCASK_PACKAGIST`, `SKILLCASK_GITHUB_REQUIRES`, `SKILLCASK_DENY_PATTERNS` (overriding an
-   enforced key prints a warning);
+   `SKILLCASK_PACKAGIST`, `SKILLCASK_GITHUB_REQUIRES`, `SKILLCASK_DENY_PATTERNS`,
+   `SKILLCASK_DENY_PACKAGES` (lists comma-separated; against an enforced key only a stricter value
+   is accepted: a longer cooldown, `deny-patterns` on, the others off, narrower sources, more
+   denied packages);
 2. keys `config.toml` lists in `enforce`: a project that sets them otherwise fails;
 3. `[policy]` in `skills.toml`;
 4. the other keys of `config.toml`, as defaults.
@@ -250,6 +262,10 @@ allow-sources = ["https://gitlab.example.com/", "github"]
 enforce = ["allow-sources"]
 ```
 
+`"github"` in an enforced `allow-sources` is public GitHub (`https://api.github.com/repos/`):
+`SKILLCASK_GITHUB_API` and `GITHUB_API_URL` do not move it. For GitHub Enterprise, enforce its
+prefix, e.g. `"https://ghe.example.com/api/v3/repos/"`.
+
 An enforced `min-release-age` also applies to a repository's own `min-release-age`: a project
 may only make it longer. Exceptions, by URL prefix, stay in `config.toml`:
 
@@ -262,6 +278,19 @@ enforce = ["min-release-age"]
 "https://gitlab.example.com/" = "0"   # internal skills, reviewed in merge requests
 ```
 
+`enforce` stops a project and its dependencies from loosening the policy for what they resolve, and
+a lock entry from a source outside an enforced `allow-sources`, or younger than an enforced or
+environment `min-release-age`, from installing. The environment, which a project's CI configuration
+also sets, may only make an enforced key stricter. A pinned version is not scanned again for `deny-
+patterns`, and its release time is what the lock says. Under `allow-sources`, a GitHub or git entry
+downloads only from its repository, and a registry the list admits only by a prefix only from inside
+the list; the archive URL of Packagist or a registry the list names (or gives by its exact URL,
+without a trailing `/`) is what the lock says, so review lock changes. `enforce` does not stop the
+person running skillcask: `SKILLCASK_HOME`, `XDG_CONFIG_HOME` or `HOME` can point at a config
+without it. For a rule nobody may skip, run `skillcask install --frozen` as a required check on pull
+requests, with the policy in the job's environment and `.github/workflows/` protected (CODEOWNERS or
+a required workflow), since a pull request runs its own copy of the workflow.
+
 `config.toml` and the environment take URL prefixes, not repository names, since a name means
 whatever a project calls it. `skillcask status` prints each key that is set and where it came
 from.
@@ -342,7 +371,7 @@ Every command except `publish`, `validate` and `projects` takes `-g, --global`.
 | `info <vendor/name[@constraint]\|github:owner/repo\|git:url\|skill>` | A package's skills, versions, description, license and requirements, or which package installs a skill. |
 | `status` | Exit 1 when manifest, lock or installed files disagree. Also lists the repositories in use (name, type, URL without credentials) and whether `allow-sources` admits each. |
 | `doctor [--fix]` | Broken or committed links, stale gitignore block, modified skills; lists each check it ran. |
-| `audit [--json\|--sarif]` | What each installed skill reaches (commands, hosts, paths, env vars, scripts) and its findings: modified files, risky lines, invisible characters. Exit 1 on any finding. |
+| `audit [--json\|--sarif] [--advisories]` | What each installed skill reaches (commands, hosts, paths, env vars, scripts) and its findings: modified files, risky lines, invisible characters; with `--advisories` also published security advisories and abandoned packages. Exit 1 on any finding. |
 | `config [key [value…]] [--unset] [--json]` | Settings with where each comes from: `[policy]` and `[agents] targets` of `skills.toml`, or with `-g` of `config.toml` (also `policy.enforce` and `search.skills-sh`). `config policy.min-release-age 5d` sets a key, `--unset` removes it, each checked before the file is written; `config edit` opens the file in `$VISUAL`/`$EDITOR` and checks it afterwards. |
 | `search [query] [--skills-sh\|--no-skills-sh [--remember]]` | Packagist (`type=ai-agent-skill`) and skill packages of the other repositories, GitLab included; with skills.sh on, also the GitHub skills it lists, as `github:owner/repo/skill` with their install count. skills.sh is off until you turn it on, since it receives the query: the first search in a terminal asks once, `--remember` saves a flag's choice (no query needed), both in `config.toml`. |
 | `auth set\|remove <host>` | Keep a registry token in git's credential helper (Keychain, Credential Manager, libsecret). |
@@ -534,25 +563,41 @@ too young falls back to an older commit when the server supports partial fetches
   | tells the agent to ignore its instructions | "ignore (all) previous/prior instructions", "disregard all previous/prior" |
 
   Skills that teach shell setup trigger some of these legitimately, so they are warnings. With
-  `deny-patterns = true` under `[policy]` (or enforced in `config.toml`) they fail the command
-  with exit 1 and nothing is written.
+  `deny-patterns = true` under `[policy]` (or enforced in `config.toml`) they, and the invisible
+  characters above, fail the command with exit 1 and nothing is written.
 - `skillcask audit` reviews what is installed now, every skill in `.agents/skills` and the project
   skills: the commands its shell code blocks run, the hosts of its URLs, the paths in the home
   directory or under system roots, the environment variables it reads and the files an agent could
-  run. That is read from the text, so it is a hint for review, not a sandbox. It also reports a
-  locked skill that differs from the lock, and every risky line and invisible character above,
-  with no limit per file, and exits 1 on any of them. `--sarif` prints a SARIF 2.1.0 log for code
-  scanning, e.g. in GitHub Actions:
+  run. That is read from the text, so it is a hint for review, not a sandbox, and a skill without
+  findings is not known to be safe. It also reports a locked skill that differs from the lock, and
+  every risky line and invisible character above, with no limit per file, and exits 1 on any of
+  them.
+- `skillcask audit --advisories` also asks the sources of the locked packages what is published
+  about them: security advisories from a Composer repository that offers them (Packagist does) and
+  from a GitHub repository's security advisories, matched against the locked version, and
+  packages marked abandoned. An entry locked at a commit has no version to match, so only
+  advisories published after that commit count. A source that cannot be read fails the run;
+  packages whose source publishes no advisories, and plain git entries, are listed as unchecked.
+  Plain `audit` stays offline. To warn users of
+  your skill, publish a GitHub security advisory on its repository (for a Composer package, with
+  the `composer` ecosystem and the package name, so Packagist lists it too).
+- `--sarif` prints a SARIF 2.1.0 log for code scanning, e.g. in GitHub Actions. Scripts a skill
+  bundles with their own dependencies (`package.json`, `requirements.txt`) are not covered by
+  `--advisories`; [OSV-Scanner](https://github.com/google/osv-scanner) checks those:
 
   ```yaml
-  - uses: GetResponse/skillcask@v0.8.0
+  - uses: GetResponse/skillcask@v0.10.5
     with:
       args: install --frozen
-  - run: skillcask audit --sarif > skills.sarif
+  - run: skillcask audit --advisories --sarif > skills.sarif
+    env:
+      GITHUB_TOKEN: ${{ github.token }}   # anonymous GitHub API calls are limited to 60 an hour
   - uses: github/codeql-action/upload-sarif@v3
     if: always()
     with:
       sarif_file: skills.sarif
+  # optional, needs osv-scanner on PATH (e.g. google/osv-scanner-action): dependencies of bundled scripts
+  - run: osv-scanner scan source -r .agents/skills
   ```
 - Plain git sources pin the commit; the lock's `dist-sha256` hashes the commit's file list
   (path, mode, sha256 of the content), so it does not depend on how a server packs objects.

package/npm-shrinkwrap.json

@@ -19,7 +19,7 @@
       "hasInstallScript": true,
       "license": "MIT OR Apache-2.0",
       "name": "skillcask",
-      "version": "0.10.5"
+      "version": "0.10.6"
     },
     "node_modules/detect-libc": {
       "engines": {
@@ -48,5 +48,5 @@
     }
   },
   "requires": true,
-  "version": "0.10.5"
+  "version": "0.10.6"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "artifactDownloadUrls": [
-    "https://github.com/GetResponse/skillcask/releases/download/v0.10.5"
+    "https://github.com/GetResponse/skillcask/releases/download/v0.10.6"
   ],
   "bin": {
     "skillcask": "run-skillcask.js"
@@ -104,7 +104,7 @@
       "zipExt": ".tar.xz"
     }
   },
-  "version": "0.10.5",
+  "version": "0.10.6",
   "volta": {
     "node": "18.14.1",
     "npm": "9.5.0"