skilldrop-cli 0.16.4 → 0.16.5

package/README.md

@@ -1,7 +1,6 @@
 # skilldrop
 
 [![npm](https://img.shields.io/npm/v/skilldrop-cli)](https://www.npmjs.com/package/skilldrop-cli)
-[![PyPI](https://img.shields.io/pypi/v/skilldrop-cli)](https://pypi.org/project/skilldrop-cli/)
 [![license](https://img.shields.io/badge/license-MIT%20OR%20Apache--2.0-blue.svg)](LICENSE)
 
 **Portable AI-agent skills, measured against the agent without them.** They cover the deliverables knowledge workers actually ship: ADRs, design docs, PRDs, runbooks, threat models, decks, postmortems and adversarial reviews. Each one is a folder you copy into Claude Code, Cursor, Kiro, Codex, Antigravity or Copilot.
@@ -20,7 +19,7 @@ Install one pack. Every role pack also brings `core` (intake, critique, review c
 
 - **Product managers:** `product-manager` — PR/FAQs, strategy, OKRs, business cases, PRDs, success metrics. [Open pack](https://sananthanarayan.github.io/skilldrop/packs/product-manager/)
 - **Architects:** `solution-architect` — diagrams, ADRs, design docs, API and data contracts, threat models. [Open pack](https://sananthanarayan.github.io/skilldrop/packs/solution-architect/)
-- **Software teams:** `dev-team` — story splitting, implementation with adversarial review, merge gates, launch readiness, release notes. [Open pack](https://sananthanarayan.github.io/skilldrop/packs/dev-team/)
+- **Software teams:** `dev-team` — story splitting, implementation with adversarial review, merge gates, PR descriptions, a tech-debt register, launch readiness, release notes. [Open pack](https://sananthanarayan.github.io/skilldrop/packs/dev-team/)
 - **SRE and on-call:** `sre-oncall` — observability, runbooks, incident comms, postmortems, capacity. [Open pack](https://sananthanarayan.github.io/skilldrop/packs/sre-oncall/)
 - **Explaining things to decision-makers:** `stakeholder-comms` — audience profiles, exec summaries, decision logs, guides. [Open pack](https://sananthanarayan.github.io/skilldrop/packs/stakeholder-comms/)
 - **On-brand decks and flyers:** `design` — capture your brand once, then build `.pptx` decks and print-ready flyers with your logo, colours and fonts. [Open pack](https://sananthanarayan.github.io/skilldrop/packs/design/)
@@ -31,7 +30,7 @@ Install one pack. Every role pack also brings `core` (intake, critique, review c
 - **Researching a question:** `research` — research plans, cited source synthesis, competing hypotheses. [Open pack](https://sananthanarayan.github.io/skilldrop/packs/research/)
 - **Keeping the tracker straight:** `trackers` — backlog triage, weekly status from tracker data, briefs turned into issues. [Open pack](https://sananthanarayan.github.io/skilldrop/packs/trackers/)
 - **Data and analytics:** `data-analytics` — metric definitions, SQL review, dashboard specs. [Open pack](https://sananthanarayan.github.io/skilldrop/packs/data-analytics/)
-- **Governance, risk and compliance:** `grc` — DPIAs, SOC 2 evidence maps, risk registers. [Open pack](https://sananthanarayan.github.io/skilldrop/packs/grc/)
+- **Governance, risk and compliance:** `grc` — DPIAs, SOC 2 evidence maps, risk registers, security questionnaire answers. [Open pack](https://sananthanarayan.github.io/skilldrop/packs/grc/)
 - **Infrastructure as code:** `infra-as-code` — Terraform modules with secure defaults, and plan reviews before apply. [Open pack](https://sananthanarayan.github.io/skilldrop/packs/infra-as-code/)
 - **Writing agent skills:** `skill-engineering` — author a portable skill with evals, and review one before it ships. [Open pack](https://sananthanarayan.github.io/skilldrop/packs/skill-engineering/)
 - **Everyone:** `core` on its own. [Open pack](https://sananthanarayan.github.io/skilldrop/packs/core/)
@@ -42,13 +41,6 @@ Install one pack. Every role pack also brings `core` (intake, critique, review c
 npx skilldrop-cli install --pack dev-team
 ```
 
-Prefer Python tooling? The same CLI is on PyPI. It still runs on Node, so Node 16.7 or newer has to be on your `PATH`:
-
-```bash
-pipx install skilldrop-cli        # or: pip install skilldrop-cli
-skilldrop install --pack dev-team
-```
-
 The install prints a starter prompt for the pack. For `dev-team`, ask your agent:
 
 ```text
@@ -70,7 +62,7 @@ In Claude Code you can use the plugin marketplace instead: run `/plugin marketpl
 ## Go deeper
 
 - **Use it:** [docs portal](https://sananthanarayan.github.io/skilldrop/docs/) · [a guide for every pack](guides/README.md#per-pack) · [install in any IDE](guides/how-to/install-per-ide.md) · [try skills in a repo you don't own](guides/how-to/install-per-ide.md#trying-skills-in-a-repo-you-dont-own) · [profiles](guides/how-to/profiles.md) · [hooks](guides/how-to/wire-a-hook.md)
-- **Run it in CI:** [a skill on every pull request](guides/how-to/run-a-skill-in-ci.md) · [how skills are checked](https://sananthanarayan.github.io/skilldrop/evals/) · [measure your loops](guides/how-to/measure-your-loops.md)
+- **Run it in CI:** [a skill on every pull request](guides/how-to/run-a-skill-in-ci.md) · [how skills are checked](https://sananthanarayan.github.io/skilldrop/evals/) · [benchmark skills yourself](guides/how-to/benchmark-skills.md) · [measure your loops](guides/how-to/measure-your-loops.md)
 - **Roll it out:** [across your org, including an internal mirror](guides/how-to/enterprise-distribution.md) · [publish your own catalogue](guides/how-to/publish-a-catalogue.md) · [security and the OWASP Top 10s](guides/reference/owasp-mapping.md)
 - **Reviewers:** three subagents that push back on generated work: `devils-advocate`, `security-reviewer` and `code-quality`. See [`agents/`](agents/README.md).
 - **Cost:** each skill declares a provider-neutral model tier (`light`, `standard` or `heavy`). See [MODEL-ROUTING.md](MODEL-ROUTING.md).

package/catalogue.json

@@ -44,7 +44,7 @@
     },
     "build-and-review-software": {
       "for": "Software teams · coding agents",
-      "description": "The loop around the code itself: supervised implementation, adversarial review panels, test plans, triage, accessibility and static-analysis passes, and the policy files agents read.",
+      "description": "The loop around the code itself: supervised implementation, adversarial review panels, test plans, triage, pull request descriptions, a ranked technical-debt register, accessibility and static-analysis passes, and the policy files agents read.",
       "skills": [
         "feature-implement-loop",
         "pre-merge-review",
@@ -170,7 +170,7 @@
     },
     "manage-risk-and-compliance": {
       "for": "Compliance, privacy and risk leads",
-      "description": "Prepare the material compliance asks for: a data protection impact assessment, a SOC 2 evidence map, and a risk register with owners and review dates.",
+      "description": "Prepare the material compliance asks for: a data protection impact assessment, a SOC 2 evidence map, a risk register with owners and review dates, and answers to a customer's security questionnaire with the evidence behind each.",
       "skills": [
         "dpia",
         "risk-register",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skilldrop-cli",
-  "version": "0.16.4",
+  "version": "0.16.5",
   "description": "Portable AI-agent skills, measured against the agent without them. ADRs, PRDs, runbooks, decks and reviews, installable into Claude Code, Cursor, Kiro, and any IDE that takes custom instructions. One command per skill or per role-based pack.",
   "author": {
     "name": "Sanjay Ananthanarayan",

package/packs/dev-team/pack.json

@@ -1,5 +1,5 @@
 {
-  "description": "Build-and-ship: story splitting, implementation with adversarial review, test plans, triage, migrations, launch readiness, release notes, agent-policy files, and code-quality gates.",
+  "description": "Build-and-ship: story splitting, implementation with adversarial review, test plans, triage, pull request descriptions, a ranked technical-debt register, migrations, launch readiness, release notes, agent-policy files, and code-quality gates.",
   "display_name": "Dev team",
   "keywords": ["review", "merge", "testing", "release", "code-quality"],
   "links": {

package/packs/grc/pack.json

@@ -1,5 +1,5 @@
 {
-  "description": "Governance, risk and compliance drafts for compliance leads, DPOs and risk owners: a risk register with a checked heat map, a GDPR data protection impact assessment, and a SOC 2 control-to-evidence map, each prepared for a qualified person to review.",
+  "description": "Governance, risk and compliance drafts for compliance leads, DPOs and risk owners: a risk register with a checked heat map, a GDPR data protection impact assessment, a SOC 2 control-to-evidence map, and answers to a customer security questionnaire drawn from your own evidence, each prepared for a qualified person to review.",
   "display_name": "Governance, risk and compliance",
   "keywords": ["grc", "risk register", "dpia", "gdpr", "soc 2", "compliance", "audit evidence", "privacy"],
   "links": {
@@ -45,6 +45,12 @@
         "you_do": "Name the criteria in scope, Type I or Type II, the audit period, and your controls and systems.",
         "you_get": "A control-to-criteria map with the evidence an auditor will ask for, where it lives, who owns it, how often it is produced, and the gaps, as a table and a CSV."
       },
+      {
+        "skill": "security-questionnaire-response",
+        "you_do": "When a customer sends a security questionnaire, give it the form and your policies, audit report and earlier answers.",
+        "you_get": "The customer's form filled in, with the document behind each answer, the questions your evidence doesn't cover marked as needing input, and conflicts and stale evidence flagged.",
+        "decide": "What the security owner confirms, corrects or declines to answer before it is sent."
+      },
       {
         "skill": "doc-critique",
         "you_do": "Run it on the DPIA or the evidence map before it goes to the DPO or the auditor.",