skillmds 1.0.8 → 1.0.10

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to `skillmds` are documented here. Versions follow [semver](https://semver.org).
 
+## 1.0.10
+
+- Quality score is now a composite of spec correctness, completeness, and **security risk** — skills that read secrets, execute scripts, or make network calls score lower (a risky/stub skill is no longer a green 100).
+- Lint output ends with a **Failed** section listing each failure's rule, message, and full path, so problems don't scroll off in a large run.
+- New `--errors-only` flag to show only failing skills.
+- Fixed emoji spacing/overlap; rule ids are grouped by severity per skill.
+- The closer states how many skills failed instead of a vague "Problems found".
+
+## 1.0.9
+
+- Compact lint output: one line per skill (status dot, score, name, rule-id chips) with a single summary line, instead of a tall multi-row block per skill. Linting a single skill still shows full diagnostic messages.
+
 ## 1.0.8
 
 - `skillmds` with no command in a terminal now opens the interactive CLI menu; it only starts the MCP server when launched over piped stdio (how MCP clients run it). Previously a bare `npx skillmds` in a terminal appeared to hang on the silent MCP server.

package/dist/cli.js

@@ -157,12 +157,21 @@ function runRules(skill, ctx = {}) {
 
 // ../../packages/core/src/quality.ts
 var WEIGHT = {
-  error: 25,
-  warn: 8,
-  info: 2
+  error: 30,
+  warn: 10,
+  info: 3
 };
-function qualityScore(diagnostics) {
-  const penalty = diagnostics.reduce((sum, d) => sum + WEIGHT[d.severity], 0);
+var RISK = {
+  docs_only: 0,
+  reads_secrets: 25,
+  executes_scripts: 15,
+  network_calls: 8
+};
+function qualityScore(diagnostics, security) {
+  let penalty = diagnostics.reduce((sum, d) => sum + WEIGHT[d.severity], 0);
+  if (security) {
+    for (const flag of security.flags) penalty += RISK[flag] ?? 0;
+  }
   return Math.max(0, Math.min(100, 100 - penalty));
 }
 
@@ -171,18 +180,19 @@ function lint(raw, opts = {}) {
   const parsed = parseSkillMd(raw, opts.type ?? "single");
   if ("error" in parsed) {
     const diagnostics2 = [{ id: "SK001", severity: "error", message: parsed.error }];
+    const security2 = scanSecurity(raw);
     return {
       ok: false,
       diagnostics: diagnostics2,
-      security: scanSecurity(raw),
-      score: qualityScore(diagnostics2)
+      security: security2,
+      score: qualityScore(diagnostics2, security2)
     };
   }
   const ctx = opts.slug !== void 0 ? { slug: opts.slug } : {};
   const diagnostics = runRules(parsed, ctx);
   const security = scanSecurity(parsed.body);
   const ok = !diagnostics.some((d) => d.severity === "error");
-  return { ok, skill: parsed, diagnostics, security, score: qualityScore(diagnostics) };
+  return { ok, skill: parsed, diagnostics, security, score: qualityScore(diagnostics, security) };
 }
 
 // ../../packages/core/src/format/text.ts
@@ -370,40 +380,112 @@ var decorate = (text3, kind) => {
       return pc.dim(text3);
   }
 };
-var badge = {
-  error: pc.bgRed(pc.white(" ERROR ")),
-  warn: pc.bgYellow(pc.black(" WARN  ")),
-  info: pc.bgCyan(pc.black(" INFO  "))
+var SEV_COLOR = {
+  error: pc.red,
+  warn: pc.yellow,
+  info: pc.cyan
+};
+var GLYPH = {
+  error: "\u2716",
+  warn: "\u26A0",
+  info: "\u2139"
 };
-function scoreBar(score) {
-  const filled = Math.max(0, Math.min(10, Math.round(score / 10)));
-  const bar = "\u2588".repeat(filled) + "\u2591".repeat(10 - filled);
-  const color = score >= 80 ? pc.green : score >= 50 ? pc.yellow : pc.red;
-  return `${color(bar)} ${pc.bold(String(score))}${pc.dim("/100")}`;
+var SEC_GLYPH = "\u2691";
+var SEV_ORDER = ["error", "warn", "info"];
+function chips(result) {
+  const bySev = { error: [], warn: [], info: [] };
+  for (const d of result.diagnostics) bySev[d.severity].push(d.id);
+  return SEV_ORDER.filter((s) => bySev[s].length).map((s) => `${GLYPH[s]} ${SEV_COLOR[s](bySev[s].join(" "))}`).join("   ");
+}
+var SEC_SHORT = {
+  network_calls: "net",
+  executes_scripts: "exec",
+  reads_secrets: "secrets"
+};
+var scoreColor = (s) => s >= 80 ? pc.green : s >= 50 ? pc.yellow : pc.red;
+function label(file) {
+  const parts = file.split(/[\\/]/).filter(Boolean);
+  const i = parts.lastIndexOf("SKILL.md");
+  return i > 0 ? parts[i - 1] : parts[parts.length - 1] || file;
+}
+function securityFlags(result) {
+  return result.security.flags.filter((f) => f !== "docs_only");
+}
+function secCodes(result) {
+  return securityFlags(result).map((f) => SEC_SHORT[f] ?? f);
+}
+function statusDot(result) {
+  if (!result.ok) return pc.red("\u25CF");
+  const attention = result.diagnostics.some((d) => d.severity === "warn") || securityFlags(result).length > 0;
+  return attention ? pc.yellow("\u25CF") : pc.green("\u25CF");
+}
+function failureBlock(file, result) {
+  const lines = [`${pc.red("\u2716")} ${pc.bold(label(file))}`];
+  for (const d of result.diagnostics.filter((x) => x.severity === "error")) {
+    const loc = d.line !== void 0 ? pc.dim(`:${d.line}`) : "";
+    lines.push(`    ${SEV_COLOR.error(d.id)}${loc}  ${d.message}`);
+  }
+  lines.push(`    ${pc.dim(file)}`);
+  return lines.join("\n");
+}
+function renderOne(file, result) {
+  const status = result.ok ? pc.green("\u25CF PASS") : pc.red("\u25CF FAIL");
+  const out = [`${status}  ${pc.bold(label(file))}  ${pc.dim("quality")} ${scoreColor(result.score)(`${result.score}/100`)}`];
+  for (const d of result.diagnostics) {
+    const loc = d.line !== void 0 ? pc.dim(`:${d.line}`) : "";
+    out.push(`  ${GLYPH[d.severity]} ${SEV_COLOR[d.severity](d.id)}${loc}  ${d.message}`);
+  }
+  const codes = secCodes(result);
+  if (codes.length) out.push(`  ${pc.magenta(`${SEC_GLYPH} ${codes.join(", ")}`)}`);
+  return out.join("\n");
 }
-function renderReport(results) {
+function renderMany(results) {
+  const names = results.map((r) => label(r.file));
+  const w = Math.min(32, Math.max(4, ...names.map((n) => n.length)));
   const out = [];
-  for (const { file, result } of results) {
-    const status = result.ok ? pc.green("\u25CF") + pc.bold(" PASS") : pc.red("\u25CF") + pc.bold(" FAIL");
+  let anySec = false;
+  results.forEach(({ result }, i) => {
+    const score = scoreColor(result.score)(String(result.score).padStart(3));
+    const nm = names[i];
+    const name = (nm.length > w ? nm.slice(0, w - 1) + "\u2026" : nm).padEnd(w);
+    const codes = secCodes(result);
+    if (codes.length) anySec = true;
+    const sec = codes.length ? `   ${pc.magenta(`${SEC_GLYPH} ${codes.join(" ")}`)}` : "";
+    out.push(`${statusDot(result)} ${score}  ${name}  ${chips(result)}${sec}`.trimEnd());
+  });
+  const failed = results.filter((r) => !r.result.ok).length;
+  const warned = results.filter((r) => r.result.ok && r.result.diagnostics.some((d) => d.severity === "warn")).length;
+  const clean = results.length - failed - warned;
+  const avg = Math.round(results.reduce((s, r) => s + r.result.score, 0) / results.length);
+  out.push("");
+  const parts = [pc.green(`${clean} clean`)];
+  if (warned) parts.push(pc.yellow(`${warned} warn`));
+  if (failed) parts.push(pc.red(`${failed} fail`));
+  out.push(`${parts.join(pc.dim(" \xB7 "))}   ${pc.dim("avg score")} ${scoreColor(avg)(`${avg}/100`)}`);
+  if (anySec) out.push(pc.dim("score = spec + completeness + security risk; magenta \u2691 = risky behaviour (net, exec, secrets)"));
+  const fails = results.filter((r) => !r.result.ok);
+  if (fails.length) {
     out.push("");
-    out.push(`${status}  ${pc.bold(file)}`);
-    out.push(`        ${scoreBar(result.score)}`);
-    for (const d of result.diagnostics) {
-      const loc = d.line !== void 0 ? pc.dim(`:${d.line}`) : "";
-      out.push(`   ${badge[d.severity]} ${pc.dim(d.id)}${loc}  ${d.message}`);
-    }
-    const flags = result.security.flags.filter((f) => f !== "docs_only");
-    if (flags.length) out.push(`   ${pc.magenta("\u2691 security")}  ${pc.dim(flags.join(", "))}`);
+    out.push(pc.red(pc.bold(`Failed (${fails.length}):`)));
+    for (const f of fails.slice(0, 25)) out.push(failureBlock(f.file, f.result));
+    if (fails.length > 25) out.push(pc.dim(`  \u2026and ${fails.length - 25} more \u2014 run with --errors-only to see all`));
   }
-  const failed = results.filter((r) => !r.result.ok).length;
-  const passed = results.length - failed;
-  const avg = results.length ? Math.round(results.reduce((s, r) => s + r.result.score, 0) / results.length) : 0;
+  return out.join("\n");
+}
+function renderFailuresView(results) {
+  const fails = results.filter((r) => !r.result.ok);
+  if (!fails.length) return pc.green(`\u2713 No failures across ${results.length} skill${results.length === 1 ? "" : "s"}.`);
+  const out = fails.map((f) => failureBlock(f.file, f.result));
   out.push("");
-  out.push(pc.dim("\u2500".repeat(44)));
-  const tally = failed === 0 ? pc.green(`\u2713 ${passed} passed`) : `${pc.green(`${passed} passed`)}  ${pc.red(`\u2717 ${failed} failed`)}`;
-  out.push(`${tally}    ${pc.dim("avg")} ${scoreBar(avg)}`);
+  out.push(`${pc.red(`${fails.length} failed`)} ${pc.dim(`of ${results.length}`)}`);
   return out.join("\n");
 }
+function renderReport(results, opts = {}) {
+  if (results.length === 0) return pc.dim("No skills found.");
+  if (opts.errorsOnly) return renderFailuresView(results);
+  if (results.length === 1) return renderOne(results[0].file, results[0].result);
+  return renderMany(results);
+}
 function exitCodeFor(results, policy = {}) {
   for (const { result } of results) {
     const hasError = result.diagnostics.some((d) => d.severity === "error");
@@ -449,12 +531,12 @@ async function runLint(target, flags) {
       output = toGithub(results);
       break;
     default:
-      output = renderReport(results);
+      output = renderReport(results, { errorsOnly: flags.errorsOnly });
   }
   return { results, output, exitCode };
 }
 function lintCommand() {
-  return new Command("lint").alias("check").description("Validate SKILL.md file(s) against the spec and report a quality score").argument("[target]", "local path or GitHub source", ".").option("--format <fmt>", "text | json | sarif | github", "text").option("--strict", "treat warnings as errors").option("--fail-on-warning", "exit non-zero when warnings exist").option("--fix", "apply safe automatic fixes (e.g. add missing license)").action(async (target, opts) => {
+  return new Command("lint").alias("check").description("Validate SKILL.md file(s) against the spec and report a quality score").argument("[target]", "local path or GitHub source", ".").option("--format <fmt>", "text | json | sarif | github", "text").option("--strict", "treat warnings as errors").option("--fail-on-warning", "exit non-zero when warnings exist").option("--fix", "apply safe automatic fixes (e.g. add missing license)").option("--errors-only", "show only skills that failed").action(async (target, opts) => {
     const ui = Boolean(process.stdout.isTTY) && opts.format === "text";
     if (resolve(target) === homedir()) {
       process.stderr.write(pc2.yellow(`Warning: scanning your entire home directory. Pass a narrower path, e.g. skillmd lint ./my-skill
@@ -468,7 +550,8 @@ function lintCommand() {
         const run2 = await runLint(target, opts);
         s.stop(`Scanned ${run2.results.length} skill${run2.results.length === 1 ? "" : "s"}`);
         console.log(run2.output);
-        p.outro(run2.exitCode === 0 ? pc2.green("All good") : pc2.red("Problems found"));
+        const failed = run2.results.filter((r) => !r.result.ok).length;
+        p.outro(failed === 0 ? pc2.green("All good") : pc2.red(`${failed} skill${failed === 1 ? "" : "s"} failed \u2014 details above`));
         process.exitCode = run2.exitCode;
       } catch (err) {
         s.stop(pc2.red("No skills found"));
@@ -540,9 +623,9 @@ function rulesCommand() {
       console.log(JSON.stringify(list.map((r) => ({ id: r.id, severity: r.severity, description: r.description })), null, 2));
       return;
     }
-    const badge2 = (sev) => sev === "error" ? pc4.bgRed(pc4.white(" error ")) : sev === "warn" ? pc4.bgYellow(pc4.black(" warn  ")) : pc4.bgCyan(pc4.black(" info  "));
+    const badge = (sev) => sev === "error" ? pc4.bgRed(pc4.white(" error ")) : sev === "warn" ? pc4.bgYellow(pc4.black(" warn  ")) : pc4.bgCyan(pc4.black(" info  "));
     console.log(pc4.bold("\nLint rules\n"));
-    for (const r of list) console.log(`  ${pc4.bold(r.id)}  ${badge2(r.severity)}  ${r.description}`);
+    for (const r of list) console.log(`  ${pc4.bold(r.id)}  ${badge(r.severity)}  ${r.description}`);
     console.log("");
   });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillmds",
-  "version": "1.0.8",
+  "version": "1.0.10",
   "description": "SkillMD for agents: the `skillmds` MCP server + the `skillmd` CLI (lint, scan, search, install, publish Agent Skills) from skillmd.com.",
   "type": "module",
   "bin": {

package/vendor/index.js

@@ -163,12 +163,21 @@ function runRules(skill, ctx = {}) {
 
 // ../../packages/core/src/quality.ts
 var WEIGHT = {
-  error: 25,
-  warn: 8,
-  info: 2
+  error: 30,
+  warn: 10,
+  info: 3
 };
-function qualityScore(diagnostics) {
-  const penalty = diagnostics.reduce((sum, d) => sum + WEIGHT[d.severity], 0);
+var RISK = {
+  docs_only: 0,
+  reads_secrets: 25,
+  executes_scripts: 15,
+  network_calls: 8
+};
+function qualityScore(diagnostics, security) {
+  let penalty = diagnostics.reduce((sum, d) => sum + WEIGHT[d.severity], 0);
+  if (security) {
+    for (const flag of security.flags) penalty += RISK[flag] ?? 0;
+  }
   return Math.max(0, Math.min(100, 100 - penalty));
 }
 
@@ -177,18 +186,19 @@ function lint(raw, opts = {}) {
   const parsed = parseSkillMd(raw, opts.type ?? "single");
   if ("error" in parsed) {
     const diagnostics2 = [{ id: "SK001", severity: "error", message: parsed.error }];
+    const security2 = scanSecurity(raw);
     return {
       ok: false,
       diagnostics: diagnostics2,
-      security: scanSecurity(raw),
-      score: qualityScore(diagnostics2)
+      security: security2,
+      score: qualityScore(diagnostics2, security2)
     };
   }
   const ctx = opts.slug !== void 0 ? { slug: opts.slug } : {};
   const diagnostics = runRules(parsed, ctx);
   const security = scanSecurity(parsed.body);
   const ok = !diagnostics.some((d) => d.severity === "error");
-  return { ok, skill: parsed, diagnostics, security, score: qualityScore(diagnostics) };
+  return { ok, skill: parsed, diagnostics, security, score: qualityScore(diagnostics, security) };
 }
 
 // ../../packages/core/src/format/text.ts