skills 1.3.8 → 1.4.0

package/README.md

@@ -212,7 +212,7 @@ Skills can be installed to any of these agents:
 | Antigravity | `antigravity` | `.agent/skills/` | `~/.gemini/antigravity/skills/` |
 | Augment | `augment` | `.augment/skills/` | `~/.augment/skills/` |
 | Claude Code | `claude-code` | `.claude/skills/` | `~/.claude/skills/` |
-| OpenClaw | `openclaw` | `skills/` | `~/.moltbot/skills/` |
+| OpenClaw | `openclaw` | `skills/` | `~/.openclaw/skills/` |
 | Cline | `cline` | `.cline/skills/` | `~/.cline/skills/` |
 | CodeBuddy | `codebuddy` | `.codebuddy/skills/` | `~/.codebuddy/skills/` |
 | Codex | `codex` | `.agents/skills/` | `~/.codex/skills/` |
@@ -373,7 +373,7 @@ If no skills are found in standard locations, a recursive search is performed.
 Skills are generally compatible across agents since they follow a
 shared [Agent Skills specification](https://agentskills.io). However, some features may be agent-specific:
 
-| Feature         | OpenCode | OpenHands | Claude Code | Cline | CodeBuddy | Codex | Command Code | Kiro CLI | Cursor | Antigravity | Roo Code | Github Copilot | Amp | Clawdbot | Neovate | Pi  | Qoder | Zencoder |
+| Feature         | OpenCode | OpenHands | Claude Code | Cline | CodeBuddy | Codex | Command Code | Kiro CLI | Cursor | Antigravity | Roo Code | Github Copilot | Amp | OpenClaw | Neovate | Pi  | Qoder | Zencoder |
 | --------------- | -------- | --------- | ----------- | ----- | --------- | ----- | ------------ | -------- | ------ | ----------- | -------- | -------------- | --- | -------- | ------- | --- | ----- | -------- |
 | Basic skills    | Yes      | Yes       | Yes         | Yes   | Yes       | Yes   | Yes          | Yes      | Yes    | Yes         | Yes      | Yes            | Yes | Yes      | Yes     | Yes | Yes   | Yes      |
 | `allowed-tools` | Yes      | Yes       | Yes         | Yes   | Yes       | Yes   | Yes          | No       | Yes    | Yes         | Yes      | Yes            | Yes | Yes      | Yes     | Yes | Yes   | No       |
@@ -423,7 +423,7 @@ Telemetry is automatically disabled in CI environments.
 - [Antigravity Skills Documentation](https://antigravity.google/docs/skills)
 - [Factory AI / Droid Skills Documentation](https://docs.factory.ai/cli/configuration/skills)
 - [Claude Code Skills Documentation](https://code.claude.com/docs/en/skills)
-- [Clawdbot Skills Documentation](https://docs.clawd.bot/tools/skills)
+- [OpenClaw Skills Documentation](https://docs.openclaw.ai/tools/skills)
 - [Cline Skills Documentation](https://docs.cline.bot/features/skills)
 - [CodeBuddy Skills Documentation](https://www.codebuddy.ai/docs/ide/Features/Skills)
 - [Codex Skills Documentation](https://developers.openai.com/codex/skills)

package/ThirdPartyNoticeText.txt

@@ -8,23 +8,6 @@ are set forth below. These licenses and notices are provided for informational p
 Third Party Code Components
 --------------------------------------------
 
-================================================================================
-Package: @clack/core@0.4.1
-License: MIT
-Repository: https://github.com/natemoo-re/clack
---------------------------------------------------------------------------------
-
-MIT License
-
-Copyright (c) Nate Moore
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-
 ================================================================================
 Package: @clack/prompts@0.11.0
 License: MIT
@@ -121,35 +104,6 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
 
-================================================================================
-Package: sisteransi@1.0.5
-License: MIT
-Repository: https://github.com/terkelg/sisteransi
---------------------------------------------------------------------------------
-
-MIT License
-
-Copyright (c) 2018 Terkel Gjervig Nielsen
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-
 ================================================================================
 Package: xdg-basedir@5.1.0
 License: MIT

package/dist/cli.mjs

@@ -58,7 +58,10 @@ function isDirectSkillUrl(input) {
 	if (input.includes("gitlab.com/") && !input.includes("/-/raw/")) return false;
 	return true;
 }
+const SOURCE_ALIASES = { "coinbase/agentWallet": "coinbase/agentic-wallet-skills" };
 function parseSource(input) {
+	const alias = SOURCE_ALIASES[input];
+	if (alias) input = alias;
 	if (isLocalPath(input)) {
 		const resolvedPath = resolve(input);
 		return {
@@ -545,6 +548,12 @@ const home = homedir();
 const configHome = xdgConfig ?? join(home, ".config");
 const codexHome = process.env.CODEX_HOME?.trim() || join(home, ".codex");
 const claudeHome = process.env.CLAUDE_CONFIG_DIR?.trim() || join(home, ".claude");
+function getOpenClawGlobalSkillsDir(homeDir = home, pathExists = existsSync) {
+	if (pathExists(join(homeDir, ".openclaw"))) return join(homeDir, ".openclaw/skills");
+	if (pathExists(join(homeDir, ".clawdbot"))) return join(homeDir, ".clawdbot/skills");
+	if (pathExists(join(homeDir, ".moltbot"))) return join(homeDir, ".moltbot/skills");
+	return join(homeDir, ".openclaw/skills");
+}
 const agents = {
 	amp: {
 		name: "amp",
@@ -586,7 +595,7 @@ const agents = {
 		name: "openclaw",
 		displayName: "OpenClaw",
 		skillsDir: "skills",
-		globalSkillsDir: existsSync(join(home, ".openclaw")) ? join(home, ".openclaw/skills") : existsSync(join(home, ".clawdbot")) ? join(home, ".clawdbot/skills") : join(home, ".moltbot/skills"),
+		globalSkillsDir: getOpenClawGlobalSkillsDir(),
 		detectInstalled: async () => {
 			return existsSync(join(home, ".openclaw")) || existsSync(join(home, ".clawdbot")) || existsSync(join(home, ".moltbot"));
 		}
@@ -1359,6 +1368,7 @@ async function listInstalledSkills(options = {}) {
 	return Array.from(skillsMap.values());
 }
 const TELEMETRY_URL = "https://add-skill.vercel.sh/t";
+const AUDIT_URL = "https://add-skill.vercel.sh/audit";
 let cliVersion = null;
 function isCI() {
 	return !!(process.env.CI || process.env.GITHUB_ACTIONS || process.env.GITLAB_CI || process.env.CIRCLECI || process.env.TRAVIS || process.env.BUILDKITE || process.env.JENKINS_URL || process.env.TEAMCITY_VERSION);
@@ -1369,6 +1379,23 @@ function isEnabled() {
 function setVersion(version) {
 	cliVersion = version;
 }
+async function fetchAuditData(source, skillSlugs, timeoutMs = 3e3) {
+	if (skillSlugs.length === 0) return null;
+	try {
+		const params = new URLSearchParams({
+			source,
+			skills: skillSlugs.join(",")
+		});
+		const controller = new AbortController();
+		const timeout = setTimeout(() => controller.abort(), timeoutMs);
+		const response = await fetch(`${AUDIT_URL}?${params.toString()}`, { signal: controller.signal });
+		clearTimeout(timeout);
+		if (!response.ok) return null;
+		return await response.json();
+	} catch {
+		return null;
+	}
+}
 function track(data) {
 	if (!isEnabled()) return;
 	try {
@@ -1796,7 +1823,7 @@ async function saveSelectedAgents(agents) {
 	lock.lastSelectedAgents = agents;
 	await writeSkillLock(lock);
 }
-var version$1 = "1.3.8";
+var version$1 = "1.4.0";
 const isCancelled = (value) => typeof value === "symbol";
 async function isSourcePrivate(source) {
 	const ownerRepo = parseOwnerRepo(source);
@@ -1806,6 +1833,48 @@ async function isSourcePrivate(source) {
 function initTelemetry(version) {
 	setVersion(version);
 }
+function riskLabel(risk) {
+	switch (risk) {
+		case "critical": return import_picocolors.default.red(import_picocolors.default.bold("Critical Risk"));
+		case "high": return import_picocolors.default.red("High Risk");
+		case "medium": return import_picocolors.default.yellow("Med Risk");
+		case "low": return import_picocolors.default.green("Low Risk");
+		case "safe": return import_picocolors.default.green("Safe");
+		default: return import_picocolors.default.dim("--");
+	}
+}
+function socketLabel(audit) {
+	if (!audit) return import_picocolors.default.dim("--");
+	const count = audit.alerts ?? 0;
+	return count > 0 ? import_picocolors.default.red(`${count} alert${count !== 1 ? "s" : ""}`) : import_picocolors.default.green("0 alerts");
+}
+function padEnd(str, width) {
+	const visible = str.replace(/\x1b\[[0-9;]*m/g, "");
+	const pad = Math.max(0, width - visible.length);
+	return str + " ".repeat(pad);
+}
+function buildSecurityLines(auditData, skills, source) {
+	if (!auditData) return [];
+	if (!skills.some((s) => {
+		const data = auditData[s.slug];
+		return data && Object.keys(data).length > 0;
+	})) return [];
+	const nameWidth = Math.min(Math.max(...skills.map((s) => s.displayName.length)), 36);
+	const lines = [];
+	const header = padEnd("", nameWidth + 2) + padEnd(import_picocolors.default.dim("Gen"), 18) + padEnd(import_picocolors.default.dim("Socket"), 18) + import_picocolors.default.dim("Snyk");
+	lines.push(header);
+	for (const skill of skills) {
+		const data = auditData[skill.slug];
+		const name = skill.displayName.length > nameWidth ? skill.displayName.slice(0, nameWidth - 1) + "…" : skill.displayName;
+		const ath = data?.ath ? riskLabel(data.ath.risk) : import_picocolors.default.dim("--");
+		const socket = data?.socket ? socketLabel(data.socket) : import_picocolors.default.dim("--");
+		const snyk = data?.snyk ? riskLabel(data.snyk.risk) : import_picocolors.default.dim("--");
+		lines.push(padEnd(import_picocolors.default.cyan(name), nameWidth + 2) + padEnd(ath, 18) + padEnd(socket, 18) + snyk);
+	}
+	lines.push("");
+	lines.push(`${import_picocolors.default.dim("Details:")} ${import_picocolors.default.dim(`https://skills.sh/${source}`)}`);
+	return lines;
+}
 function shortenPath$1(fullPath, cwd) {
 	const home = homedir();
 	if (fullPath === home || fullPath.startsWith(home + sep)) return "~" + fullPath.slice(home.length);
@@ -2711,6 +2780,8 @@ async function runAdd(args, options = {}) {
 			}
 			selectedSkills = selected;
 		}
+		const ownerRepoForAudit = getOwnerRepo(parsed);
+		const auditPromise = ownerRepoForAudit ? fetchAuditData(ownerRepoForAudit, selectedSkills.map((s) => getSkillDisplayName(s))) : Promise.resolve(null);
 		let targetAgents;
 		const validAgents = Object.keys(agents);
 		if (options.agent?.includes("*")) {
@@ -2829,6 +2900,16 @@ async function runAdd(args, options = {}) {
 		}
 		console.log();
 		Me(summaryLines.join("\n"), "Installation Summary");
+		try {
+			const auditData = await auditPromise;
+			if (auditData && ownerRepoForAudit) {
+				const securityLines = buildSecurityLines(auditData, selectedSkills.map((s) => ({
+					slug: getSkillDisplayName(s),
+					displayName: getSkillDisplayName(s)
+				})), ownerRepoForAudit);
+				if (securityLines.length > 0) Me(securityLines.join("\n"), "Security Risk Assessments");
+			}
+		} catch {}
 		if (!options.yes) {
 			const confirmed = await ye({ message: "Proceed with installation?" });
 			if (pD(confirmed) || !confirmed) {
@@ -3043,7 +3124,14 @@ const RESET$2 = "\x1B[0m";
 const BOLD$2 = "\x1B[1m";
 const DIM$2 = "\x1B[38;5;102m";
 const TEXT$1 = "\x1B[38;5;145m";
+const CYAN$1 = "\x1B[36m";
 const SEARCH_API_BASE = process.env.SKILLS_API_URL || "https://skills.sh";
+function formatInstalls(count) {
+	if (!count || count <= 0) return "";
+	if (count >= 1e6) return `${(count / 1e6).toFixed(1).replace(/\.0$/, "")}M installs`;
+	if (count >= 1e3) return `${(count / 1e3).toFixed(1).replace(/\.0$/, "")}K installs`;
+	return `${count} install${count === 1 ? "" : "s"}`;
+}
 async function searchSkillsAPI(query) {
 	try {
 		const url = `${SEARCH_API_BASE}/api/search?q=${encodeURIComponent(query)}&limit=10`;
@@ -3093,8 +3181,10 @@ async function runSearchPrompt(initialQuery = "") {
 				const arrow = isSelected ? `${BOLD$2}>${RESET$2}` : " ";
 				const name = isSelected ? `${BOLD$2}${skill.name}${RESET$2}` : `${TEXT$1}${skill.name}${RESET$2}`;
 				const source = skill.source ? ` ${DIM$2}${skill.source}${RESET$2}` : "";
+				const installs = formatInstalls(skill.installs);
+				const installsBadge = installs ? ` ${CYAN$1}${installs}${RESET$2}` : "";
 				const loadingIndicator = loading && i === 0 ? ` ${DIM$2}...${RESET$2}` : "";
-				lines.push(`  ${arrow} ${name}${source}${loadingIndicator}`);
+				lines.push(`  ${arrow} ${name}${source}${installsBadge}${loadingIndicator}`);
 			}
 		}
 		lines.push("");
@@ -3212,7 +3302,8 @@ ${DIM$2}  2) npx skills add <owner/repo@skill>${RESET$2}`;
 		console.log();
 		for (const skill of results.slice(0, 6)) {
 			const pkg = skill.source || skill.slug;
-			console.log(`${TEXT$1}${pkg}@${skill.name}${RESET$2}`);
+			const installs = formatInstalls(skill.installs);
+			console.log(`${TEXT$1}${pkg}@${skill.name}${RESET$2}${installs ? ` ${CYAN$1}${installs}${RESET$2}` : ""}`);
 			console.log(`${DIM$2}└ https://skills.sh/${skill.slug}${RESET$2}`);
 			console.log();
 		}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skills",
-  "version": "1.3.8",
+  "version": "1.4.0",
   "description": "The open agent skills ecosystem",
   "type": "module",
   "bin": {