skillmds 1.0.15 → 1.0.17

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 All notable changes to `skillmds` are documented here. Versions follow [semver](https://semver.org).
 
+## 1.0.16
+
+- **Installs are no longer gated on verification.** Any skill installs directly — verified or not — with no flag, no prompt, and no second step, from both the CLI (`skillmd add`) and the MCP `skillmd_install` tool. Security flags (network_calls, executes_scripts, reads_secrets, docs_only) are still shown on the result as information, but never block. `--deny <flag>` remains available as an opt-in for anyone who wants to exclude a flag; `--allow-unverified` is now a no-op kept for backward compatibility.
+
 ## 1.0.15
 
 - Search is now **browsable in the interactive menu**: arrow through results, press Enter on one to see a card, and install it to your project or user directory — all without leaving the CLI (`← Back` at each level; Esc goes up one step, never quits).

package/bin/skillmd-mcp.mjs

@@ -1,4 +1,4 @@
-#!/usr/bin/env node
+#!/usr/bin/env node
 // SkillMD MCP server (stdio). Wraps the public SkillMD API so any MCP-capable agent
 // can search, fetch, install, and discover Agent Skills by name or task.
 //
@@ -14,7 +14,7 @@ import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprot
 import { mkdir, writeFile } from "node:fs/promises";
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join, resolve } from "node:path";
+import { join, resolve, dirname, sep } from "node:path";
 import { stringify as stringifyYaml } from "yaml";
 
 const VERSION = (() => {
@@ -70,13 +70,12 @@ const TOOLS = [
   {
     name: "skillmd_install",
     description:
-      "Install a skill by slug: validates it, then writes its SKILL.md into the agent's skills directory. Never executes any scripts. Unverified skills are refused unless allow_unverified is true. Do not set allow_unverified on your own initiative — only after the human has explicitly approved installing this specific unverified skill.",
+      "Install a skill by slug: writes its SKILL.md into the agent's skills directory. Never executes any scripts. Any skill installs; the response reports its security flags (docs_only / network_calls / executes_scripts / reads_secrets) as information.",
     inputSchema: {
       type: "object",
       properties: {
         slug: { type: "string", description: "owner/name, e.g. anthropic/pdf" },
         dest: { type: "string", description: "Target skills dir. Default ~/.claude/skills" },
-        allow_unverified: { type: "boolean", description: "Install even if the skill is not verified by SkillMD. Never set this on your own initiative — only after the human has explicitly approved this specific skill." },
       },
       required: ["slug"],
     },
@@ -193,13 +192,8 @@ async function handleCall(name, args) {
       }
       const skill = await api(`/api/skills/${owner}/${slugName}`);
       const flags = skill.security_flags ?? [];
-      if (skill.verified === false && !args.allow_unverified) {
-        return text(
-          `Refused: ${args.slug} is not yet verified by SkillMD (security flags: ${flags.join(", ") || "unscanned"}). ` +
-          `Review it at https://skillmd.com/skills/${args.slug}. Only call skillmd_install again with allow_unverified: true ` +
-          `if the human explicitly approves installing this specific unverified skill — do not decide this yourself.`,
-        );
-      }
+      // Verification never gates installs — any skill installs; flags are
+      // reported in the response as information, not a wall.
       const raw = reconstructSkillMd(skill); // returns raw_md verbatim when the registry has it
       if (lint) {
         const result = lint(raw, { slug: slugName });
@@ -211,13 +205,45 @@ async function handleCall(name, args) {
       const baseDir = args.dest ? resolve(args.dest) : join(homedir(), ".claude", "skills");
       const dir = join(baseDir, slugName);
       await mkdir(dir, { recursive: true });
-      const file = join(dir, "SKILL.md");
-      await writeFile(file, raw, "utf8");
+      const root = resolve(dir);
+
+      // Zip-slip guard: refuse any path that resolves outside the skill's dir.
+      const writeSafe = async (relPath, contents) => {
+        const fp = resolve(dir, relPath);
+        if (fp !== root && !fp.startsWith(root + sep)) throw new Error(`unsafe path: ${relPath}`);
+        await mkdir(dirname(fp), { recursive: true });
+        await writeFile(fp, contents);
+      };
+
+      let written = 1;
+      let note = "";
+      if (skill.type === "pack") {
+        // Pull the full pack (SKILL.md + companion files) in one call. The JSON
+        // bundle avoids adding an unzip dependency to this standalone binary.
+        try {
+          const bundle = await api(`/api/skills/${owner}/${slugName}/bundle?format=json`);
+          for (const f of bundle.files ?? []) {
+            if (f.path.includes("..") || f.path.startsWith("/")) continue;
+            let buf;
+            if (f.content_base64 != null) buf = Buffer.from(f.content_base64, "base64");
+            else if (f.source_url) {
+              const r = await fetch(f.source_url).catch(() => null);
+              if (!r || !r.ok) continue;
+              buf = Buffer.from(await r.arrayBuffer());
+            } else continue;
+            await writeSafe(f.path, f.path === "SKILL.md" ? raw : buf);
+          }
+          written = (bundle.files ?? []).length || 1;
+          if (!(bundle.files ?? []).some((f) => f.path === "SKILL.md")) await writeSafe("SKILL.md", raw);
+        } catch {
+          await writeSafe("SKILL.md", raw);
+          note = ` NOTE: pack assets could not be fetched — only SKILL.md was written. For the full pack run: npx skillmds add ${args.slug}`;
+        }
+      } else {
+        await writeSafe("SKILL.md", raw);
+      }
       api(`/api/skills/${owner}/${slugName}/install`, { method: "POST", body: JSON.stringify({ via: "mcp" }) }).catch(() => {});
-      const note = skill.type === "pack"
-        ? ` NOTE: this is a pack and only SKILL.md was written — its assets/references are missing. For the full pack run: npx skillmds add ${args.slug}`
-        : "";
-      return text(`Installed ${args.slug} → ${file} (security: ${flags.join(", ") || "unscanned"})${note}`);
+      return text(`Installed ${args.slug} → ${dir} (${written} file${written === 1 ? "" : "s"}; security: ${flags.join(", ") || "unscanned"})${note}`);
     }
     default:
       throw new Error(`Unknown tool: ${name}`);

package/dist/cli.js

@@ -779,7 +779,25 @@ function createClient(flags = {}) {
     }
     return await res.json();
   }
-  return { api, base, hasToken: Boolean(token) };
+  return { api, base, token, hasToken: Boolean(token) };
+}
+async function fetchBundle(base, slug, token) {
+  const headers = { accept: "application/json" };
+  if (token) headers.authorization = `Bearer ${token}`;
+  const res = await fetch(`${base}/api/skills/${slug}/bundle?format=json`, { headers }).catch(() => null);
+  if (!res || !res.ok) return null;
+  const data = await res.json().catch(() => null);
+  if (!data?.files) return null;
+  const out = [];
+  for (const f of data.files) {
+    if (f.content_base64 != null) {
+      out.push({ path: f.path, contents: Buffer.from(f.content_base64, "base64") });
+    } else if (f.source_url) {
+      const r = await fetch(f.source_url).catch(() => null);
+      if (r && r.ok) out.push({ path: f.path, contents: Buffer.from(await r.arrayBuffer()) });
+    }
+  }
+  return out;
 }
 function skillMdFor(skill) {
   if (skill.raw_md) return skill.raw_md;
@@ -894,14 +912,14 @@ function infoCommand() {
 }
 
 // ../cli/src/commands/add.ts
-import { Command as Command7 } from "commander";
+import { Command as Command7, Option } from "commander";
 import { existsSync as existsSync4 } from "fs";
 import pc7 from "picocolors";
 
 // ../cli/src/agents.ts
 import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync4, rmSync as rmSync2, symlinkSync, existsSync as existsSync3, readdirSync as readdirSync2, statSync as statSync2, readFileSync as readFileSync3 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join4, resolve as resolve2, dirname as dirname2 } from "path";
+import { join as join4, resolve as resolve2, dirname as dirname2, sep as sep2 } from "path";
 var AGENTS = [
   { id: "claude-code", segments: [".claude", "skills"] },
   { id: "cursor", segments: [".cursor", "skills"] },
@@ -927,8 +945,12 @@ function writeSkill(skillName, files, targetDir, opts = {}) {
     return dest;
   }
   mkdirSync3(dest, { recursive: true });
+  const root = resolve2(dest);
   for (const f of files) {
-    const fp = join4(dest, f.path);
+    const fp = resolve2(dest, f.path);
+    if (fp !== root && !fp.startsWith(root + sep2)) {
+      throw new Error(`refused unsafe path in skill "${skillName}": ${f.path}`);
+    }
     mkdirSync3(dirname2(fp), { recursive: true });
     writeFileSync4(fp, f.contents);
   }
@@ -974,12 +996,12 @@ var defaultDeps = {
       return rs2.map((r) => ({ name: r.slug, raw: r.raw, slug: r.slug }));
     }
     if (/^[^/\s:]+\/[^/\s:]+$/.test(arg)) {
-      const { api } = createClient(flags);
+      const { api, base: apiBase, token } = createClient(flags);
       const [owner, name] = arg.split("/");
       try {
         const skill = await api(`/api/skills/${owner}/${name}`);
         const skillName = skill.slug.split("/")[1] || name;
-        const base = {
+        const meta = {
           name: skillName,
           slug: skillName,
           registrySlug: arg,
@@ -988,10 +1010,15 @@ var defaultDeps = {
           securityFlags: skill.security_flags
         };
         if (skill.type === "pack") {
+          const bundle = await fetchBundle(apiBase, arg, token);
+          if (bundle && bundle.length) {
+            const sk = bundle.find((f) => f.path === "SKILL.md");
+            return [{ ...meta, raw: sk ? sk.contents.toString("utf8") : skillMdFor(skill), files: bundle }];
+          }
           const pack = await resolvePackFiles(skill);
-          if (pack) return [{ ...base, ...pack }];
+          if (pack) return [{ ...meta, ...pack }];
         }
-        return [{ ...base, raw: skillMdFor(skill) }];
+        return [{ ...meta, raw: skillMdFor(skill) }];
       } catch {
       }
     }
@@ -1007,16 +1034,6 @@ var defaultDeps = {
       body: JSON.stringify({ via: "cli" })
     }).catch(() => {
     });
-  },
-  async confirmUnverified(c, score, secFlags) {
-    if (!process.stdin.isTTY) return false;
-    const { confirm: confirm2, isCancel: isCancel4 } = await import("@clack/prompts");
-    const ok = await confirm2({
-      message: `${c.name} is not yet verified by SkillMD (lint score ${score}${secFlags.length ? `; flags: ${secFlags.join(", ")}` : ""}). Install anyway?`,
-      initialValue: false
-    });
-    if (isCancel4(ok)) return false;
-    return ok === true;
   }
 };
 async function runAdd(arg, flags, deps = defaultDeps) {
@@ -1039,18 +1056,9 @@ async function runAdd(arg, flags, deps = defaultDeps) {
     }
     if (deniedFlags.length) {
       blocked.push({ name: c.name, reason: `denied security flags: ${deniedFlags.join(", ")}` });
-      lines.push(pc7.red(`\u2717 ${c.name} blocked \u2014 ${deniedFlags.join(", ")}`));
+      lines.push(pc7.red(`\u2717 ${c.name} blocked \u2014 you passed --deny ${deniedFlags.join(", ")}`));
       continue;
     }
-    if (c.registrySlug && c.verified === false && !flags.allowUnverified) {
-      const ok = !flags.yes && deps.confirmUnverified ? await deps.confirmUnverified(c, result.score, allFlags) : false;
-      if (!ok) {
-        blocked.push({ name: c.name, reason: "unverified registry skill (use --allow-unverified)" });
-        lines.push(pc7.yellow(`\u2717 ${c.name} blocked \u2014 not yet verified by SkillMD${allFlags.length ? ` (flags: ${allFlags.join(", ")})` : ""}`));
-        lines.push(pc7.dim(`  review at https://skillmd.com/skills/${c.registrySlug}, then re-run with --allow-unverified`));
-        continue;
-      }
-    }
     const files = c.files ?? [{ path: "SKILL.md", contents: c.raw }];
     for (const agentId of targets) {
       const dir = agentDir(agentId, scope);
@@ -1070,7 +1078,7 @@ async function runAdd(arg, flags, deps = defaultDeps) {
   return { written, blocked, exitCode, output: lines.join("\n") };
 }
 function addCommand() {
-  return new Command7("add").description("Install a skill from the registry, a GitHub repo, or a local path (lints before writing)").argument("<source>", "registry slug (owner/name), GitHub source, or local path").option("-g, --global", "install to the user directory instead of the project").option("-a, --agent <agents...>", "target specific agents").option("-s, --skill <names...>", "install only specific skills by name ('*' for all)").option("--copy", "copy files (default)", true).option("-y, --yes", "skip confirmation prompts").option("--allow-unverified", "allow installing unverified registry skills").option("--skip-lint", "install even if the skill fails lint").option("--deny <flags...>", "refuse skills with these security flags").action(async (source, opts, cmd) => {
+  return new Command7("add").description("Install a skill from the registry, a GitHub repo, or a local path (lints before writing)").argument("<source>", "registry slug (owner/name), GitHub source, or local path").option("-g, --global", "install to the user directory instead of the project").option("-a, --agent <agents...>", "target specific agents").option("-s, --skill <names...>", "install only specific skills by name ('*' for all)").option("--copy", "copy files (default)", true).option("-y, --yes", "skip confirmation prompts").addOption(new Option("--allow-unverified").hideHelp()).option("--skip-lint", "install even if the skill fails lint").option("--deny <flags...>", "refuse skills carrying any of these security flags (opt-in)").action(async (source, opts, cmd) => {
     const merged = { ...cmd.parent?.opts(), ...opts };
     const run = await runAdd(source, merged);
     console.log(run.output);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillmds",
-  "version": "1.0.15",
+  "version": "1.0.17",
   "description": "SkillMD for agents: the `skillmds` MCP server + the `skillmd` CLI (lint, scan, search, install, publish Agent Skills) from skillmd.com.",
   "type": "module",
   "bin": {