skillmds 1.2.0 → 1.2.1

package/dist/{chunk-A7BKAUUO.js → chunk-4BFQJ3YZ.js}

@@ -182,13 +182,14 @@ async function fetchBundle(base, slug, token, opts = {}) {
   let bytes = 0;
   for (const f of data.files) {
     let contents;
+    let fromUrl = false;
     if (f.content_base64 != null) {
       contents = Buffer.from(f.content_base64, "base64");
     } else if (f.source_url && isAllowedSourceUrl(f.source_url)) {
-      if (!f.sha256) throw new IntegrityError(`"${f.path}" is delivered by URL but the registry recorded no sha256 for it \u2014 refusing to install unverifiable content`);
       const r = await doFetch(f.source_url).catch(() => null);
       if (!r || !r.ok) throw new Error(`could not fetch companion file "${f.path}" from ${hostOf(f.source_url)}`);
       contents = Buffer.from(await r.arrayBuffer());
+      fromUrl = true;
     } else {
       continue;
     }
@@ -197,10 +198,10 @@ async function fetchBundle(base, slug, token, opts = {}) {
     if (f.sha256) {
       const got = createHash("sha256").update(contents).digest("hex");
       if (got !== f.sha256) throw new IntegrityError(`integrity check failed for "${f.path}" (expected ${f.sha256.slice(0, 12)}\u2026, got ${got.slice(0, 12)}\u2026)`);
-    } else if (f.path !== "SKILL.md") {
+    } else if (!fromUrl && f.path !== "SKILL.md") {
       throw new IntegrityError(`"${f.path}" has no sha256 in the registry bundle \u2014 refusing to install unverifiable content`);
     }
-    out.push({ path: f.path, contents });
+    out.push({ path: f.path, contents, ...fromUrl && !f.sha256 ? { unverified: true } : {} });
   }
   return out;
 }

package/dist/cli.js

@@ -30,7 +30,7 @@ import {
   uninstallSkill,
   upsertEntry,
   writeConfig
-} from "./chunk-A7BKAUUO.js";
+} from "./chunk-4BFQJ3YZ.js";
 
 // src/index.ts
 import { Command as Command13 } from "commander";
@@ -662,6 +662,10 @@ async function promptAgentsInteractive(ctx) {
   });
   return p3.isCancel(picked) ? null : picked;
 }
+function unverifiedFilesNote(n) {
+  const [f, it] = n === 1 ? ["file", "it"] : ["files", "them"];
+  return `${n} companion ${f} came straight from the source repo \u2014 the registry holds no checksum for ${it}, so only the connection was verified`;
+}
 function registryFallbackNote(host) {
   return `installed from GitHub because the SkillMD registry (${host}) was unreachable \u2014 this copy is not the registry-reviewed version`;
 }
@@ -736,7 +740,13 @@ function makeDefaultDeps(flags) {
           const bundle = await fetchBundle(apiBase, registrySlug, token);
           if (bundle && bundle.length) {
             const sk = bundle.find((file) => file.path === "SKILL.md");
-            return [{ ...meta, raw: sk ? sk.contents.toString("utf8") : skillMdFor(skill), files: bundle }];
+            const unverified = bundle.filter((file) => file.unverified).length;
+            return [{
+              ...meta,
+              raw: sk ? sk.contents.toString("utf8") : skillMdFor(skill),
+              files: bundle,
+              ...unverified ? { note: unverifiedFilesNote(unverified) } : {}
+            }];
           }
           const pack = await resolvePackFiles(skill);
           if (pack) return [{ ...meta, ...pack }];

package/dist/mcp.js

@@ -12,7 +12,7 @@ import {
   safeText,
   stripTerminalEscapes,
   telemetryDisabled
-} from "./chunk-A7BKAUUO.js";
+} from "./chunk-4BFQJ3YZ.js";
 
 // src/mcp/server.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillmds",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "SkillMD for agents: the `skillmds` MCP server + the `skillmd` CLI (lint, scan, search, install, publish Agent Skills) from skillmd.com.",
   "license": "MIT",
   "author": "SkillMD",