skills-layer 0.1.7 → 0.1.9

package/README.md

@@ -22,7 +22,7 @@ This repository contains the public CLI/local integration surface only. The host
 
 Use it to discover, validate, install, export, and manage agent-ready skill bundles from a terminal. By default, backend-backed commands talk to Skills Layer Cloud. Use another endpoint only when Skills Layer explicitly provides one for your account or environment.
 
-Skills Layer is a headless, agent-first platform for Markdown-first skill bundles centered on `SKILL.md`. It manages catalog metadata, validation, trust reports, installation plans, entitlements, exports, workspace deployment, and local agent materialization. It does not host a separate runtime for every user's skill; your agent, IDE, CLI, or backend remains the execution environment.
+Skills Layer is a headless, agent-first platform for Markdown-first skill bundles centered on `SKILL.md`. It manages catalog metadata, validation, trust reports, installation plans, entitlements, exports, workspace approvals, and local agent materialization. It does not host a separate runtime for every user's skill; your agent, IDE, CLI, or backend remains the execution environment.
 
 <p align="center">
   <img src="https://unpkg.com/skills-layer/docs/assets/skills-layer-flow.svg" alt="Skills Layer flow from SKILL.md bundle to validation, catalog, CLI, MCP, API, and local agent installation" width="96%">
@@ -126,7 +126,7 @@ Use only endpoints published or explicitly provided by Skills Layer.
 ## Safety Model
 
 - Inspect trust reports before installing skills into sensitive projects.
-- Use `--dry-run` before mutating installs, submissions, workspace deployment, listing visibility, or ownership state.
+- Use `--dry-run` before mutating installs, submissions, workspace approvals, listing visibility, or ownership state.
 - Use `guardian check` before letting a skill drive shell, network, file, secret, browser, device, API, generated-code, or model-context actions.
 - Keep API keys out of visible command arguments. Login flows use saved sessions, masked prompts, secure headers, or environment-provided secrets.
 

package/SECURITY.md

@@ -0,0 +1,18 @@
+# Security Policy
+
+This repository contains the open-source Skills Layer CLI and local integration surface only. Skills Layer Cloud, marketplace services, Guardian scoring internals, and hosted backend code are not part of this repository.
+
+## Reporting A Vulnerability
+
+Please do not open public issues for active vulnerabilities.
+
+Use GitHub private vulnerability reporting for this repository when available, or email `hello@skills-layer.com` with a short non-sensitive summary and a way to contact you securely.
+
+Include:
+
+- affected package version
+- operating system and Node.js version
+- steps to reproduce
+- impact and any suggested mitigation
+
+We prioritize issues that could expose credentials, bypass Guardian checks, corrupt local installs, or mislead users about the source of a package.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skills-layer",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "private": false,
   "type": "module",
   "description": "Open-source CLI and local agent integration layer for Skills Layer Cloud.",
@@ -18,23 +18,23 @@
     "skills-layer": "bin/skills-layer.js"
   },
   "files": [
+    "SECURITY.md",
     "bin/skills-layer.js",
     "public/skills-layer-public.mjs",
     "scripts/skills-layer.mjs",
-    "docs/assets/*.svg",
-    "tests/public-cli-package.test.mjs"
+    "docs/assets/*.svg"
   ],
   "engines": {
     "node": ">=22"
   },
-  "publishConfig": {
-    "access": "public"
-  },
   "scripts": {
     "typecheck": "node --check bin/skills-layer.js && node --check scripts/skills-layer.mjs && node --check public/skills-layer-public.mjs && node --check tests/public-cli-package.test.mjs",
     "test": "node --test tests/public-cli-package.test.mjs",
     "test:coverage": "node --test --experimental-test-coverage --test-coverage-include=**/tests/public-cli-package.test.mjs --test-coverage-lines=100 --test-coverage-functions=100 --test-coverage-branches=100 tests/public-cli-package.test.mjs"
   },
+  "publishConfig": {
+    "access": "public"
+  },
   "license": "Apache-2.0",
   "repository": {
     "type": "git",