skillmds 1.3.5 → 1.3.7

package/CHANGELOG.md

@@ -1,6 +1,15 @@
 # Changelog
 
-All notable changes to `skillmds` are documented here. Versions follow [semver](https://semver.org).
+All notable changes to `get-skill` (published as `skillmds` until 1.3.6) are documented here. Versions follow [semver](https://semver.org).
+
+## 1.3.7
+
+- **The package is now `get-skill`.** Install and run it as `npx get-skill add owner/name`, `npx get-skill search "pdf"`, and so on; MCP clients start the server with `npx -y get-skill`. `npm i -g get-skill` installs the `get-skill` and `skillmd` commands. Every release is still published as `skillmds` too, with identical contents, so existing setups keep working.
+
+## 1.3.6
+
+- **Installed skills name where they came from.** A skill installed from the registry (with `add`, `update` or the MCP install tool) gets one line in its frontmatter, `metadata.source: https://skillmd.com/skills/<owner>/<name>`, so an agent reading it knows its SkillMD page. Every other byte is the author's: an existing `metadata` block gains that one line, and an author's own `metadata.source` is never replaced. The line is added after the integrity checks, and the lock file's digest still covers the bytes the registry served, so `update` is unaffected. GitHub, gist and local installs are written exactly as fetched.
+- **find-skills, offered once.** After your first successful install in a terminal, `add` asks once whether to also add `skillmd/find-skills`, a skill that tells your agent to look on SkillMD when a task needs know-how it doesn't have, and to vet what it finds before suggesting it. Yes or no, it never asks again; an agent running the CLI, `-y` and `--json` are never asked.
 
 ## 1.3.5
 

package/README.md

@@ -2,32 +2,32 @@
   <img src="https://skillmd.com/brand/banner.png" alt="SkillMD" width="560">
 </p>
 
-# skillmds
+# get-skill
 
-[![npm version](https://img.shields.io/npm/v/skillmds.svg)](https://www.npmjs.com/package/skillmds)
-[![license](https://img.shields.io/npm/l/skillmds.svg)](https://github.com/skillmds/skillmd/blob/main/LICENSE)
+[![npm version](https://img.shields.io/npm/v/get-skill.svg)](https://www.npmjs.com/package/get-skill)
+[![license](https://img.shields.io/npm/l/get-skill.svg)](https://github.com/skillmds/skillmd/blob/main/LICENSE)
 [![source](https://img.shields.io/badge/source-skillmds%2Fskillmd-blue?logo=github)](https://github.com/skillmds/skillmd)
 
 Tools for working with [Agent Skills](https://docs.claude.com/en/docs/agents-and-tools/agent-skills) (`SKILL.md`) from the [SkillMD](https://skillmd.com) registry. One package, two binaries:
 
 - **`skillmd`** — a CLI to lint, scan, search, install, and publish skills.
-- **`skillmds`** — an MCP server exposing the registry to MCP clients (Claude Code, Claude Desktop, Cursor, …).
+- **`get-skill`** — the same CLI, and an MCP server exposing the registry to MCP clients (Claude Code, Claude Desktop, Cursor, …).
 
 Both validate `SKILL.md` with the same engine ([`@skillmds/core`](https://www.npmjs.com/package/@skillmds/core)), so the CLI and the registry apply identical rules. Source lives at [github.com/skillmds/skillmd](https://github.com/skillmds/skillmd).
 
 ## Install
 
 ```bash
-npm i -g skillmds
+npm i -g get-skill
 ```
 
-This installs both the `skillmd` and `skillmds` commands. To run the CLI without installing:
+This installs both the `get-skill` and `skillmd` commands. To run the CLI without installing:
 
 ```bash
-npx skillmds lint .
+npx get-skill lint .
 ```
 
-**Which binary runs what.** `skillmds` with any argument runs the CLI. `skillmds` with no arguments starts the **MCP server** when stdin is piped (how an MCP client launches it), and opens the interactive CLI menu when there's a terminal attached. `skillmd` is always the CLI.
+**Which binary runs what.** `get-skill` with any argument runs the CLI. `get-skill` with no arguments starts the **MCP server** when stdin is piped (how an MCP client launches it), and opens the interactive CLI menu when there's a terminal attached. `skillmd` is always the CLI.
 
 ## CLI: `skillmd`
 
@@ -152,12 +152,12 @@ skillmd publish ./my-skill --dry-run
 skillmd publish ./my-skill --force   # publish despite warnings; never bypasses errors
 ```
 
-## MCP server: `skillmds`
+## MCP server: `get-skill`
 
 Claude Code:
 
 ```bash
-claude mcp add skillmd -- npx -y skillmds
+claude mcp add skillmd -- npx -y get-skill
 ```
 
 Other MCP clients:
@@ -165,7 +165,7 @@ Other MCP clients:
 ```jsonc
 {
   "mcpServers": {
-    "skillmd": { "command": "npx", "args": ["-y", "skillmds"] }
+    "skillmd": { "command": "npx", "args": ["-y", "get-skill"] }
   }
 }
 ```

package/bin/skillmd.mjs

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-// The `skillmd` CLI, shipped inside the `skillmds` package.
+// The `skillmd` CLI, shipped inside the `get-skill` package.
 import("../dist/cli.js");

package/dist/{chunk-6JVWN3IG.js → chunk-MPBRLZWJ.js}

@@ -2,7 +2,7 @@
 import { existsSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
-var UNSUPPORTED = (what) => new Error(`${what} sources are not supported yet \u2014 clone it locally and run \`skillmd add ./path/to/skill\`.`);
+var UNSUPPORTED = (what) => new Error(`${what} sources are not supported yet \u2014 clone it locally and run \`npx get-skill add ./path/to/skill\`.`);
 function assertSubpath(sub) {
   if (!sub) return void 0;
   const clean = sub.replace(/^\/+|\/+$/g, "");
@@ -321,7 +321,7 @@ async function resolveSource(arg, opts = {}) {
     if (st.isFile()) return [loadLocal(spec.path)];
     const files = findSkillFiles(spec.path);
     if (files.length === 0) {
-      throw new Error(`No SKILL.md found under ${spec.path}. Point at a skill directory, e.g. "skillmd lint ./my-skill", or run "skillmd init" to create one.`);
+      throw new Error(`No SKILL.md found under ${spec.path}. Point at a skill directory, e.g. "npx get-skill lint ./my-skill", or run "npx get-skill init" to create one.`);
     }
     return files.map(loadLocal);
   }
@@ -337,7 +337,7 @@ async function resolveSource(arg, opts = {}) {
     return [{ path: spec.display, raw, slug: `gist-${spec.id.slice(0, 8)}` }];
   }
   if (spec.kind === "plugin") {
-    throw new Error(`"${spec.display}" is a plugin, not a single skill \u2014 install it with \`skillmd add ${spec.display}\`.`);
+    throw new Error(`"${spec.display}" is a plugin, not a single skill \u2014 install it with \`npx get-skill add ${spec.display}\`.`);
   }
   const gh = asGithub(spec);
   const { dir, cleanup } = await downloadGithub(gh, "skillmd-src-", opts, Boolean(gh.subpath));
@@ -622,6 +622,48 @@ import { createHash as createHash2 } from "crypto";
 import { cpSync, existsSync as existsSync5, lstatSync as lstatSync2, mkdirSync as mkdirSync3, readdirSync as readdirSync2, renameSync as renameSync2, rmSync as rmSync3, symlinkSync, writeFileSync as writeFileSync3 } from "fs";
 import { platform } from "os";
 import { dirname as dirname3, join as join7, relative as relative2, resolve as resolve2, sep as sep2 } from "path";
+
+// src/provenance.ts
+import { parseSkillMd } from "@skillmds/core";
+var SKILLMD_ORIGIN = "https://skillmd.com";
+var FRONTMATTER = /^(?---\r?\n)([\s\S]*?)(\r?\n---[ \t]*(?:\r?\n|$))/;
+function withRegistrySource(md, slug) {
+  const m = FRONTMATTER.exec(md);
+  if (!m) return md;
+  const [whole, open, block, close] = m;
+  const nl = open.endsWith("\r\n") ? "\r\n" : "\n";
+  const source = `${SKILLMD_ORIGIN}/skills/${slug}`;
+  const lines = block.split(/\r?\n/);
+  const at = lines.findIndex((l) => /^metadata[ \t]*:/.test(l));
+  if (at === -1) {
+    lines.push("metadata:", `  source: ${source}`);
+  } else {
+    if (!/^metadata[ \t]*:[ \t]*(#.*)?$/.test(lines[at])) return md;
+    let end = at + 1;
+    while (end < lines.length && (/^[ \t]/.test(lines[end]) || lines[end].trim() === "")) end++;
+    const children = lines.slice(at + 1, end);
+    if (children.some((l) => /^[ \t]+source[ \t]*:/.test(l))) return md;
+    const indent = /^([ \t]+)\S/.exec(children.find((l) => l.trim() !== "") ?? "")?.[1] ?? "  ";
+    lines.splice(at + 1, 0, `${indent}source: ${source}`);
+  }
+  const out = open + lines.join(nl) + close + md.slice(whole.length);
+  const before = parseSkillMd(md);
+  const after = parseSkillMd(out);
+  return "error" in after && !("error" in before) ? md : out;
+}
+function filesForInstall(files, source) {
+  const slug = /^registry:([^/\s]+\/[^/\s]+)$/.exec(source)?.[1];
+  if (!slug) return files;
+  return files.map((f) => {
+    if (f.path.replace(/\\/g, "/") !== "SKILL.md") return f;
+    const text = typeof f.contents === "string" ? f.contents : f.contents.toString("utf8");
+    const next = withRegistrySource(text, slug);
+    if (next === text) return f;
+    return { ...f, contents: typeof f.contents === "string" ? next : Buffer.from(next, "utf8") };
+  });
+}
+
+// src/installer.ts
 var NAME_OK = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
 function assertSafeName(name) {
   if (!NAME_OK.test(name) || name.includes("..")) throw new Error(`refused unsafe skill name: "${name}"`);
@@ -712,7 +754,7 @@ async function installSkill(req) {
   const staging = `${canonical}.tmp-${process.pid}`;
   rmSync3(staging, { recursive: true, force: true });
   try {
-    writeTree(staging, req.files);
+    writeTree(staging, filesForInstall(req.files, req.source));
   } catch (e) {
     rmSync3(staging, { recursive: true, force: true });
     throw e;

package/dist/cli.js

@@ -31,7 +31,7 @@ import {
   uninstallSkill,
   upsertEntry,
   writeConfig
-} from "./chunk-6JVWN3IG.js";
+} from "./chunk-MPBRLZWJ.js";
 
 // src/index.ts
 import { Command as Command13 } from "commander";
@@ -608,7 +608,7 @@ async function runInfo(slug, flags, deps = {}) {
   const commitSha = safeText(s.provenance?.commit_sha ?? s.commit_sha, 100);
   if (sourceRepo) lines.push(pc7.dim(`  source: ${sourceRepo}${commitSha ? ` @ ${commitSha.slice(0, 8)}` : ""}`));
   lines.push(pc7.dim(`  page: https://skillmd.com/skills/${slugTxt}`));
-  lines.push(pc7.dim(`  install: ${safeText(s.install?.cli, 300) || `npx skillmds add ${slugTxt}`}`));
+  lines.push(pc7.dim(`  install: ${safeText(s.install?.cli, 300) || `npx get-skill add ${slugTxt}`}`));
   return { ok: true, exitCode: 0, output: lines.join("\n"), skill: s };
 }
 function infoCommand() {
@@ -1137,7 +1137,9 @@ function finish2(flags, outcome) {
         written,
         blocked,
         exitCode,
-        output: json ? JSON.stringify(doc, null, 2) : renderHuman(outcome.notices, outcome.records, outcome.paths)
+        output: json ? JSON.stringify(doc, null, 2) : renderHuman(outcome.notices, outcome.records, outcome.paths),
+        scope: outcome.scope,
+        agents: [...new Set(installed.flatMap((d) => d.targets.map((t) => t.agent)))]
       };
     }
     case "list": {
@@ -1387,8 +1389,40 @@ var clackUI = {
   spinner: () => p3.spinner(),
   message: (m) => p3.log.message(m),
   outro: (m) => p3.outro(m),
-  cancel: (m) => p3.cancel(m)
+  cancel: (m) => p3.cancel(m),
+  confirm: async (m) => {
+    const answer = await p3.confirm({ message: m, initialValue: true });
+    return p3.isCancel(answer) ? null : answer;
+  }
 };
+var FIND_SKILLS = "skillmd/find-skills";
+async function offerFindSkills(source, flags, run2, ui, deps) {
+  if (!ui.confirm || run2.exitCode !== 0 || !run2.written.length || !run2.scope || !run2.agents?.length) return;
+  if (source.replace(/^registry:/, "").toLowerCase() === FIND_SKILLS) return;
+  const cfg = readConfig(flags.home);
+  if (cfg.findSkillsOffered) return;
+  const global = run2.scope === "global";
+  const lock = readLock({ global, cwd: flags.cwd, home: flags.home });
+  if (Object.values(lock.skills).some((e) => e.source === `registry:${FIND_SKILLS}`)) return;
+  try {
+    writeConfig({ ...cfg, findSkillsOffered: true }, flags.home);
+  } catch {
+  }
+  const yes = await ui.confirm("Also add find-skills, so your agent can look for more skills on SkillMD when a task needs one?");
+  if (!yes) return;
+  const r = await runAdd(FIND_SKILLS, {
+    ...flags,
+    yes: true,
+    json: false,
+    skill: void 0,
+    list: void 0,
+    ref: void 0,
+    global,
+    project: !global,
+    agent: run2.agents
+  }, deps);
+  ui.message(r.exitCode === 0 ? `${pc8.green(GLYPH.ok)} find-skills added` : pc8.yellow(`${GLYPH.warn} find-skills could not be added. Try later: npx get-skill add ${FIND_SKILLS}`));
+}
 async function runAddWithUI(source, flags, opts = {}) {
   const term = opts.term ?? { ...realTerminal(), env: flags.env ?? process.env };
   const base = opts.deps ?? makeDefaultDeps(flags);
@@ -1421,7 +1455,8 @@ async function runAddWithUI(source, flags, opts = {}) {
       return { run: run2, printed: true };
     }
     ui.message(run2.output);
-    ui.outro(run2.exitCode === 0 ? `Done. Run ${pc8.cyan("skillmd list")} to see everything installed.` : pc8.red("Some skills were not installed."));
+    await offerFindSkills(source, flags, run2, ui, base);
+    ui.outro(run2.exitCode === 0 ? `Done. Run ${pc8.cyan("npx get-skill list")} to see everything installed.` : pc8.red("Some skills were not installed."));
     return { run: run2, printed: true };
   } catch (e) {
     ui.outro(pc8.red("Nothing was installed."));
@@ -1454,7 +1489,7 @@ function runList(flags = {}) {
   if (flags.json) {
     return { items, output: JSON.stringify(items.map(({ name, scope, path, agents, source, mode, tracked, description }) => ({ name, scope, path, agents, source: source ?? null, mode, tracked, description })), null, 2) };
   }
-  if (items.length === 0) return { items, output: pc9.dim("No installed skills found. Install one with `skillmd add owner/name`.") };
+  if (items.length === 0) return { items, output: pc9.dim("No installed skills found. Install one with `npx get-skill add owner/name`.") };
   const w = Math.max(...items.map((i) => i.name.length), 4);
   const lines = items.map((i) => {
     const tag = i.tracked ? pc9.dim(i.source ?? "") : pc9.yellow("untracked");
@@ -1672,7 +1707,7 @@ async function runUpdate(names, flags, deps = defaultUpdateDeps) {
       const label2 = `${s.name}${scopes.length > 1 ? pc11.dim(` [${s.scope}]`) : ""}`;
       const entry = lock.skills[s.name];
       if (!entry) {
-        lines.push(pc11.dim(`- ${label2} untracked \u2014 reinstall with \`skillmd add\` to track updates`));
+        lines.push(pc11.dim(`- ${label2} untracked \u2014 reinstall with \`npx get-skill add\` to track updates`));
         continue;
       }
       if (entry.source.startsWith("local:")) {
@@ -1752,7 +1787,7 @@ var defaultDeps2 = {
   resolve: resolveSource,
   async submit(payload, flags) {
     const { api, hasToken } = createClient(flags);
-    if (!hasToken) throw new Error("No token. Run `skillmd login` or pass --token.");
+    if (!hasToken) throw new Error("No token. Run `npx get-skill login` or pass --token.");
     return api(`/api/skills`, {
       method: "POST",
       headers: { "content-type": "application/json" },
@@ -2078,18 +2113,18 @@ try {
   version = JSON.parse(readFileSync3(new URL("../package.json", import.meta.url), "utf8")).version;
 } catch {
 }
-var program = new Command13("skillmd").version(version).description("Lint, validate, and install Agent Skills from the SkillMD registry.").option("--json", "machine-readable output").option("--token <token>", "personal access token (prefer `skillmd login` or SKILLMD_TOKEN \u2014 command-line tokens show up in process lists)").option("--api <url>", "override the registry API base URL").option("--insecure-http", "allow an http:// --api base (local development only)");
+var program = new Command13("get-skill").version(version).description("Lint, validate, and install Agent Skills from the SkillMD registry.").option("--json", "machine-readable output").option("--token <token>", "personal access token (prefer `npx get-skill login` or SKILLMD_TOKEN \u2014 command-line tokens show up in process lists)").option("--api <url>", "override the registry API base URL").option("--insecure-http", "allow an http:// --api base (local development only)");
 program.configureHelp({ sortSubcommands: false });
 program.addHelpText("after", `
 Examples:
-  $ skillmd add anthropic/pdf                  install from the registry (asks project vs global)
-  $ skillmd add owner/repo/skills/x#main -g    a GitHub subfolder at a ref, into your user dirs
-  $ skillmd add ./my-skill -a claude-code -p   a local skill into this project for one agent
-  $ skillmd add anthropic/pdf -y --json        non-interactive, machine-readable
-  $ skillmd list                               everything installed, project and global
-  $ skillmd check                              which installed skills have updates
-  $ skillmd update -g                          update your user-level skills
-  $ skillmd remove pdf                         remove a skill from every agent
+  $ npx get-skill add anthropic/pdf                  install from the registry (asks project vs global)
+  $ npx get-skill add owner/repo/skills/x#main -g    a GitHub subfolder at a ref, into your user dirs
+  $ npx get-skill add ./my-skill -a claude-code -p   a local skill into this project for one agent
+  $ npx get-skill add anthropic/pdf -y --json        non-interactive, machine-readable
+  $ npx get-skill list                               everything installed, project and global
+  $ npx get-skill check                              which installed skills have updates
+  $ npx get-skill update -g                          update your user-level skills
+  $ npx get-skill remove pdf                         remove a skill from every agent
 
 Quality:   lint  scan  rules  init
 Registry:  search  info  add  list  remove  update  check
@@ -2099,7 +2134,7 @@ Docs: https://skillmd.com/docs/cli`);
 program.hook("preAction", (thisCmd) => {
   const opts = thisCmd.opts();
   if (opts.token && process.stderr.isTTY) {
-    console.error(pc15.yellow("\u26A0 --token is visible in your shell history and process list; prefer `skillmd login` or SKILLMD_TOKEN."));
+    console.error(pc15.yellow("\u26A0 --token is visible in your shell history and process list; prefer `npx get-skill login` or SKILLMD_TOKEN."));
   }
 });
 program.addCommand(lintCommand());

package/dist/mcp.js

@@ -13,7 +13,7 @@ import {
   safeText,
   stripTerminalEscapes,
   telemetryDisabled
-} from "./chunk-6JVWN3IG.js";
+} from "./chunk-MPBRLZWJ.js";
 
 // src/mcp/server.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";

package/package.json

@@ -1,14 +1,15 @@
 {
   "name": "skillmds",
-  "version": "1.3.5",
-  "description": "SkillMD for agents: the `skillmds` MCP server + the `skillmd` CLI (lint, scan, search, install, publish Agent Skills) from skillmd.com.",
+  "version": "1.3.7",
+  "description": "Find, install, lint and publish Agent Skills (SKILL.md) from skillmd.com: the get-skill CLI and MCP server.",
   "license": "MIT",
   "author": "SkillMD",
   "type": "module",
   "mcpName": "com.skillmd/skillmd",
   "bin": {
-    "skillmds": "bin/skillmd-mcp.mjs",
-    "skillmd": "bin/skillmd.mjs"
+    "get-skill": "bin/skillmd-mcp.mjs",
+    "skillmd": "bin/skillmd.mjs",
+    "skillmds": "bin/skillmd-mcp.mjs"
   },
   "files": [
     "bin",
@@ -21,6 +22,7 @@
     "node": ">=18"
   },
   "keywords": [
+    "get-skill",
     "mcp",
     "model-context-protocol",
     "cli",