skillmds 1.0.10 → 1.0.12

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 All notable changes to `skillmds` are documented here. Versions follow [semver](https://semver.org).
 
+## 1.0.11
+
+- Security flags render with full readable labels, each with its own marker: `⚑ Executes Scripts  ⚑ Calls Network  ⚑ Reads Secrets`.
+
 ## 1.0.10
 
 - Quality score is now a composite of spec correctness, completeness, and **security risk** — skills that read secrets, execute scripts, or make network calls score lower (a risky/stub skill is no longer a green 100).

package/bin/skillmd-mcp.mjs

@@ -5,7 +5,7 @@
 //   claude mcp add skillmd -- npx -y skillmds
 //
 // Env:
-//   SKILLMD_API   override API base (default https://skillmd-api.vinoor.workers.dev)
+//   SKILLMD_API   override API base (default https://api.skillmd.com)
 //   SKILLMD_TOKEN  personal access token (enables skillmd_list_saved / personalized recommend)
 
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
@@ -32,7 +32,7 @@ try {
   /* skillmd_lint will report that validation is unavailable */
 }
 
-const API = process.env.SKILLMD_API || "https://skillmd-api.vinoor.workers.dev";
+const API = process.env.SKILLMD_API || "https://api.skillmd.com";
 const TOKEN = process.env.SKILLMD_TOKEN || "";
 
 async function api(path, init = {}) {

package/dist/cli.js

@@ -397,11 +397,12 @@ function chips(result) {
   for (const d of result.diagnostics) bySev[d.severity].push(d.id);
   return SEV_ORDER.filter((s) => bySev[s].length).map((s) => `${GLYPH[s]} ${SEV_COLOR[s](bySev[s].join(" "))}`).join("   ");
 }
-var SEC_SHORT = {
-  network_calls: "net",
-  executes_scripts: "exec",
-  reads_secrets: "secrets"
+var SEC_LABEL = {
+  network_calls: "Calls Network",
+  executes_scripts: "Executes Scripts",
+  reads_secrets: "Reads Secrets"
 };
+var titleCase = (flag) => flag.split("_").map((w) => w[0].toUpperCase() + w.slice(1)).join(" ");
 var scoreColor = (s) => s >= 80 ? pc.green : s >= 50 ? pc.yellow : pc.red;
 function label(file) {
   const parts = file.split(/[\\/]/).filter(Boolean);
@@ -411,8 +412,9 @@ function label(file) {
 function securityFlags(result) {
   return result.security.flags.filter((f) => f !== "docs_only");
 }
-function secCodes(result) {
-  return securityFlags(result).map((f) => SEC_SHORT[f] ?? f);
+function secLabels(result) {
+  const flags = securityFlags(result);
+  return flags.map((f) => pc.magenta(`${SEC_GLYPH} ${SEC_LABEL[f] ?? titleCase(f)}`)).join("  ");
 }
 function statusDot(result) {
   if (!result.ok) return pc.red("\u25CF");
@@ -435,8 +437,8 @@ function renderOne(file, result) {
     const loc = d.line !== void 0 ? pc.dim(`:${d.line}`) : "";
     out.push(`  ${GLYPH[d.severity]} ${SEV_COLOR[d.severity](d.id)}${loc}  ${d.message}`);
   }
-  const codes = secCodes(result);
-  if (codes.length) out.push(`  ${pc.magenta(`${SEC_GLYPH} ${codes.join(", ")}`)}`);
+  const sec = secLabels(result);
+  if (sec) out.push(`  ${sec}`);
   return out.join("\n");
 }
 function renderMany(results) {
@@ -448,9 +450,9 @@ function renderMany(results) {
     const score = scoreColor(result.score)(String(result.score).padStart(3));
     const nm = names[i];
     const name = (nm.length > w ? nm.slice(0, w - 1) + "\u2026" : nm).padEnd(w);
-    const codes = secCodes(result);
-    if (codes.length) anySec = true;
-    const sec = codes.length ? `   ${pc.magenta(`${SEC_GLYPH} ${codes.join(" ")}`)}` : "";
+    const secStr = secLabels(result);
+    if (secStr) anySec = true;
+    const sec = secStr ? `   ${secStr}` : "";
     out.push(`${statusDot(result)} ${score}  ${name}  ${chips(result)}${sec}`.trimEnd());
   });
   const failed = results.filter((r) => !r.result.ok).length;
@@ -462,7 +464,7 @@ function renderMany(results) {
   if (warned) parts.push(pc.yellow(`${warned} warn`));
   if (failed) parts.push(pc.red(`${failed} fail`));
   out.push(`${parts.join(pc.dim(" \xB7 "))}   ${pc.dim("avg score")} ${scoreColor(avg)(`${avg}/100`)}`);
-  if (anySec) out.push(pc.dim("score = spec + completeness + security risk; magenta \u2691 = risky behaviour (net, exec, secrets)"));
+  if (anySec) out.push(pc.dim(`${SEC_GLYPH} = risky behaviour, factored into the score alongside spec correctness and completeness`));
   const fails = results.filter((r) => !r.result.ok);
   if (fails.length) {
     out.push("");
@@ -699,7 +701,7 @@ import pc5 from "picocolors";
 import { readFileSync as readFileSync2, writeFileSync as writeFileSync3, mkdirSync as mkdirSync2 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join3 } from "path";
-var DEFAULT_API = "https://skillmd-api.vinoor.workers.dev";
+var DEFAULT_API = "https://api.skillmd.com";
 function configPath() {
   return join3(homedir2(), ".skillmd", "config.json");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillmds",
-  "version": "1.0.10",
+  "version": "1.0.12",
   "description": "SkillMD for agents: the `skillmds` MCP server + the `skillmd` CLI (lint, scan, search, install, publish Agent Skills) from skillmd.com.",
   "type": "module",
   "bin": {