skillmds 1.3.3 → 1.3.4

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 All notable changes to `skillmds` are documented here. Versions follow [semver](https://semver.org).
 
+## 1.3.4
+
+- **A companion file that its source repo no longer serves no longer fails the install.** When a registry pack links to a file the upstream repo has since deleted or moved, `add` (and the MCP install tool) now installs everything else and warns which files are missing, e.g. `1 companion file is gone from the source repo and was not installed (scripts/gone.ts)`. Before, one such link failed the whole bundle and `add owner/name` fell back to fetching the slug as a GitHub repo, ending in a misleading 404 with nothing installed. `update` stays strict: it never replaces a full install with a partial one.
+
 ## 1.2.0
 
 `skillmd add` was rewritten. It no longer copies a skill into every agent folder it can find: it writes **one canonical copy** and links that copy into the agents you chose, in the scope you chose, and records what it did in a lock file.

package/README.md

@@ -186,7 +186,7 @@ No auth required. It exposes `skillmd_search`, `skillmd_get`, `skillmd_download`
 
 ## Find skills on skillmd.com
 
-The registry behind these tools is [skillmd.com](https://skillmd.com): 25,000+ Agent Skills, each linted, security-scanned and content-pinned.
+The registry behind these tools is [skillmd.com](https://skillmd.com): 1,000,000+ Agent Skills, each linted, security-scanned and content-pinned.
 
 - [Search all skills](https://skillmd.com/search) · [browse by category](https://skillmd.com/categories) · [by publisher](https://skillmd.com/publishers)
 - Install guides per agent: [Claude Code](https://skillmd.com/agents/claude-code) · [Cursor](https://skillmd.com/agents/cursor) · [Codex](https://skillmd.com/agents/codex) · [all 60+ agents](https://skillmd.com/agents)

package/dist/{chunk-FVWCI37S.js → chunk-6JVWN3IG.js}

@@ -197,7 +197,13 @@ async function fetchBundle(base, slug, token, opts = {}) {
       contents = Buffer.from(f.content_base64, "base64");
     } else if (f.source_url && isAllowedSourceUrl(f.source_url)) {
       const r = await doFetch(f.source_url).catch(() => null);
-      if (!r || !r.ok) throw new Error(`could not fetch companion file "${f.path}" from ${hostOf(f.source_url)}`);
+      if (!r || !r.ok) {
+        if (opts.missing) {
+          opts.missing.push(f.path);
+          continue;
+        }
+        throw new Error(`could not fetch companion file "${f.path}" from ${hostOf(f.source_url)}`);
+      }
       contents = Buffer.from(await r.arrayBuffer());
       fromUrl = true;
     } else {
@@ -215,6 +221,12 @@ async function fetchBundle(base, slug, token, opts = {}) {
   }
   return out;
 }
+function missingFilesNote(paths) {
+  const n = paths.length;
+  const shown = paths.slice(0, 5).join(", ") + (n > 5 ? `, and ${n - 5} more` : "");
+  const [f, was, it] = n === 1 ? ["file is", "was", "it"] : ["files are", "were", "them"];
+  return `${n} companion ${f} gone from the source repo and ${was} not installed (${shown}); the skill may still refer to ${it}`;
+}
 
 // src/source.ts
 import { existsSync as existsSync2, statSync, lstatSync, readFileSync as readFileSync2, readdirSync, mkdtempSync, rmSync } from "fs";
@@ -841,6 +853,7 @@ export {
   RegistryError,
   createClient,
   fetchBundle,
+  missingFilesNote,
   skillMdFor,
   resolveSource,
   collectFiles,

package/dist/cli.js

@@ -16,6 +16,7 @@ import {
   isSkillDirOrLink,
   listInstalled,
   looksLikeProject,
+  missingFilesNote,
   parseSource,
   readConfig,
   readLock,
@@ -30,7 +31,7 @@ import {
   uninstallSkill,
   upsertEntry,
   writeConfig
-} from "./chunk-FVWCI37S.js";
+} from "./chunk-6JVWN3IG.js";
 
 // src/index.ts
 import { Command as Command13 } from "commander";
@@ -870,6 +871,11 @@ function unverifiedFilesNote(n) {
   const [f, it] = n === 1 ? ["file", "it"] : ["files", "them"];
   return `${n} companion ${f} came straight from the source repo \u2014 the registry holds no checksum for ${it}, so only the connection was verified`;
 }
+function bundleNote(bundle, missing) {
+  const unverified = bundle.filter((file) => file.unverified).length;
+  const notes = [unverified ? unverifiedFilesNote(unverified) : "", missing.length ? missingFilesNote(missing) : ""].filter(Boolean);
+  return notes.length ? notes.join("; ") : void 0;
+}
 function registryFallbackNote(host) {
   return `installed from GitHub because the SkillMD registry (${host}) was unreachable \u2014 this copy is not the registry-reviewed version`;
 }
@@ -912,15 +918,16 @@ async function registryCandidate(owner, name, source, client) {
     securityFlags: skill.security_flags
   };
   if (skill.type === "pack") {
-    const bundle = await fetchBundle(client.base, registrySlug, client.token);
+    const missing = [];
+    const bundle = await fetchBundle(client.base, registrySlug, client.token, { missing });
     if (bundle && bundle.length) {
       const sk = bundle.find((file) => file.path === "SKILL.md");
-      const unverified = bundle.filter((file) => file.unverified).length;
+      const note2 = bundleNote(bundle, missing);
       return {
         ...meta,
         raw: sk ? sk.contents.toString("utf8") : skillMdFor(skill),
         files: bundle,
-        ...unverified ? { note: unverifiedFilesNote(unverified) } : {}
+        ...note2 ? { note: note2 } : {}
       };
     }
     const pack = await resolvePackFiles(skill);
@@ -1010,13 +1017,14 @@ function makeDefaultDeps(flags) {
             for (let i = n++; i < multi.length; i = n++) {
               const c = multi[i];
               try {
-                const bundle = await fetchBundle(apiBase2, c.registrySlug, token2);
+                const missing2 = [];
+                const bundle = await fetchBundle(apiBase2, c.registrySlug, token2, { missing: missing2 });
                 if (!bundle?.length) continue;
                 const sk = bundle.find((file) => file.path === "SKILL.md");
-                const unverified = bundle.filter((file) => file.unverified).length;
+                const note2 = bundleNote(bundle, missing2);
                 c.files = bundle;
                 if (sk) c.raw = sk.contents.toString("utf8");
-                if (unverified) c.note = unverifiedFilesNote(unverified);
+                if (note2) c.note = note2;
               } catch {
               }
             }

package/dist/mcp.js

@@ -8,11 +8,12 @@ import {
   fetchBundle,
   installSkill,
   looksLikeProject,
+  missingFilesNote,
   resolvePackFiles,
   safeText,
   stripTerminalEscapes,
   telemetryDisabled
-} from "./chunk-FVWCI37S.js";
+} from "./chunk-6JVWN3IG.js";
 
 // src/mcp/server.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
@@ -206,9 +207,11 @@ async function installFromRegistry(args, ctx, deps = {}) {
   let note = "";
   if (skill.type === "pack") {
     try {
-      const bundle = await getBundle(ctx.base, `${owner}/${name}`, ctx.token);
+      const missing = [];
+      const bundle = await getBundle(ctx.base, `${owner}/${name}`, ctx.token, { missing });
       if (bundle?.length) {
         files = bundle.some((f) => f.path === "SKILL.md") ? bundle : [...bundle, { path: "SKILL.md", contents: raw }];
+        if (missing.length) note = missingFilesNote(missing);
       } else {
         const pack = await getPackFiles(skill);
         if (pack) {
@@ -549,7 +552,7 @@ async function startMcpServer() {
       name: "skillmd",
       version: VERSION,
       title: "SkillMD",
-      description: "The open registry of Agent Skills: search, inspect, lint and install 25,000+ linted, security-reviewed SKILL.md files for Claude Code, Cursor, Codex and 60+ other agents.",
+      description: "The open registry of Agent Skills: search, inspect, lint and install 1,000,000+ linted, security-reviewed SKILL.md files for Claude Code, Cursor, Codex and 60+ other agents.",
       websiteUrl: "https://skillmd.com",
       icons: [
         { src: "https://skillmd.com/favicon.png", mimeType: "image/png", sizes: ["512x512"] },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillmds",
-  "version": "1.3.3",
+  "version": "1.3.4",
   "description": "SkillMD for agents: the `skillmds` MCP server + the `skillmd` CLI (lint, scan, search, install, publish Agent Skills) from skillmd.com.",
   "license": "MIT",
   "author": "SkillMD",