skillmds 1.0.14 → 1.0.16

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 All notable changes to `skillmds` are documented here. Versions follow [semver](https://semver.org).
 
+## 1.0.16
+
+- **Installs are no longer gated on verification.** Any skill installs directly — verified or not — with no flag, no prompt, and no second step, from both the CLI (`skillmd add`) and the MCP `skillmd_install` tool. Security flags (network_calls, executes_scripts, reads_secrets, docs_only) are still shown on the result as information, but never block. `--deny <flag>` remains available as an opt-in for anyone who wants to exclude a flag; `--allow-unverified` is now a no-op kept for backward compatibility.
+
+## 1.0.15
+
+- Search is now **browsable in the interactive menu**: arrow through results, press Enter on one to see a card, and install it to your project or user directory — all without leaving the CLI (`← Back` at each level; Esc goes up one step, never quits).
+- Search results are clean two-line entries showing the source repo's **star count** (e.g. `★ 223.7k`) instead of the placeholder rating, with the description truncated to fit your terminal.
+- Fixes for narrow terminals: result rows are width-budgeted so they don't wrap and garble the menu; the result card prints once instead of repainting on every action.
+
 ## 1.0.14
 
 - Interactive menu (`skillmds` in a terminal) no longer exits after one action — it returns to the menu until you pick **Quit**; cancelling a sub-prompt goes back to the menu instead of quitting.

package/bin/skillmd-mcp.mjs

@@ -70,13 +70,12 @@ const TOOLS = [
   {
     name: "skillmd_install",
     description:
-      "Install a skill by slug: validates it, then writes its SKILL.md into the agent's skills directory. Never executes any scripts. Unverified skills are refused unless allow_unverified is true. Do not set allow_unverified on your own initiative — only after the human has explicitly approved installing this specific unverified skill.",
+      "Install a skill by slug: writes its SKILL.md into the agent's skills directory. Never executes any scripts. Any skill installs; the response reports its security flags (docs_only / network_calls / executes_scripts / reads_secrets) as information.",
     inputSchema: {
       type: "object",
       properties: {
         slug: { type: "string", description: "owner/name, e.g. anthropic/pdf" },
         dest: { type: "string", description: "Target skills dir. Default ~/.claude/skills" },
-        allow_unverified: { type: "boolean", description: "Install even if the skill is not verified by SkillMD. Never set this on your own initiative — only after the human has explicitly approved this specific skill." },
       },
       required: ["slug"],
     },
@@ -193,13 +192,8 @@ async function handleCall(name, args) {
       }
       const skill = await api(`/api/skills/${owner}/${slugName}`);
       const flags = skill.security_flags ?? [];
-      if (skill.verified === false && !args.allow_unverified) {
-        return text(
-          `Refused: ${args.slug} is not yet verified by SkillMD (security flags: ${flags.join(", ") || "unscanned"}). ` +
-          `Review it at https://skillmd.com/skills/${args.slug}. Only call skillmd_install again with allow_unverified: true ` +
-          `if the human explicitly approves installing this specific unverified skill — do not decide this yourself.`,
-        );
-      }
+      // Verification never gates installs — any skill installs; flags are
+      // reported in the response as information, not a wall.
       const raw = reconstructSkillMd(skill); // returns raw_md verbatim when the registry has it
       if (lint) {
         const result = lint(raw, { slug: slugName });

package/dist/cli.js

@@ -795,6 +795,34 @@ ${skill.body_md || ""}`;
 }
 
 // ../cli/src/commands/search.ts
+var MAX_LINE_WIDTH = 100;
+function formatStars(n) {
+  if (n >= 1e6) {
+    const m = Math.round(n / 1e6 * 10) / 10;
+    return `${m % 1 === 0 ? m.toFixed(0) : m.toFixed(1)}M`;
+  }
+  if (n >= 1e3) {
+    const k = Math.round(n / 1e3 * 10) / 10;
+    return `${k % 1 === 0 ? k.toFixed(0) : k.toFixed(1)}k`;
+  }
+  return String(n);
+}
+function truncate(text3, width) {
+  if (text3.length <= width) return text3;
+  if (width <= 1) return "\u2026";
+  return `${text3.slice(0, width - 1).trimEnd()}\u2026`;
+}
+function formatSearchResult(item, width = process.stdout.columns ?? 80) {
+  const stars = item.repo_stars != null ? pc5.dim(`\u2605 ${formatStars(item.repo_stars)}`) : "";
+  const check = item.verified ? pc5.green("\u2713") : "";
+  const pack = item.type === "pack" ? pc5.dim("[pack]") : "";
+  const head = [pc5.bold(item.slug), stars, check, pack].filter(Boolean).join(" ");
+  const indent = "  ";
+  const lineWidth = Math.max(10, Math.min(width, MAX_LINE_WIDTH) - indent.length);
+  const desc = `${indent}${pc5.dim(truncate(item.description ?? "", lineWidth))}`;
+  return `${head}
+${desc}`;
+}
 async function runSearch(query, flags) {
   const { api } = createClient(flags);
   const params = new URLSearchParams({ q: query, limit: String(flags.limit ?? 20) });
@@ -805,13 +833,8 @@ async function runSearch(query, flags) {
   const r = await api(`/api/search?${params}`);
   const items = r.items ?? [];
   if (flags.json) return { items, output: JSON.stringify(items, null, 2) };
-  const lines = items.map((s) => {
-    const check = s.verified ? pc5.green("\u2713") : " ";
-    const rating = s.avg_rating ? pc5.dim(`\u2605${s.avg_rating.toFixed(1)} (${s.rating_count ?? 0})`) : "";
-    return `${check} ${pc5.bold(s.slug)} ${rating}
-    ${pc5.dim(s.description)}`;
-  });
-  return { items, output: lines.join("\n") || "No skills found." };
+  const lines = items.map((s) => formatSearchResult(s));
+  return { items, output: lines.join("\n\n") || "No skills found." };
 }
 function searchCommand() {
   return new Command5("search").description("Search the SkillMD registry").argument("<query>", "search terms").option("--category <slug>", "filter by category").option("--verified", "only verified skills").option("--type <type>", "single | pack").option("--min-rating <n>", "minimum average rating (0-5)").option("--limit <n>", "max results", "20").option("--json", "machine-readable output").action(async (query, opts, cmd) => {
@@ -871,7 +894,7 @@ function infoCommand() {
 }
 
 // ../cli/src/commands/add.ts
-import { Command as Command7 } from "commander";
+import { Command as Command7, Option } from "commander";
 import { existsSync as existsSync4 } from "fs";
 import pc7 from "picocolors";
 
@@ -984,16 +1007,6 @@ var defaultDeps = {
       body: JSON.stringify({ via: "cli" })
     }).catch(() => {
     });
-  },
-  async confirmUnverified(c, score, secFlags) {
-    if (!process.stdin.isTTY) return false;
-    const { confirm: confirm2, isCancel: isCancel4 } = await import("@clack/prompts");
-    const ok = await confirm2({
-      message: `${c.name} is not yet verified by SkillMD (lint score ${score}${secFlags.length ? `; flags: ${secFlags.join(", ")}` : ""}). Install anyway?`,
-      initialValue: false
-    });
-    if (isCancel4(ok)) return false;
-    return ok === true;
   }
 };
 async function runAdd(arg, flags, deps = defaultDeps) {
@@ -1016,18 +1029,9 @@ async function runAdd(arg, flags, deps = defaultDeps) {
     }
     if (deniedFlags.length) {
       blocked.push({ name: c.name, reason: `denied security flags: ${deniedFlags.join(", ")}` });
-      lines.push(pc7.red(`\u2717 ${c.name} blocked \u2014 ${deniedFlags.join(", ")}`));
+      lines.push(pc7.red(`\u2717 ${c.name} blocked \u2014 you passed --deny ${deniedFlags.join(", ")}`));
       continue;
     }
-    if (c.registrySlug && c.verified === false && !flags.allowUnverified) {
-      const ok = !flags.yes && deps.confirmUnverified ? await deps.confirmUnverified(c, result.score, allFlags) : false;
-      if (!ok) {
-        blocked.push({ name: c.name, reason: "unverified registry skill (use --allow-unverified)" });
-        lines.push(pc7.yellow(`\u2717 ${c.name} blocked \u2014 not yet verified by SkillMD${allFlags.length ? ` (flags: ${allFlags.join(", ")})` : ""}`));
-        lines.push(pc7.dim(`  review at https://skillmd.com/skills/${c.registrySlug}, then re-run with --allow-unverified`));
-        continue;
-      }
-    }
     const files = c.files ?? [{ path: "SKILL.md", contents: c.raw }];
     for (const agentId of targets) {
       const dir = agentDir(agentId, scope);
@@ -1047,7 +1051,7 @@ async function runAdd(arg, flags, deps = defaultDeps) {
   return { written, blocked, exitCode, output: lines.join("\n") };
 }
 function addCommand() {
-  return new Command7("add").description("Install a skill from the registry, a GitHub repo, or a local path (lints before writing)").argument("<source>", "registry slug (owner/name), GitHub source, or local path").option("-g, --global", "install to the user directory instead of the project").option("-a, --agent <agents...>", "target specific agents").option("-s, --skill <names...>", "install only specific skills by name ('*' for all)").option("--copy", "copy files (default)", true).option("-y, --yes", "skip confirmation prompts").option("--allow-unverified", "allow installing unverified registry skills").option("--skip-lint", "install even if the skill fails lint").option("--deny <flags...>", "refuse skills with these security flags").action(async (source, opts, cmd) => {
+  return new Command7("add").description("Install a skill from the registry, a GitHub repo, or a local path (lints before writing)").argument("<source>", "registry slug (owner/name), GitHub source, or local path").option("-g, --global", "install to the user directory instead of the project").option("-a, --agent <agents...>", "target specific agents").option("-s, --skill <names...>", "install only specific skills by name ('*' for all)").option("--copy", "copy files (default)", true).option("-y, --yes", "skip confirmation prompts").addOption(new Option("--allow-unverified").hideHelp()).option("--skip-lint", "install even if the skill fails lint").option("--deny <flags...>", "refuse skills carrying any of these security flags (opt-in)").action(async (source, opts, cmd) => {
     const merged = { ...cmd.parent?.opts(), ...opts };
     const run = await runAdd(source, merged);
     console.log(run.output);
@@ -1250,6 +1254,67 @@ function bail(v) {
   }
   return false;
 }
+async function browseSearchResults(items) {
+  const cols = process.stdout.columns ?? 80;
+  for (; ; ) {
+    const picked = await p4.select({
+      message: "Search results",
+      options: [
+        ...items.map((item2) => {
+          const starsTxt = item2.repo_stars != null ? ` \u2605${formatStars(item2.repo_stars)}` : "";
+          const checkTxt = item2.verified ? " \u2713" : "";
+          const plainLabel = `${item2.slug}${starsTxt}${checkTxt}`;
+          const label2 = `${pc12.bold(item2.slug)}${starsTxt ? pc12.dim(starsTxt) : ""}${checkTxt ? pc12.green(checkTxt) : ""}`;
+          const hintWidth = Math.max(10, cols - plainLabel.length - 6);
+          return {
+            value: item2.slug,
+            label: label2,
+            hint: truncate(item2.description ?? "", hintWidth)
+          };
+        }),
+        { value: "__back", label: "\u2190 Back to menu" }
+      ]
+    });
+    if (p4.isCancel(picked) || picked === "__back") return;
+    const item = items.find((i) => i.slug === picked);
+    if (!item) continue;
+    await browseOneResult(item);
+  }
+}
+async function browseOneResult(item) {
+  const starsTxt = item.repo_stars != null ? `\u2605 ${formatStars(item.repo_stars)} stars` : "";
+  const meta = [
+    starsTxt,
+    item.verified ? pc12.green("\u2713 verified") : "unverified",
+    item.type === "pack" ? "pack" : ""
+  ].filter(Boolean).join(" \xB7 ");
+  p4.note([item.description ?? "", pc12.dim(meta)].join("\n"), item.slug);
+  for (; ; ) {
+    const action = await p4.select({
+      message: "What next?",
+      options: [
+        { value: "project", label: "Install to this project" },
+        { value: "global", label: "Install globally (user dir)" },
+        { value: "url", label: "Show page URL" },
+        { value: "back", label: "\u2190 Back to results" }
+      ]
+    });
+    if (p4.isCancel(action) || action === "back") return;
+    if (action === "url") {
+      p4.log.message(pc12.dim(`https://skillmd.com/skills/${item.slug}`));
+      continue;
+    }
+    p4.log.step(`Installing ${item.slug}\u2026`);
+    try {
+      const run = await runAdd(item.slug, action === "global" ? { global: true } : {});
+      console.log(run.output);
+      if (run.exitCode === 0) p4.log.success("Installed.");
+      else p4.log.warn("Not installed.");
+    } catch (err) {
+      p4.log.error(err instanceof Error ? err.message : String(err));
+    }
+  }
+}
 async function runInteractive() {
   p4.intro(pc12.bgCyan(pc12.black(" skillmd ")));
   for (; ; ) {
@@ -1295,7 +1360,11 @@ async function runInteractive() {
         try {
           const run = await runSearch(String(query), { verified: Boolean(verified), limit: "20" });
           s.stop(`${run.items.length} result${run.items.length === 1 ? "" : "s"}`);
-          console.log(run.output);
+          if (run.items.length === 0) {
+            p4.log.info("No results.");
+            break;
+          }
+          await browseSearchResults(run.items);
         } catch (err) {
           s.stop(pc12.red(err instanceof Error ? err.message : String(err)));
           process.exitCode = 1;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillmds",
-  "version": "1.0.14",
+  "version": "1.0.16",
   "description": "SkillMD for agents: the `skillmds` MCP server + the `skillmd` CLI (lint, scan, search, install, publish Agent Skills) from skillmd.com.",
   "type": "module",
   "bin": {