skillmds 1.0.9 → 1.0.10

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to `skillmds` are documented here. Versions follow [semver](https://semver.org).
 
+## 1.0.10
+
+- Quality score is now a composite of spec correctness, completeness, and **security risk** — skills that read secrets, execute scripts, or make network calls score lower (a risky/stub skill is no longer a green 100).
+- Lint output ends with a **Failed** section listing each failure's rule, message, and full path, so problems don't scroll off in a large run.
+- New `--errors-only` flag to show only failing skills.
+- Fixed emoji spacing/overlap; rule ids are grouped by severity per skill.
+- The closer states how many skills failed instead of a vague "Problems found".
+
 ## 1.0.9
 
 - Compact lint output: one line per skill (status dot, score, name, rule-id chips) with a single summary line, instead of a tall multi-row block per skill. Linting a single skill still shows full diagnostic messages.

package/dist/cli.js

@@ -157,12 +157,21 @@ function runRules(skill, ctx = {}) {
 
 // ../../packages/core/src/quality.ts
 var WEIGHT = {
-  error: 25,
-  warn: 8,
-  info: 2
+  error: 30,
+  warn: 10,
+  info: 3
 };
-function qualityScore(diagnostics) {
-  const penalty = diagnostics.reduce((sum, d) => sum + WEIGHT[d.severity], 0);
+var RISK = {
+  docs_only: 0,
+  reads_secrets: 25,
+  executes_scripts: 15,
+  network_calls: 8
+};
+function qualityScore(diagnostics, security) {
+  let penalty = diagnostics.reduce((sum, d) => sum + WEIGHT[d.severity], 0);
+  if (security) {
+    for (const flag of security.flags) penalty += RISK[flag] ?? 0;
+  }
   return Math.max(0, Math.min(100, 100 - penalty));
 }
 
@@ -171,18 +180,19 @@ function lint(raw, opts = {}) {
   const parsed = parseSkillMd(raw, opts.type ?? "single");
   if ("error" in parsed) {
     const diagnostics2 = [{ id: "SK001", severity: "error", message: parsed.error }];
+    const security2 = scanSecurity(raw);
     return {
       ok: false,
       diagnostics: diagnostics2,
-      security: scanSecurity(raw),
-      score: qualityScore(diagnostics2)
+      security: security2,
+      score: qualityScore(diagnostics2, security2)
     };
   }
   const ctx = opts.slug !== void 0 ? { slug: opts.slug } : {};
   const diagnostics = runRules(parsed, ctx);
   const security = scanSecurity(parsed.body);
   const ok = !diagnostics.some((d) => d.severity === "error");
-  return { ok, skill: parsed, diagnostics, security, score: qualityScore(diagnostics) };
+  return { ok, skill: parsed, diagnostics, security, score: qualityScore(diagnostics, security) };
 }
 
 // ../../packages/core/src/format/text.ts
@@ -370,10 +380,27 @@ var decorate = (text3, kind) => {
       return pc.dim(text3);
   }
 };
+var SEV_COLOR = {
+  error: pc.red,
+  warn: pc.yellow,
+  info: pc.cyan
+};
 var GLYPH = {
-  error: pc.red("\u2716"),
-  warn: pc.yellow("\u26A0"),
-  info: pc.cyan("\xB7")
+  error: "\u2716",
+  warn: "\u26A0",
+  info: "\u2139"
+};
+var SEC_GLYPH = "\u2691";
+var SEV_ORDER = ["error", "warn", "info"];
+function chips(result) {
+  const bySev = { error: [], warn: [], info: [] };
+  for (const d of result.diagnostics) bySev[d.severity].push(d.id);
+  return SEV_ORDER.filter((s) => bySev[s].length).map((s) => `${GLYPH[s]} ${SEV_COLOR[s](bySev[s].join(" "))}`).join("   ");
+}
+var SEC_SHORT = {
+  network_calls: "net",
+  executes_scripts: "exec",
+  reads_secrets: "secrets"
 };
 var scoreColor = (s) => s >= 80 ? pc.green : s >= 50 ? pc.yellow : pc.red;
 function label(file) {
@@ -381,35 +408,50 @@ function label(file) {
   const i = parts.lastIndexOf("SKILL.md");
   return i > 0 ? parts[i - 1] : parts[parts.length - 1] || file;
 }
+function securityFlags(result) {
+  return result.security.flags.filter((f) => f !== "docs_only");
+}
+function secCodes(result) {
+  return securityFlags(result).map((f) => SEC_SHORT[f] ?? f);
+}
 function statusDot(result) {
   if (!result.ok) return pc.red("\u25CF");
-  return result.diagnostics.some((d) => d.severity === "warn") ? pc.yellow("\u25CF") : pc.green("\u25CF");
+  const attention = result.diagnostics.some((d) => d.severity === "warn") || securityFlags(result).length > 0;
+  return attention ? pc.yellow("\u25CF") : pc.green("\u25CF");
 }
-function securityFlags(result) {
-  return result.security.flags.filter((f) => f !== "docs_only");
+function failureBlock(file, result) {
+  const lines = [`${pc.red("\u2716")} ${pc.bold(label(file))}`];
+  for (const d of result.diagnostics.filter((x) => x.severity === "error")) {
+    const loc = d.line !== void 0 ? pc.dim(`:${d.line}`) : "";
+    lines.push(`    ${SEV_COLOR.error(d.id)}${loc}  ${d.message}`);
+  }
+  lines.push(`    ${pc.dim(file)}`);
+  return lines.join("\n");
 }
 function renderOne(file, result) {
   const status = result.ok ? pc.green("\u25CF PASS") : pc.red("\u25CF FAIL");
-  const out = [`${status}  ${pc.bold(label(file))}  ${scoreColor(result.score)(`${result.score}/100`)}`];
+  const out = [`${status}  ${pc.bold(label(file))}  ${pc.dim("quality")} ${scoreColor(result.score)(`${result.score}/100`)}`];
   for (const d of result.diagnostics) {
     const loc = d.line !== void 0 ? pc.dim(`:${d.line}`) : "";
-    out.push(`  ${GLYPH[d.severity]} ${pc.dim(d.id)}${loc}  ${d.message}`);
+    out.push(`  ${GLYPH[d.severity]} ${SEV_COLOR[d.severity](d.id)}${loc}  ${d.message}`);
   }
-  const flags = securityFlags(result);
-  if (flags.length) out.push(`  ${pc.magenta(`\u2691 ${flags.join(", ")}`)}`);
+  const codes = secCodes(result);
+  if (codes.length) out.push(`  ${pc.magenta(`${SEC_GLYPH} ${codes.join(", ")}`)}`);
   return out.join("\n");
 }
 function renderMany(results) {
   const names = results.map((r) => label(r.file));
-  const w = Math.min(34, Math.max(4, ...names.map((n) => n.length)));
+  const w = Math.min(32, Math.max(4, ...names.map((n) => n.length)));
   const out = [];
+  let anySec = false;
   results.forEach(({ result }, i) => {
     const score = scoreColor(result.score)(String(result.score).padStart(3));
-    const name = names[i].length > w ? names[i].slice(0, w - 1) + "\u2026" : names[i].padEnd(w);
-    const issues = result.diagnostics.map((d) => `${GLYPH[d.severity]}${pc.dim(d.id)}`).join(" ");
-    const flags = securityFlags(result);
-    const sec = flags.length ? `  ${pc.magenta(`\u2691 ${flags.join(",")}`)}` : "";
-    out.push(`${statusDot(result)} ${score}  ${name}  ${issues}${sec}`.trimEnd());
+    const nm = names[i];
+    const name = (nm.length > w ? nm.slice(0, w - 1) + "\u2026" : nm).padEnd(w);
+    const codes = secCodes(result);
+    if (codes.length) anySec = true;
+    const sec = codes.length ? `   ${pc.magenta(`${SEC_GLYPH} ${codes.join(" ")}`)}` : "";
+    out.push(`${statusDot(result)} ${score}  ${name}  ${chips(result)}${sec}`.trimEnd());
   });
   const failed = results.filter((r) => !r.result.ok).length;
   const warned = results.filter((r) => r.result.ok && r.result.diagnostics.some((d) => d.severity === "warn")).length;
@@ -419,11 +461,28 @@ function renderMany(results) {
   const parts = [pc.green(`${clean} clean`)];
   if (warned) parts.push(pc.yellow(`${warned} warn`));
   if (failed) parts.push(pc.red(`${failed} fail`));
-  out.push(`${parts.join(pc.dim(" \xB7 "))}   ${pc.dim("avg")} ${scoreColor(avg)(`${avg}/100`)}`);
+  out.push(`${parts.join(pc.dim(" \xB7 "))}   ${pc.dim("avg score")} ${scoreColor(avg)(`${avg}/100`)}`);
+  if (anySec) out.push(pc.dim("score = spec + completeness + security risk; magenta \u2691 = risky behaviour (net, exec, secrets)"));
+  const fails = results.filter((r) => !r.result.ok);
+  if (fails.length) {
+    out.push("");
+    out.push(pc.red(pc.bold(`Failed (${fails.length}):`)));
+    for (const f of fails.slice(0, 25)) out.push(failureBlock(f.file, f.result));
+    if (fails.length > 25) out.push(pc.dim(`  \u2026and ${fails.length - 25} more \u2014 run with --errors-only to see all`));
+  }
+  return out.join("\n");
+}
+function renderFailuresView(results) {
+  const fails = results.filter((r) => !r.result.ok);
+  if (!fails.length) return pc.green(`\u2713 No failures across ${results.length} skill${results.length === 1 ? "" : "s"}.`);
+  const out = fails.map((f) => failureBlock(f.file, f.result));
+  out.push("");
+  out.push(`${pc.red(`${fails.length} failed`)} ${pc.dim(`of ${results.length}`)}`);
   return out.join("\n");
 }
-function renderReport(results) {
+function renderReport(results, opts = {}) {
   if (results.length === 0) return pc.dim("No skills found.");
+  if (opts.errorsOnly) return renderFailuresView(results);
   if (results.length === 1) return renderOne(results[0].file, results[0].result);
   return renderMany(results);
 }
@@ -472,12 +531,12 @@ async function runLint(target, flags) {
       output = toGithub(results);
       break;
     default:
-      output = renderReport(results);
+      output = renderReport(results, { errorsOnly: flags.errorsOnly });
   }
   return { results, output, exitCode };
 }
 function lintCommand() {
-  return new Command("lint").alias("check").description("Validate SKILL.md file(s) against the spec and report a quality score").argument("[target]", "local path or GitHub source", ".").option("--format <fmt>", "text | json | sarif | github", "text").option("--strict", "treat warnings as errors").option("--fail-on-warning", "exit non-zero when warnings exist").option("--fix", "apply safe automatic fixes (e.g. add missing license)").action(async (target, opts) => {
+  return new Command("lint").alias("check").description("Validate SKILL.md file(s) against the spec and report a quality score").argument("[target]", "local path or GitHub source", ".").option("--format <fmt>", "text | json | sarif | github", "text").option("--strict", "treat warnings as errors").option("--fail-on-warning", "exit non-zero when warnings exist").option("--fix", "apply safe automatic fixes (e.g. add missing license)").option("--errors-only", "show only skills that failed").action(async (target, opts) => {
     const ui = Boolean(process.stdout.isTTY) && opts.format === "text";
     if (resolve(target) === homedir()) {
       process.stderr.write(pc2.yellow(`Warning: scanning your entire home directory. Pass a narrower path, e.g. skillmd lint ./my-skill
@@ -491,7 +550,8 @@ function lintCommand() {
         const run2 = await runLint(target, opts);
         s.stop(`Scanned ${run2.results.length} skill${run2.results.length === 1 ? "" : "s"}`);
         console.log(run2.output);
-        p.outro(run2.exitCode === 0 ? pc2.green("All good") : pc2.red("Problems found"));
+        const failed = run2.results.filter((r) => !r.result.ok).length;
+        p.outro(failed === 0 ? pc2.green("All good") : pc2.red(`${failed} skill${failed === 1 ? "" : "s"} failed \u2014 details above`));
         process.exitCode = run2.exitCode;
       } catch (err) {
         s.stop(pc2.red("No skills found"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillmds",
-  "version": "1.0.9",
+  "version": "1.0.10",
   "description": "SkillMD for agents: the `skillmds` MCP server + the `skillmd` CLI (lint, scan, search, install, publish Agent Skills) from skillmd.com.",
   "type": "module",
   "bin": {

package/vendor/index.js

@@ -163,12 +163,21 @@ function runRules(skill, ctx = {}) {
 
 // ../../packages/core/src/quality.ts
 var WEIGHT = {
-  error: 25,
-  warn: 8,
-  info: 2
+  error: 30,
+  warn: 10,
+  info: 3
 };
-function qualityScore(diagnostics) {
-  const penalty = diagnostics.reduce((sum, d) => sum + WEIGHT[d.severity], 0);
+var RISK = {
+  docs_only: 0,
+  reads_secrets: 25,
+  executes_scripts: 15,
+  network_calls: 8
+};
+function qualityScore(diagnostics, security) {
+  let penalty = diagnostics.reduce((sum, d) => sum + WEIGHT[d.severity], 0);
+  if (security) {
+    for (const flag of security.flags) penalty += RISK[flag] ?? 0;
+  }
   return Math.max(0, Math.min(100, 100 - penalty));
 }
 
@@ -177,18 +186,19 @@ function lint(raw, opts = {}) {
   const parsed = parseSkillMd(raw, opts.type ?? "single");
   if ("error" in parsed) {
     const diagnostics2 = [{ id: "SK001", severity: "error", message: parsed.error }];
+    const security2 = scanSecurity(raw);
     return {
       ok: false,
       diagnostics: diagnostics2,
-      security: scanSecurity(raw),
-      score: qualityScore(diagnostics2)
+      security: security2,
+      score: qualityScore(diagnostics2, security2)
     };
   }
   const ctx = opts.slug !== void 0 ? { slug: opts.slug } : {};
   const diagnostics = runRules(parsed, ctx);
   const security = scanSecurity(parsed.body);
   const ok = !diagnostics.some((d) => d.severity === "error");
-  return { ok, skill: parsed, diagnostics, security, score: qualityScore(diagnostics) };
+  return { ok, skill: parsed, diagnostics, security, score: qualityScore(diagnostics, security) };
 }
 
 // ../../packages/core/src/format/text.ts