skillmds 1.0.12 → 1.0.13

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 All notable changes to `skillmds` are documented here. Versions follow [semver](https://semver.org).
 
+## 1.0.13
+
+Safe & easy installs release.
+
+- **Packs install their full file tree.** `skillmd add owner/pack` now downloads the pack's source directory (pinned to the registry's commit; falls back to the default branch with a warning if the pin is gone upstream), so `assets/` and `references/` files referenced by SKILL.md actually exist. Hardened: symlinks are skipped, 200-file/20MB caps, temp dirs cleaned up.
+- **Unverified skills prompt instead of hard-blocking.** Interactive installs show the lint score and security flags and ask before installing; non-interactive installs (and `-y`) still require the explicit `--allow-unverified`. Blocked output links the skill's page for review.
+- **New `skillmd info <slug>`** shows verification status, security flags, rating, provenance (source repo @ commit), and the install snippet. Unknown subcommands now print a proper error instead of silently starting the MCP server.
+- **MCP `skillmd_install` gained the CLI's safety gates**: refuses unverified skills unless `allow_unverified: true` (only after explicit human approval), validates before writing, reports security flags, and guards against malformed skill names.
+- **Installs are exact.** The registry now stores the published SKILL.md verbatim (`raw_md`) and installs deliver it byte-for-byte; reconstructed frontmatter (legacy rows) is YAML-quoted so descriptions with `:`/`#`/quotes can't corrupt the file.
+- Description limit aligned with Claude Code's real spec (1024 chars, was 500) — valid skills are no longer flagged "(invalid SKILL.md)" by `skillmd list`, and `list` now says *why* a file is invalid.
+
+## 1.0.12
+
+- Registry-native `skillmd` CLI shipped inside `skillmds`: `search`, `add`, `list`, `remove`, `update`, `publish`, `login`/`logout`, plus lint/scan/rules/init. (Release notes added retroactively.)
+
 ## 1.0.11
 
 - Security flags render with full readable labels, each with its own marker: `⚑ Executes Scripts  ⚑ Calls Network  ⚑ Reads Secrets`.

package/bin/skillmd-mcp.mjs

@@ -1,232 +1,253 @@
-#!/usr/bin/env node
-// SkillMD MCP server (stdio). Wraps the public SkillMD API so any MCP-capable agent
-// can search, fetch, install, and discover Agent Skills by name or task.
-//
-//   claude mcp add skillmd -- npx -y skillmds
-//
-// Env:
-//   SKILLMD_API   override API base (default https://api.skillmd.com)
-//   SKILLMD_TOKEN  personal access token (enables skillmd_list_saved / personalized recommend)
-
-import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
-import { mkdir, writeFile } from "node:fs/promises";
-import { readFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join, resolve } from "node:path";
-
-const VERSION = (() => {
-  try {
-    return JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
-  } catch {
-    return "0.0.0";
-  }
-})();
-// Shared validation engine, bundled into ./vendor at publish time (npm run build).
-// Falls back gracefully if the vendor build is absent (e.g. running from source).
-let lint = null;
-try {
-  ({ lint } = await import("../vendor/index.js"));
-} catch {
-  /* skillmd_lint will report that validation is unavailable */
-}
-
-const API = process.env.SKILLMD_API || "https://api.skillmd.com";
-const TOKEN = process.env.SKILLMD_TOKEN || "";
-
-async function api(path, init = {}) {
-  const headers = { accept: "application/json", ...(init.headers || {}) };
-  if (TOKEN) headers.authorization = `Bearer ${TOKEN}`;
-  const res = await fetch(API + path, { ...init, headers });
-  if (!res.ok) throw new Error(`SkillMD API ${res.status} on ${path}: ${await res.text().catch(() => "")}`);
-  return res.json();
-}
-const text = (obj) => ({ content: [{ type: "text", text: typeof obj === "string" ? obj : JSON.stringify(obj, null, 2) }] });
-
-const TOOLS = [
-  {
-    name: "skillmd_search",
-    description: "Search SkillMD for Agent Skills by name, description, or task. Returns matching skills with ratings and install snippets.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        query: { type: "string", description: "Natural-language query or keywords" },
-        category: { type: "string", description: "Filter by category slug (e.g. devops, data, security)" },
-        verified_only: { type: "boolean", description: "Only verified skills" },
-        type: { type: "string", enum: ["single", "pack"], description: "single file or pack" },
-        min_rating: { type: "number", description: "Minimum average rating 0-5" },
-        limit: { type: "number", description: "Max results (default 20)" },
-      },
-      required: ["query"],
-    },
-  },
-  {
-    name: "skillmd_get",
-    description: "Fetch a single skill by slug (owner/name), including its SKILL.md body, provenance, license and security flags.",
-    inputSchema: { type: "object", properties: { slug: { type: "string", description: "owner/name, e.g. anthropic/pdf" } }, required: ["slug"] },
-  },
-  {
-    name: "skillmd_install",
-    description: "Install a skill by slug: writes its SKILL.md into the agent's skills directory. Never executes any scripts.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        slug: { type: "string", description: "owner/name, e.g. anthropic/pdf" },
-        dest: { type: "string", description: "Target skills dir. Default ~/.claude/skills" },
-      },
-      required: ["slug"],
-    },
-  },
-  {
-    name: "skillmd_trending",
-    description: "Top skills on the SkillMD leaderboard. range: '30d' or 'all'.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        range: { type: "string", enum: ["30d", "all"], description: "Time window (default all)" },
-        category: { type: "string", description: "Optional category slug" },
-        limit: { type: "number", description: "Max results (default 20)" },
-      },
-    },
-  },
-  {
-    name: "skillmd_recommend",
-    description: "Recommend skills. If based_on is given, suggests skills similar to it (same category); otherwise returns trending.",
-    inputSchema: {
-      type: "object",
-      properties: { based_on: { type: "string", description: "A slug to base recommendations on" }, limit: { type: "number" } },
-    },
-  },
-  {
-    name: "skillmd_list_saved",
-    description: "List the signed-in user's saved skills. Requires SKILLMD_TOKEN to be set.",
-    inputSchema: { type: "object", properties: {} },
-  },
-  {
-    name: "skillmd_lint",
-    description:
-      "Validate a SKILL.md against the SkillMD spec and return diagnostics, security flags, and a quality score (0-100). Pass raw SKILL.md content, or a registry slug (owner/name) to fetch and lint.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        content: { type: "string", description: "Raw SKILL.md content to validate" },
-        slug: { type: "string", description: "Registry slug owner/name to fetch and validate" },
-      },
-    },
-  },
-];
-
-function reconstructSkillMd(skill) {
-  const fm = ["---", `name: ${skill.slug.split("/")[1] || skill.title}`, `description: ${String(skill.description).replace(/\n/g, " ")}`];
-  if (skill.license) fm.push(`license: ${skill.license}`);
-  fm.push("---", "");
-  return fm.join("\n") + (skill.body_md || "");
-}
-
-async function handleCall(name, args) {
-  switch (name) {
-    case "skillmd_search": {
-      const p = new URLSearchParams({ q: args.query, limit: String(args.limit ?? 20) });
-      if (args.category) p.set("category", args.category);
-      if (args.verified_only) p.set("verified", "true");
-      if (args.type) p.set("type", args.type);
-      if (args.min_rating != null) p.set("min_rating", String(args.min_rating));
-      const r = await api(`/api/search?${p}`);
-      return text(r.items ?? []);
-    }
-    case "skillmd_get": {
-      const [owner, slugName] = String(args.slug).split("/");
-      const r = await api(`/api/skills/${owner}/${slugName}`);
-      return text(r);
-    }
-    case "skillmd_trending": {
-      const p = new URLSearchParams({ range: args.range ?? "all", limit: String(args.limit ?? 20) });
-      if (args.category) p.set("category", args.category);
-      const r = await api(`/api/leaderboard?${p}`);
-      return text(r.items ?? []);
-    }
-    case "skillmd_recommend": {
-      if (args.based_on) {
-        const [owner, slugName] = String(args.based_on).split("/");
-        const base = await api(`/api/skills/${owner}/${slugName}`).catch(() => null);
-        if (base?.category_slug) {
-          const r = await api(`/api/leaderboard?range=all&limit=${args.limit ?? 10}&category=${base.category_slug}`);
-          return text((r.items ?? []).filter((s) => s.slug !== args.based_on));
-        }
-      }
-      const r = await api(`/api/leaderboard?range=30d&limit=${args.limit ?? 10}`);
-      return text(r.items ?? []);
-    }
-    case "skillmd_list_saved": {
-      if (!TOKEN) return text("Set SKILLMD_TOKEN (a SkillMD personal access token) to list your saved skills.");
-      const r = await api(`/api/favorites`);
-      return text(r.items ?? []);
-    }
-    case "skillmd_lint": {
-      if (!lint) return text("Validation engine unavailable — run `npm run build` in the skillmds package.");
-      let raw = args.content;
-      let slug;
-      if (!raw && args.slug) {
-        const [owner, slugName] = String(args.slug).split("/");
-        const skill = await api(`/api/skills/${owner}/${slugName}`);
-        raw = reconstructSkillMd(skill);
-        slug = slugName;
-      }
-      if (!raw) return text("Provide `content` (raw SKILL.md) or `slug` (owner/name).");
-      const result = lint(raw, slug ? { slug } : {});
-      return text({ ok: result.ok, score: result.score, diagnostics: result.diagnostics, security: result.security });
-    }
-    case "skillmd_install": {
-      const [owner, slugName] = String(args.slug).split("/");
-      const skill = await api(`/api/skills/${owner}/${slugName}`);
-      const baseDir = args.dest ? resolve(args.dest) : join(homedir(), ".claude", "skills");
-      const dir = join(baseDir, slugName);
-      await mkdir(dir, { recursive: true });
-      const file = join(dir, "SKILL.md");
-      await writeFile(file, reconstructSkillMd(skill), "utf8");
-      api(`/api/skills/${owner}/${slugName}/install`, { method: "POST", body: JSON.stringify({ via: "mcp" }) }).catch(() => {});
-      const note = skill.type === "pack"
-        ? " (pack assets are not bundled yet — only SKILL.md was written)"
-        : "";
-      return text(`Installed ${args.slug} → ${file}${note}`);
-    }
-    default:
-      throw new Error(`Unknown tool: ${name}`);
-  }
-}
-
-async function startMcpServer() {
-  const server = new Server({ name: "skillmd", version: VERSION }, { capabilities: { tools: {} } });
-  server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: TOOLS }));
-  server.setRequestHandler(CallToolRequestSchema, async (req) => {
-    try {
-      return await handleCall(req.params.name, req.params.arguments ?? {});
-    } catch (e) {
-      return { isError: true, content: [{ type: "text", text: String(e?.message || e) }] };
-    }
-  });
-  const transport = new StdioServerTransport();
-  await server.connect(transport);
-  console.error("skillmd MCP server running (stdio)");
-}
-
-// This binary is invoked three ways:
-//   - `skillmds lint .` etc.      → run the CLI (so `npx skillmds <cmd>` works without -p)
-//   - `skillmds` in a terminal    → run the CLI (opens the interactive menu)
-//   - `skillmds` over piped stdio → start the MCP server (how MCP clients launch it)
-// MCP clients always connect stdin as a pipe (never a TTY), so an interactive
-// stdin is a reliable signal that a human is present.
-const CLI_COMMANDS = new Set([
-  "lint", "check", "scan", "rules", "init", "search", "add", "list", "ls",
-  "remove", "rm", "update", "publish", "submit", "login", "logout", "help",
-  "--help", "-h", "--version", "-V",
-]);
-const first = process.argv[2];
-const isCliCommand = first && CLI_COMMANDS.has(first);
-const humanInTerminal = !first && process.stdin.isTTY;
-if (isCliCommand || humanInTerminal) {
-  await import("../dist/cli.js"); // the CLI parses process.argv itself
-} else {
-  await startMcpServer();
-}
+#!/usr/bin/env node
+// SkillMD MCP server (stdio). Wraps the public SkillMD API so any MCP-capable agent
+// can search, fetch, install, and discover Agent Skills by name or task.
+//
+//   claude mcp add skillmd -- npx -y skillmds
+//
+// Env:
+//   SKILLMD_API   override API base (default https://api.skillmd.com)
+//   SKILLMD_TOKEN  personal access token (enables skillmd_list_saved / personalized recommend)
+
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+import { mkdir, writeFile } from "node:fs/promises";
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { stringify as stringifyYaml } from "yaml";
+
+const VERSION = (() => {
+  try {
+    return JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
+  } catch {
+    return "0.0.0";
+  }
+})();
+// Shared validation engine, bundled into ./vendor at publish time (npm run build).
+// Falls back gracefully if the vendor build is absent (e.g. running from source).
+let lint = null;
+try {
+  ({ lint } = await import("../vendor/index.js"));
+} catch {
+  /* skillmd_lint will report that validation is unavailable */
+}
+
+const API = process.env.SKILLMD_API || "https://api.skillmd.com";
+const TOKEN = process.env.SKILLMD_TOKEN || "";
+
+async function api(path, init = {}) {
+  const headers = { accept: "application/json", ...(init.headers || {}) };
+  if (TOKEN) headers.authorization = `Bearer ${TOKEN}`;
+  const res = await fetch(API + path, { ...init, headers });
+  if (!res.ok) throw new Error(`SkillMD API ${res.status} on ${path}: ${await res.text().catch(() => "")}`);
+  return res.json();
+}
+const text = (obj) => ({ content: [{ type: "text", text: typeof obj === "string" ? obj : JSON.stringify(obj, null, 2) }] });
+
+const TOOLS = [
+  {
+    name: "skillmd_search",
+    description: "Search SkillMD for Agent Skills by name, description, or task. Returns matching skills with ratings and install snippets.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        query: { type: "string", description: "Natural-language query or keywords" },
+        category: { type: "string", description: "Filter by category slug (e.g. devops, data, security)" },
+        verified_only: { type: "boolean", description: "Only verified skills" },
+        type: { type: "string", enum: ["single", "pack"], description: "single file or pack" },
+        min_rating: { type: "number", description: "Minimum average rating 0-5" },
+        limit: { type: "number", description: "Max results (default 20)" },
+      },
+      required: ["query"],
+    },
+  },
+  {
+    name: "skillmd_get",
+    description: "Fetch a single skill by slug (owner/name), including its SKILL.md body, provenance, license and security flags.",
+    inputSchema: { type: "object", properties: { slug: { type: "string", description: "owner/name, e.g. anthropic/pdf" } }, required: ["slug"] },
+  },
+  {
+    name: "skillmd_install",
+    description:
+      "Install a skill by slug: validates it, then writes its SKILL.md into the agent's skills directory. Never executes any scripts. Unverified skills are refused unless allow_unverified is true. Do not set allow_unverified on your own initiative — only after the human has explicitly approved installing this specific unverified skill.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        slug: { type: "string", description: "owner/name, e.g. anthropic/pdf" },
+        dest: { type: "string", description: "Target skills dir. Default ~/.claude/skills" },
+        allow_unverified: { type: "boolean", description: "Install even if the skill is not verified by SkillMD. Never set this on your own initiative — only after the human has explicitly approved this specific skill." },
+      },
+      required: ["slug"],
+    },
+  },
+  {
+    name: "skillmd_trending",
+    description: "Top skills on the SkillMD leaderboard. range: '30d' or 'all'.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        range: { type: "string", enum: ["30d", "all"], description: "Time window (default all)" },
+        category: { type: "string", description: "Optional category slug" },
+        limit: { type: "number", description: "Max results (default 20)" },
+      },
+    },
+  },
+  {
+    name: "skillmd_recommend",
+    description: "Recommend skills. If based_on is given, suggests skills similar to it (same category); otherwise returns trending.",
+    inputSchema: {
+      type: "object",
+      properties: { based_on: { type: "string", description: "A slug to base recommendations on" }, limit: { type: "number" } },
+    },
+  },
+  {
+    name: "skillmd_list_saved",
+    description: "List the signed-in user's saved skills. Requires SKILLMD_TOKEN to be set.",
+    inputSchema: { type: "object", properties: {} },
+  },
+  {
+    name: "skillmd_lint",
+    description:
+      "Validate a SKILL.md against the SkillMD spec and return diagnostics, security flags, and a quality score (0-100). Pass raw SKILL.md content, or a registry slug (owner/name) to fetch and lint.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        content: { type: "string", description: "Raw SKILL.md content to validate" },
+        slug: { type: "string", description: "Registry slug owner/name to fetch and validate" },
+      },
+    },
+  },
+];
+
+// KEEP IN SYNC with apps/cli/src/api.ts (reconstructSkillMd / skillMdFor) —
+// duplicated because the MCP bin ships as a standalone script; no automated
+// check enforces this.
+function reconstructSkillMd(skill) {
+  if (skill.raw_md) return skill.raw_md;
+  const fm = { name: skill.slug.split("/")[1] || skill.title, description: String(skill.description).replace(/\n/g, " ") };
+  if (skill.license) fm.license = skill.license;
+  return `---\n${stringifyYaml(fm)}---\n${skill.body_md || ""}`;
+}
+
+async function handleCall(name, args) {
+  switch (name) {
+    case "skillmd_search": {
+      const p = new URLSearchParams({ q: args.query, limit: String(args.limit ?? 20) });
+      if (args.category) p.set("category", args.category);
+      if (args.verified_only) p.set("verified", "true");
+      if (args.type) p.set("type", args.type);
+      if (args.min_rating != null) p.set("min_rating", String(args.min_rating));
+      const r = await api(`/api/search?${p}`);
+      return text(r.items ?? []);
+    }
+    case "skillmd_get": {
+      const [owner, slugName] = String(args.slug).split("/");
+      const r = await api(`/api/skills/${owner}/${slugName}`);
+      return text(r);
+    }
+    case "skillmd_trending": {
+      const p = new URLSearchParams({ range: args.range ?? "all", limit: String(args.limit ?? 20) });
+      if (args.category) p.set("category", args.category);
+      const r = await api(`/api/leaderboard?${p}`);
+      return text(r.items ?? []);
+    }
+    case "skillmd_recommend": {
+      if (args.based_on) {
+        const [owner, slugName] = String(args.based_on).split("/");
+        const base = await api(`/api/skills/${owner}/${slugName}`).catch(() => null);
+        if (base?.category_slug) {
+          const r = await api(`/api/leaderboard?range=all&limit=${args.limit ?? 10}&category=${base.category_slug}`);
+          return text((r.items ?? []).filter((s) => s.slug !== args.based_on));
+        }
+      }
+      const r = await api(`/api/leaderboard?range=30d&limit=${args.limit ?? 10}`);
+      return text(r.items ?? []);
+    }
+    case "skillmd_list_saved": {
+      if (!TOKEN) return text("Set SKILLMD_TOKEN (a SkillMD personal access token) to list your saved skills.");
+      const r = await api(`/api/favorites`);
+      return text(r.items ?? []);
+    }
+    case "skillmd_lint": {
+      if (!lint) return text("Validation engine unavailable — run `npm run build` in the skillmds package.");
+      let raw = args.content;
+      let slug;
+      if (!raw && args.slug) {
+        const [owner, slugName] = String(args.slug).split("/");
+        const skill = await api(`/api/skills/${owner}/${slugName}`);
+        raw = reconstructSkillMd(skill);
+        slug = slugName;
+      }
+      if (!raw) return text("Provide `content` (raw SKILL.md) or `slug` (owner/name).");
+      const result = lint(raw, slug ? { slug } : {});
+      return text({ ok: result.ok, score: result.score, diagnostics: result.diagnostics, security: result.security });
+    }
+    case "skillmd_install": {
+      const [owner, slugName] = String(args.slug).split("/");
+      // Defense in depth: slugName becomes a directory name below — refuse
+      // anything outside the registry's slugify alphabet (path separators,
+      // "..", etc.) before touching the network or filesystem.
+      if (!/^[a-z0-9][a-z0-9-]*$/.test(slugName ?? "")) {
+        return text(`Refused: invalid skill name "${slugName}" — expected a lowercase slug.`);
+      }
+      const skill = await api(`/api/skills/${owner}/${slugName}`);
+      const flags = skill.security_flags ?? [];
+      if (skill.verified === false && !args.allow_unverified) {
+        return text(
+          `Refused: ${args.slug} is not yet verified by SkillMD (security flags: ${flags.join(", ") || "unscanned"}). ` +
+          `Review it at https://skillmd.com/skills/${args.slug}. Only call skillmd_install again with allow_unverified: true ` +
+          `if the human explicitly approves installing this specific unverified skill — do not decide this yourself.`,
+        );
+      }
+      const raw = reconstructSkillMd(skill); // returns raw_md verbatim when the registry has it
+      if (lint) {
+        const result = lint(raw, { slug: slugName });
+        if (!result.ok) {
+          const errors = result.diagnostics.filter((d) => d.severity === "error");
+          return text(`Refused: ${args.slug} failed validation (${errors.map((d) => `${d.id}: ${d.message}`).join("; ")}). Not installed.`);
+        }
+      }
+      const baseDir = args.dest ? resolve(args.dest) : join(homedir(), ".claude", "skills");
+      const dir = join(baseDir, slugName);
+      await mkdir(dir, { recursive: true });
+      const file = join(dir, "SKILL.md");
+      await writeFile(file, raw, "utf8");
+      api(`/api/skills/${owner}/${slugName}/install`, { method: "POST", body: JSON.stringify({ via: "mcp" }) }).catch(() => {});
+      const note = skill.type === "pack"
+        ? ` NOTE: this is a pack and only SKILL.md was written — its assets/references are missing. For the full pack run: npx skillmds add ${args.slug}`
+        : "";
+      return text(`Installed ${args.slug} → ${file} (security: ${flags.join(", ") || "unscanned"})${note}`);
+    }
+    default:
+      throw new Error(`Unknown tool: ${name}`);
+  }
+}
+
+async function startMcpServer() {
+  const server = new Server({ name: "skillmd", version: VERSION }, { capabilities: { tools: {} } });
+  server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: TOOLS }));
+  server.setRequestHandler(CallToolRequestSchema, async (req) => {
+    try {
+      return await handleCall(req.params.name, req.params.arguments ?? {});
+    } catch (e) {
+      return { isError: true, content: [{ type: "text", text: String(e?.message || e) }] };
+    }
+  });
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+  console.error("skillmd MCP server running (stdio)");
+}
+
+// This binary is invoked three ways:
+//   - `skillmds <anything>`       → run the CLI. commander owns argv, so known
+//     commands run and unknown commands get a proper "unknown command" error
+//     instead of silently starting an MCP server.
+//   - `skillmds` in a terminal    → run the CLI (opens the interactive menu)
+//   - `skillmds` over piped stdio → start the MCP server (how MCP clients launch it;
+//     they always connect stdin as a pipe, never a TTY, and pass no args)
+if (process.argv.length > 2 || process.stdin.isTTY) {
+  await import("../dist/cli.js"); // the CLI parses process.argv itself
+} else {
+  await startMcpServer();
+}

package/dist/cli.js

@@ -1,5 +1,5 @@
 // ../cli/src/index.ts
-import { Command as Command12 } from "commander";
+import { Command as Command13 } from "commander";
 import { readFileSync as readFileSync4 } from "fs";
 
 // ../cli/src/commands/lint.ts
@@ -13,7 +13,7 @@ import * as p from "@clack/prompts";
 // ../../packages/core/src/parse.ts
 import { parse as parseYaml } from "yaml";
 var MAX_SKILL_BYTES = 256 * 1024;
-var MAX_DESCRIPTION = 500;
+var MAX_DESCRIPTION = 1024;
 var MAX_NAME = 120;
 var slugify = (s) => String(s).toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60) || "skill";
 function parseSkillMd(raw, type = "single") {
@@ -30,7 +30,7 @@ function parseSkillMd(raw, type = "single") {
   const description = String(fm.description ?? "").replace(/\s+/g, " ").trim();
   if (!name) return { error: "frontmatter 'name' is required" };
   if (!description) return { error: "frontmatter 'description' is required" };
-  if (description.length > MAX_DESCRIPTION) return { error: "description must be <= 500 chars" };
+  if (description.length > MAX_DESCRIPTION) return { error: `description must be <= ${MAX_DESCRIPTION} chars` };
   return {
     name: name.slice(0, MAX_NAME),
     description: description.slice(0, MAX_DESCRIPTION),
@@ -92,7 +92,7 @@ var RULES2 = [
   {
     id: "SK003",
     severity: "error",
-    description: "description must be present and \u2264 500 chars",
+    description: "description must be present and \u2264 1024 chars",
     check(s, _ctx) {
       const out = [];
       if (!s.description.trim()) out.push(diag(this, "frontmatter 'description' is required"));
@@ -284,9 +284,9 @@ function toGithub(results) {
 }
 
 // ../cli/src/source.ts
-import { existsSync, statSync, readFileSync, readdirSync, mkdtempSync } from "fs";
+import { existsSync, statSync, lstatSync, readFileSync, readdirSync, mkdtempSync, rmSync } from "fs";
 import { tmpdir } from "os";
-import { join, basename, dirname } from "path";
+import { join, basename, dirname, relative, sep } from "path";
 var IGNORE_DIRS = /* @__PURE__ */ new Set([
   // build/dependency dirs
   "node_modules",
@@ -357,6 +357,44 @@ async function resolveSource(arg) {
   if (files.length === 0) throw new Error(`No SKILL.md found in ${arg}`);
   return files.map(loadLocal);
 }
+var MAX_PACK_FILES = 200;
+var MAX_PACK_BYTES = 20 * 1024 * 1024;
+function collectFiles(root, dir, limits = {}) {
+  const maxFiles = limits.maxFiles ?? MAX_PACK_FILES;
+  const maxBytes = limits.maxBytes ?? MAX_PACK_BYTES;
+  const out = [];
+  let bytes = 0;
+  const walk = (d, depth) => {
+    if (depth > MAX_DEPTH) return;
+    for (const entry of readdirSync(d, { withFileTypes: true })) {
+      const fp = join(d, entry.name);
+      const st = lstatSync(fp);
+      if (st.isSymbolicLink()) continue;
+      if (st.isDirectory()) {
+        if (entry.name === ".git" || entry.name === "node_modules") continue;
+        walk(fp, depth + 1);
+      } else if (st.isFile()) {
+        if (out.length >= maxFiles) throw new Error(`pack too large: > ${maxFiles} files`);
+        bytes += st.size;
+        if (bytes > maxBytes) throw new Error(`pack too large: > ${Math.round(maxBytes / (1024 * 1024))}MB`);
+        out.push({ path: relative(root, fp).split(sep).join("/"), contents: readFileSync(fp) });
+      }
+    }
+  };
+  walk(dir, 0);
+  return out;
+}
+async function resolveTree(sourceUrl, ref) {
+  const { downloadTemplate } = await import("giget");
+  const input = normalizeGiget(sourceUrl) + (ref ? `#${ref}` : "");
+  const dir = mkdtempSync(join(tmpdir(), "skillmd-pack-"));
+  try {
+    const { dir: out } = await downloadTemplate(input, { dir, forceClean: true });
+    return collectFiles(out, out);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
 function normalizeGiget(arg) {
   const m = arg.match(/github\.com\/([^/]+)\/([^/]+)(?:\/tree\/[^/]+\/(.+))?/);
   if (m) return `github:${m[1]}/${m[2]}${m[3] ? "/" + m[3] : ""}`;
@@ -697,6 +735,9 @@ function initCommand() {
 import { Command as Command5 } from "commander";
 import pc5 from "picocolors";
 
+// ../cli/src/api.ts
+import { stringify as stringifyYaml } from "yaml";
+
 // ../cli/src/config.ts
 import { readFileSync as readFileSync2, writeFileSync as writeFileSync3, mkdirSync as mkdirSync2 } from "fs";
 import { homedir as homedir2 } from "os";
@@ -740,12 +781,17 @@ function createClient(flags = {}) {
   }
   return { api, base, hasToken: Boolean(token) };
 }
+function skillMdFor(skill) {
+  if (skill.raw_md) return skill.raw_md;
+  return reconstructSkillMd(skill);
+}
 function reconstructSkillMd(skill) {
   const name = skill.slug.split("/")[1] || skill.title;
-  const fm = ["---", `name: ${name}`, `description: ${String(skill.description).replace(/\n/g, " ")}`];
-  if (skill.license) fm.push(`license: ${skill.license}`);
-  fm.push("---", "");
-  return fm.join("\n") + (skill.body_md || "");
+  const fm = { name, description: String(skill.description).replace(/\n/g, " ") };
+  if (skill.license) fm.license = skill.license;
+  return `---
+${stringifyYaml(fm)}---
+${skill.body_md || ""}`;
 }
 
 // ../cli/src/commands/search.ts
@@ -775,13 +821,62 @@ function searchCommand() {
   });
 }
 
-// ../cli/src/commands/add.ts
+// ../cli/src/commands/info.ts
 import { Command as Command6 } from "commander";
-import { existsSync as existsSync4 } from "fs";
 import pc6 from "picocolors";
+async function runInfo(slug, flags) {
+  const [owner, name] = slug.split("/");
+  if (!owner || !name || slug.split("/").length !== 2) {
+    return { ok: false, exitCode: 1, output: pc6.red("Expected owner/name, e.g. anthropic/pdf") };
+  }
+  const { api } = createClient(flags);
+  let s;
+  try {
+    s = await api(`/api/skills/${owner}/${name}`);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (/^SkillMD API 404 /.test(message)) {
+      return { ok: false, exitCode: 1, output: pc6.red(`Skill not found on the registry: ${slug}`) };
+    }
+    return { ok: false, exitCode: 1, output: pc6.red(`Could not reach the SkillMD registry: ${message}`) };
+  }
+  if (flags.json) return { ok: true, exitCode: 0, output: JSON.stringify(s, null, 2), skill: s };
+  const lines = [];
+  lines.push(
+    `${pc6.bold(s.slug)} ${pc6.dim(`[${s.type ?? "single"}]`)} ${s.verified ? pc6.green("\u2713 verified") : pc6.yellow("unverified")}`
+  );
+  lines.push(`  ${s.description}`);
+  lines.push(
+    pc6.dim(
+      `  category: ${s.category ?? "-"} \xB7 rating: ${s.avg_rating != null ? s.avg_rating.toFixed(1) : "-"} (${s.rating_count ?? 0}) \xB7 installs: ${s.install_count ?? 0}`
+    )
+  );
+  lines.push(
+    pc6.dim(`  security: ${(s.security_flags ?? []).join(", ") || "unscanned"} \xB7 license: ${s.provenance?.license ?? s.license ?? "unknown"}`)
+  );
+  const sourceRepo = s.provenance?.source_repo ?? s.source_repo;
+  const commitSha = s.provenance?.commit_sha ?? s.commit_sha;
+  if (sourceRepo) lines.push(pc6.dim(`  source: ${sourceRepo}${commitSha ? ` @ ${commitSha.slice(0, 8)}` : ""}`));
+  lines.push(pc6.dim(`  page: https://skillmd.com/skills/${s.slug}`));
+  lines.push(pc6.dim(`  install: ${s.install?.cli ?? `npx skillmds add ${s.slug}`}`));
+  return { ok: true, exitCode: 0, output: lines.join("\n"), skill: s };
+}
+function infoCommand() {
+  return new Command6("info").description("Show registry details for a skill: verification, security flags, provenance, rating").argument("<slug>", "owner/name, e.g. anthropic/pdf").action(async (slug, _opts, cmd) => {
+    const flags = { ...cmd.parent?.opts() };
+    const run = await runInfo(slug, flags);
+    if (run.output) (run.ok ? console.log : console.error)(run.output);
+    process.exitCode = run.exitCode;
+  });
+}
+
+// ../cli/src/commands/add.ts
+import { Command as Command7 } from "commander";
+import { existsSync as existsSync4 } from "fs";
+import pc7 from "picocolors";
 
 // ../cli/src/agents.ts
-import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync4, rmSync, symlinkSync, existsSync as existsSync3, readdirSync as readdirSync2, statSync as statSync2, readFileSync as readFileSync3 } from "fs";
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync4, rmSync as rmSync2, symlinkSync, existsSync as existsSync3, readdirSync as readdirSync2, statSync as statSync2, readFileSync as readFileSync3 } from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join4, resolve as resolve2, dirname as dirname2 } from "path";
 var AGENTS = [
@@ -804,7 +899,7 @@ function writeSkill(skillName, files, targetDir, opts = {}) {
   const dest = join4(targetDir, skillName);
   if (opts.mode === "symlink" && opts.canonicalDir) {
     mkdirSync3(dirname2(dest), { recursive: true });
-    rmSync(dest, { recursive: true, force: true });
+    rmSync2(dest, { recursive: true, force: true });
     symlinkSync(resolve2(opts.canonicalDir), dest, "dir");
     return dest;
   }
@@ -812,7 +907,7 @@ function writeSkill(skillName, files, targetDir, opts = {}) {
   for (const f of files) {
     const fp = join4(dest, f.path);
     mkdirSync3(dirname2(fp), { recursive: true });
-    writeFileSync4(fp, f.contents, "utf8");
+    writeFileSync4(fp, f.contents);
   }
   return dest;
 }
@@ -835,6 +930,20 @@ function installedSkills(opts = {}) {
 function isLocalish(arg) {
   return arg === "." || arg.startsWith("./") || arg.startsWith("../") || arg.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(arg) || existsSync4(arg);
 }
+async function resolvePackFiles(skill, fetchTree = resolveTree) {
+  if (!skill.source_repo) return null;
+  const attempts = [{ ref: skill.commit_sha ?? void 0, pinMiss: false }];
+  if (skill.commit_sha) attempts.push({ ref: void 0, pinMiss: true });
+  for (const attempt of attempts) {
+    try {
+      const files = await fetchTree(skill.source_repo, attempt.ref);
+      const sk = files.find((f) => f.path === "SKILL.md");
+      if (sk) return { raw: sk.contents.toString("utf8"), files, pinMiss: attempt.pinMiss };
+    } catch {
+    }
+  }
+  return null;
+}
 var defaultDeps = {
   async resolve(arg, flags) {
     if (isLocalish(arg)) {
@@ -847,7 +956,19 @@ var defaultDeps = {
       try {
         const skill = await api(`/api/skills/${owner}/${name}`);
         const skillName = skill.slug.split("/")[1] || name;
-        return [{ name: skillName, raw: reconstructSkillMd(skill), slug: skillName, registrySlug: arg, verified: skill.verified }];
+        const base = {
+          name: skillName,
+          slug: skillName,
+          registrySlug: arg,
+          verified: skill.verified,
+          type: skill.type,
+          securityFlags: skill.security_flags
+        };
+        if (skill.type === "pack") {
+          const pack = await resolvePackFiles(skill);
+          if (pack) return [{ ...base, ...pack }];
+        }
+        return [{ ...base, raw: skillMdFor(skill) }];
       } catch {
       }
     }
@@ -863,6 +984,16 @@ var defaultDeps = {
       body: JSON.stringify({ via: "cli" })
     }).catch(() => {
     });
+  },
+  async confirmUnverified(c, score, secFlags) {
+    if (!process.stdin.isTTY) return false;
+    const { confirm: confirm2, isCancel: isCancel4 } = await import("@clack/prompts");
+    const ok = await confirm2({
+      message: `${c.name} is not yet verified by SkillMD (lint score ${score}${secFlags.length ? `; flags: ${secFlags.join(", ")}` : ""}). Install anyway?`,
+      initialValue: false
+    });
+    if (isCancel4(ok)) return false;
+    return ok === true;
   }
 };
 async function runAdd(arg, flags, deps = defaultDeps) {
@@ -876,27 +1007,39 @@ async function runAdd(arg, flags, deps = defaultDeps) {
   const targets = flags.agent?.length ? flags.agent : detectAgents(scope).length ? detectAgents(scope) : ["claude-code"];
   for (const c of candidates) {
     const result = lint(c.raw, { slug: c.slug });
-    const deniedFlags = result.security.flags.filter((f) => deny.has(f));
+    const allFlags = [.../* @__PURE__ */ new Set([...result.security.flags, ...c.securityFlags ?? []])];
+    const deniedFlags = allFlags.filter((f) => deny.has(f));
     if (!flags.skipLint && !result.ok) {
       blocked.push({ name: c.name, reason: `lint errors: ${result.diagnostics.filter((d) => d.severity === "error").map((d) => d.id).join(", ")}` });
-      lines.push(pc6.red(`\u2717 ${c.name} blocked \u2014 failed lint (use --skip-lint to override)`));
+      lines.push(pc7.red(`\u2717 ${c.name} blocked \u2014 failed lint (use --skip-lint to override)`));
       continue;
     }
     if (deniedFlags.length) {
       blocked.push({ name: c.name, reason: `denied security flags: ${deniedFlags.join(", ")}` });
-      lines.push(pc6.red(`\u2717 ${c.name} blocked \u2014 ${deniedFlags.join(", ")}`));
+      lines.push(pc7.red(`\u2717 ${c.name} blocked \u2014 ${deniedFlags.join(", ")}`));
       continue;
     }
     if (c.registrySlug && c.verified === false && !flags.allowUnverified) {
-      blocked.push({ name: c.name, reason: "unverified registry skill (use --allow-unverified)" });
-      lines.push(pc6.yellow(`\u2717 ${c.name} blocked \u2014 unverified (use --allow-unverified)`));
-      continue;
+      const ok = !flags.yes && deps.confirmUnverified ? await deps.confirmUnverified(c, result.score, allFlags) : false;
+      if (!ok) {
+        blocked.push({ name: c.name, reason: "unverified registry skill (use --allow-unverified)" });
+        lines.push(pc7.yellow(`\u2717 ${c.name} blocked \u2014 not yet verified by SkillMD${allFlags.length ? ` (flags: ${allFlags.join(", ")})` : ""}`));
+        lines.push(pc7.dim(`  review at https://skillmd.com/skills/${c.registrySlug}, then re-run with --allow-unverified`));
+        continue;
+      }
     }
+    const files = c.files ?? [{ path: "SKILL.md", contents: c.raw }];
     for (const agentId of targets) {
       const dir = agentDir(agentId, scope);
-      const out = writeSkill(c.name, [{ path: "SKILL.md", contents: c.raw }], dir, { mode: "copy" });
+      const out = writeSkill(c.name, files, dir, { mode: "copy" });
       written.push({ name: c.name, dir: out });
-      lines.push(pc6.green(`\u2713 ${c.name} \u2192 ${out}`));
+      lines.push(pc7.green(`\u2713 ${c.name} \u2192 ${out}`) + pc7.dim(` (score ${result.score}${allFlags.length ? `; ${allFlags.join(", ")}` : ""})`));
+    }
+    if (c.pinMiss) {
+      lines.push(pc7.yellow(`\u26A0 ${c.name}: pinned commit unavailable upstream \u2014 fetched the source repo's default branch instead`));
+    }
+    if (c.type === "pack" && !c.files) {
+      lines.push(pc7.yellow(`\u26A0 ${c.name} is a pack but its asset files could not be fetched \u2014 only SKILL.md was installed. It may reference missing files.`));
     }
     if (c.registrySlug) deps.fireInstall(c.registrySlug, flags);
   }
@@ -904,7 +1047,7 @@ async function runAdd(arg, flags, deps = defaultDeps) {
   return { written, blocked, exitCode, output: lines.join("\n") };
 }
 function addCommand() {
-  return new Command6("add").description("Install a skill from the registry, a GitHub repo, or a local path (lints before writing)").argument("<source>", "registry slug (owner/name), GitHub source, or local path").option("-g, --global", "install to the user directory instead of the project").option("-a, --agent <agents...>", "target specific agents").option("-s, --skill <names...>", "install only specific skills by name ('*' for all)").option("--copy", "copy files (default)", true).option("-y, --yes", "skip confirmation prompts").option("--allow-unverified", "allow installing unverified registry skills").option("--skip-lint", "install even if the skill fails lint").option("--deny <flags...>", "refuse skills with these security flags").action(async (source, opts, cmd) => {
+  return new Command7("add").description("Install a skill from the registry, a GitHub repo, or a local path (lints before writing)").argument("<source>", "registry slug (owner/name), GitHub source, or local path").option("-g, --global", "install to the user directory instead of the project").option("-a, --agent <agents...>", "target specific agents").option("-s, --skill <names...>", "install only specific skills by name ('*' for all)").option("--copy", "copy files (default)", true).option("-y, --yes", "skip confirmation prompts").option("--allow-unverified", "allow installing unverified registry skills").option("--skip-lint", "install even if the skill fails lint").option("--deny <flags...>", "refuse skills with these security flags").action(async (source, opts, cmd) => {
     const merged = { ...cmd.parent?.opts(), ...opts };
     const run = await runAdd(source, merged);
     console.log(run.output);
@@ -913,10 +1056,10 @@ function addCommand() {
 }
 
 // ../cli/src/commands/list.ts
-import { Command as Command7 } from "commander";
-import pc7 from "picocolors";
+import { Command as Command8 } from "commander";
+import pc8 from "picocolors";
 function listCommand() {
-  return new Command7("list").alias("ls").description("List installed skills across detected agents").option("-g, --global", "only global skills").option("--json", "machine-readable output").action((opts) => {
+  return new Command8("list").alias("ls").description("List installed skills across detected agents").option("-g, --global", "only global skills").option("--json", "machine-readable output").action((opts) => {
     const scope = { global: opts.global };
     const skills = installedSkills(scope);
     if (opts.json) {
@@ -929,44 +1072,44 @@ function listCommand() {
     }
     for (const s of skills) {
       const parsed = parseSkillMd(s.raw);
-      const desc = "error" in parsed ? pc7.red("(invalid SKILL.md)") : pc7.dim(parsed.description.slice(0, 80));
-      console.log(`${pc7.bold(s.name)} ${pc7.dim(`[${s.agent}/${s.scope}]`)}
+      const desc = "error" in parsed ? pc8.red(`(invalid SKILL.md \u2014 ${parsed.error})`) : pc8.dim(parsed.description.slice(0, 80));
+      console.log(`${pc8.bold(s.name)} ${pc8.dim(`[${s.agent}/${s.scope}]`)}
     ${desc}`);
     }
   });
 }
 
 // ../cli/src/commands/remove.ts
-import { Command as Command8 } from "commander";
-import { rmSync as rmSync2 } from "fs";
-import pc8 from "picocolors";
+import { Command as Command9 } from "commander";
+import { rmSync as rmSync3 } from "fs";
+import pc9 from "picocolors";
 function runRemove(names, scope = {}) {
   const installed = installedSkills(scope);
   const targets = installed.filter((s) => names.includes(s.name));
   const removed = [];
   const lines = [];
   for (const t of targets) {
-    rmSync2(t.path, { recursive: true, force: true });
+    rmSync3(t.path, { recursive: true, force: true });
     removed.push(t.path);
-    lines.push(pc8.green(`\u2713 removed ${t.name} (${t.agent})`));
+    lines.push(pc9.green(`\u2713 removed ${t.name} (${t.agent})`));
   }
   for (const n of names) {
-    if (!targets.some((t) => t.name === n)) lines.push(pc8.yellow(`- ${n} not installed`));
+    if (!targets.some((t) => t.name === n)) lines.push(pc9.yellow(`- ${n} not installed`));
   }
   return { removed, output: lines.join("\n") };
 }
 function removeCommand() {
-  return new Command8("remove").alias("rm").description("Remove installed skills").argument("<names...>", "skill names to remove").option("-g, --global", "only global skills").action((names, opts) => {
+  return new Command9("remove").alias("rm").description("Remove installed skills").argument("<names...>", "skill names to remove").option("-g, --global", "only global skills").action((names, opts) => {
     const run = runRemove(names, { global: opts.global });
     console.log(run.output);
   });
 }
 
 // ../cli/src/commands/update.ts
-import { Command as Command9 } from "commander";
+import { Command as Command10 } from "commander";
 import { writeFileSync as writeFileSync5 } from "fs";
 import { join as join5 } from "path";
-import pc9 from "picocolors";
+import pc10 from "picocolors";
 async function runUpdate(names, flags, scope = {}) {
   const { api } = createClient(flags);
   const installed = installedSkills(scope).filter((s) => names.length === 0 || names.includes(s.name));
@@ -975,27 +1118,27 @@ async function runUpdate(names, flags, scope = {}) {
   for (const s of installed) {
     const slug = await findRegistrySlug(api, s);
     if (!slug) {
-      lines.push(pc9.dim(`- ${s.name} skipped (no registry match)`));
+      lines.push(pc10.dim(`- ${s.name} skipped (no registry match)`));
       continue;
     }
     try {
       const [owner, name] = slug.split("/");
       const skill = await api(`/api/skills/${owner}/${name}`);
-      const next = reconstructSkillMd(skill);
+      const next = skillMdFor(skill);
       if (next.trim() === s.raw.trim()) {
-        lines.push(pc9.dim(`- ${s.name} already up to date`));
+        lines.push(pc10.dim(`- ${s.name} already up to date`));
         continue;
       }
       const result = lint(next, { slug: s.name });
       if (!result.ok) {
-        lines.push(pc9.red(`\u2717 ${s.name} update failed lint \u2014 skipped`));
+        lines.push(pc10.red(`\u2717 ${s.name} update failed lint \u2014 skipped`));
         continue;
       }
       writeFileSync5(join5(s.path, "SKILL.md"), next, "utf8");
       updated.push(s.name);
-      lines.push(pc9.green(`\u2713 updated ${s.name}`));
+      lines.push(pc10.green(`\u2713 updated ${s.name}`));
     } catch {
-      lines.push(pc9.red(`\u2717 ${s.name} update error`));
+      lines.push(pc10.red(`\u2717 ${s.name} update error`));
     }
   }
   return { updated, output: lines.join("\n") || "Nothing to update." };
@@ -1006,7 +1149,7 @@ async function findRegistrySlug(api, s) {
   return hit?.slug ?? null;
 }
 function updateCommand() {
-  return new Command9("update").description("Update installed skills from the registry (re-lints before writing)").argument("[names...]", "specific skills to update (default: all)").option("-g, --global", "only global skills").action(async (names, opts, cmd) => {
+  return new Command10("update").description("Update installed skills from the registry (re-lints before writing)").argument("[names...]", "specific skills to update (default: all)").option("-g, --global", "only global skills").action(async (names, opts, cmd) => {
     const merged = { ...cmd.parent?.opts(), ...opts };
     const run = await runUpdate(names, merged, { global: opts.global });
     console.log(run.output);
@@ -1014,8 +1157,8 @@ function updateCommand() {
 }
 
 // ../cli/src/commands/publish.ts
-import { Command as Command10 } from "commander";
-import pc10 from "picocolors";
+import { Command as Command11 } from "commander";
+import pc11 from "picocolors";
 var defaultDeps2 = {
   resolve: resolveSource,
   async submit(payload, flags) {
@@ -1038,23 +1181,23 @@ async function runPublish(target, flags, deps = defaultDeps2) {
   const report = toText([{ file: src.path, result }], { decorate });
   if (!result.ok) {
     return { result, published: false, exitCode: 1, output: `${report}
-${pc10.red("\u2717 Refusing to publish: fix the errors above.")}` };
+${pc11.red("\u2717 Refusing to publish: fix the errors above.")}` };
   }
   const hasWarn = result.diagnostics.some((d) => d.severity === "warn");
   if (hasWarn && !flags.force) {
     return { result, published: false, exitCode: 1, output: `${report}
-${pc10.yellow("\u2717 Warnings present. Re-run with --force to publish anyway.")}` };
+${pc11.yellow("\u2717 Warnings present. Re-run with --force to publish anyway.")}` };
   }
   if (flags.dryRun) {
     return { result, published: false, exitCode: 0, output: `${report}
-${pc10.green("\u2713 Dry run: would publish.")}` };
+${pc11.green("\u2713 Dry run: would publish.")}` };
   }
   const res = await deps.submit({ content: src.raw, type: flags.type ?? "single" }, flags);
   return { result, published: true, slug: res.slug, exitCode: 0, output: `${report}
-${pc10.green(`\u2713 Published ${res.slug ?? src.slug} (status: ${res.status ?? "pending"})`)}` };
+${pc11.green(`\u2713 Published ${res.slug ?? src.slug} (status: ${res.status ?? "pending"})`)}` };
 }
 function publishCommand() {
-  return new Command10("publish").alias("submit").description("Publish a skill to the registry (refuses to publish on lint errors)").argument("[target]", "local path to the skill", ".").option("--type <type>", "single | pack", "single").option("--force", "publish despite warnings (never bypasses errors)").option("--dry-run", "lint only; do not publish").action(async (target, opts, cmd) => {
+  return new Command11("publish").alias("submit").description("Publish a skill to the registry (refuses to publish on lint errors)").argument("[target]", "local path to the skill", ".").option("--type <type>", "single | pack", "single").option("--force", "publish despite warnings (never bypasses errors)").option("--dry-run", "lint only; do not publish").action(async (target, opts, cmd) => {
     const merged = { ...cmd.parent?.opts(), ...opts };
     const run = await runPublish(target, merged);
     console.log(run.output);
@@ -1063,10 +1206,10 @@ function publishCommand() {
 }
 
 // ../cli/src/commands/login.ts
-import { Command as Command11 } from "commander";
+import { Command as Command12 } from "commander";
 import * as p3 from "@clack/prompts";
 function loginCommand() {
-  return new Command11("login").description("Store a SkillMD personal access token for publishing").option("--token <token>", "token to store (otherwise prompt)").option("--api <url>", "registry API base to store").action(async (opts) => {
+  return new Command12("login").description("Store a SkillMD personal access token for publishing").option("--token <token>", "token to store (otherwise prompt)").option("--api <url>", "registry API base to store").action(async (opts) => {
     let token = opts.token;
     if (!token) {
       const answer = await p3.password({ message: "Paste your SkillMD token (from your account page)" });
@@ -1089,7 +1232,7 @@ function loginCommand() {
   });
 }
 function logoutCommand() {
-  return new Command11("logout").description("Remove the stored SkillMD token").action(() => {
+  return new Command12("logout").description("Remove the stored SkillMD token").action(() => {
     const cfg = readConfig();
     delete cfg.token;
     writeConfig(cfg);
@@ -1099,7 +1242,7 @@ function logoutCommand() {
 
 // ../cli/src/commands/interactive.ts
 import * as p4 from "@clack/prompts";
-import pc11 from "picocolors";
+import pc12 from "picocolors";
 function bail(v) {
   if (p4.isCancel(v)) {
     p4.cancel("Cancelled.");
@@ -1108,7 +1251,7 @@ function bail(v) {
   return false;
 }
 async function runInteractive() {
-  p4.intro(pc11.bgCyan(pc11.black(" skillmd ")));
+  p4.intro(pc12.bgCyan(pc12.black(" skillmd ")));
   const action = await p4.select({
     message: "What would you like to do?",
     options: [
@@ -1135,7 +1278,7 @@ async function runInteractive() {
         console.log(run.output);
         process.exitCode = run.exitCode;
       } catch (err) {
-        s.stop(pc11.red(err instanceof Error ? err.message : String(err)));
+        s.stop(pc12.red(err instanceof Error ? err.message : String(err)));
         process.exitCode = 1;
       }
       break;
@@ -1152,7 +1295,7 @@ async function runInteractive() {
         s.stop(`${run.items.length} result${run.items.length === 1 ? "" : "s"}`);
         console.log(run.output);
       } catch (err) {
-        s.stop(pc11.red(err instanceof Error ? err.message : String(err)));
+        s.stop(pc12.red(err instanceof Error ? err.message : String(err)));
         process.exitCode = 1;
       }
       break;
@@ -1164,7 +1307,7 @@ async function runInteractive() {
       if (bail(description)) return;
       try {
         const file = initSkill(String(name), { description: String(description || "") });
-        p4.log.success(`Created ${pc11.bold(file)}`);
+        p4.log.success(`Created ${pc12.bold(file)}`);
       } catch (err) {
         p4.log.error(err instanceof Error ? err.message : String(err));
         process.exitCode = 1;
@@ -1181,8 +1324,8 @@ async function runInteractive() {
         p4.log.message(
           skills.map((sk) => {
             const parsed = parseSkillMd(sk.raw);
-            const desc = "error" in parsed ? pc11.red("(invalid)") : pc11.dim(parsed.description.slice(0, 70));
-            return `${pc11.bold(sk.name)} ${pc11.dim(`[${sk.agent}]`)}
+            const desc = "error" in parsed ? pc12.red("(invalid)") : pc12.dim(parsed.description.slice(0, 70));
+            return `${pc12.bold(sk.name)} ${pc12.dim(`[${sk.agent}]`)}
   ${desc}`;
           }).join("\n")
         );
@@ -1192,21 +1335,21 @@ async function runInteractive() {
     case "help": {
       p4.note(
         [
-          `${pc11.bold("lint")} [path]      validate SKILL.md + quality score`,
-          `${pc11.bold("scan")} [path]      security scan`,
-          `${pc11.bold("search")} <query>   search the registry`,
-          `${pc11.bold("add")} <source>     install a skill (lints first)`,
-          `${pc11.bold("init")} [name]      scaffold a new skill`,
-          `${pc11.bold("list / remove / update")}   manage installed skills`,
-          `${pc11.bold("publish")} [path]   publish (fails on lint errors)`,
-          `${pc11.bold("rules / login")}`
+          `${pc12.bold("lint")} [path]      validate SKILL.md + quality score`,
+          `${pc12.bold("scan")} [path]      security scan`,
+          `${pc12.bold("search")} <query>   search the registry`,
+          `${pc12.bold("add")} <source>     install a skill (lints first)`,
+          `${pc12.bold("init")} [name]      scaffold a new skill`,
+          `${pc12.bold("list / remove / update")}   manage installed skills`,
+          `${pc12.bold("publish")} [path]   publish (fails on lint errors)`,
+          `${pc12.bold("rules / login")}`
         ].join("\n"),
         "Commands (run: skillmd <command>)"
       );
       break;
     }
   }
-  p4.outro(pc11.dim("skillmd.com"));
+  p4.outro(pc12.dim("skillmd.com"));
 }
 
 // ../cli/src/index.ts
@@ -1215,12 +1358,13 @@ try {
   version = JSON.parse(readFileSync4(new URL("../package.json", import.meta.url), "utf8")).version;
 } catch {
 }
-var program = new Command12("skillmd").version(version).description("Lint, validate, and install Agent Skills from the SkillMD registry.").option("--json", "machine-readable output").option("--token <token>", "SkillMD personal access token").option("--api <url>", "override the registry API base URL");
+var program = new Command13("skillmd").version(version).description("Lint, validate, and install Agent Skills from the SkillMD registry.").option("--json", "machine-readable output").option("--token <token>", "SkillMD personal access token").option("--api <url>", "override the registry API base URL");
 program.addCommand(lintCommand());
 program.addCommand(scanCommand());
 program.addCommand(rulesCommand());
 program.addCommand(initCommand());
 program.addCommand(searchCommand());
+program.addCommand(infoCommand());
 program.addCommand(addCommand());
 program.addCommand(listCommand());
 program.addCommand(removeCommand());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillmds",
-  "version": "1.0.12",
+  "version": "1.0.13",
   "description": "SkillMD for agents: the `skillmds` MCP server + the `skillmd` CLI (lint, scan, search, install, publish Agent Skills) from skillmd.com.",
   "type": "module",
   "bin": {
@@ -24,11 +24,22 @@
     "llm"
   ],
   "homepage": "https://skillmd.com",
-  "bugs": { "url": "https://skillmd.com/contact" },
+  "bugs": {
+    "url": "https://skillmd.com/contact"
+  },
   "author": "SkillMD",
   "license": "MIT",
-  "files": ["bin", "dist", "vendor", "assets", "README.md", "CHANGELOG.md"],
-  "engines": { "node": ">=18" },
+  "files": [
+    "bin",
+    "dist",
+    "vendor",
+    "assets",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
   "dependencies": {
     "@clack/prompts": "^0.8.0",
     "@modelcontextprotocol/sdk": "^1.13.0",

package/vendor/index.js

@@ -1,7 +1,7 @@
 // ../../packages/core/src/parse.ts
 import { parse as parseYaml } from "yaml";
 var MAX_SKILL_BYTES = 256 * 1024;
-var MAX_DESCRIPTION = 500;
+var MAX_DESCRIPTION = 1024;
 var MAX_NAME = 120;
 var slugify = (s) => String(s).toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60) || "skill";
 function parseSkillMd(raw, type = "single") {
@@ -18,7 +18,7 @@ function parseSkillMd(raw, type = "single") {
   const description = String(fm.description ?? "").replace(/\s+/g, " ").trim();
   if (!name) return { error: "frontmatter 'name' is required" };
   if (!description) return { error: "frontmatter 'description' is required" };
-  if (description.length > MAX_DESCRIPTION) return { error: "description must be <= 500 chars" };
+  if (description.length > MAX_DESCRIPTION) return { error: `description must be <= ${MAX_DESCRIPTION} chars` };
   return {
     name: name.slice(0, MAX_NAME),
     description: description.slice(0, MAX_DESCRIPTION),
@@ -98,7 +98,7 @@ var RULES2 = [
   {
     id: "SK003",
     severity: "error",
-    description: "description must be present and \u2264 500 chars",
+    description: "description must be present and \u2264 1024 chars",
     check(s, _ctx) {
       const out = [];
       if (!s.description.trim()) out.push(diag(this, "frontmatter 'description' is required"));