skillscokac 1.5.0 → 1.5.1

package/README.md

@@ -2,6 +2,9 @@
 
 CLI tool to install and manage Claude Code skills from [skills.cokac.com](https://skills.cokac.com)
 
+[![npm version](https://img.shields.io/npm/v/skillscokac.svg)](https://www.npmjs.com/package/skillscokac)
+[![License: ISC](https://img.shields.io/badge/License-ISC-blue.svg)](https://opensource.org/licenses/ISC)
+
 ## Installation
 
 No installation required! Use `npx` to run the CLI directly:
@@ -363,6 +366,69 @@ npm publish
 - **boxen** - Terminal UI boxes for skill listings
 - **yaml** - YAML frontmatter parsing from SKILL.md
 
+## Security
+
+Version 1.5.0 introduces comprehensive security enhancements to protect against various attack vectors:
+
+### Security Features
+
+**YAML Parsing Protection**
+- Automatic YAML frontmatter preprocessing with special character handling
+- Protection against YAML bombs (Billion Laughs attack)
+- Frontmatter size limits (10KB max)
+- Alias expansion limits (max 10 aliases)
+- Strict YAML parsing with unique key validation
+
+**Zip Bomb Protection**
+- Compression ratio validation (max 100:1 ratio)
+- Individual file size limits (10MB max)
+- Total package size limits (100MB max)
+- Early detection of suspicious compression patterns
+
+**Path Traversal Protection**
+- ZIP entry name validation
+- Absolute path rejection
+- Path traversal attempt detection (`..` sequences)
+- Null byte filename protection
+
+**Input Validation**
+- Collection ID validation (alphanumeric with hyphens/underscores only)
+- Skill name validation from API responses
+- Network request validation (content-type, redirect limits)
+- ReDoS (Regular Expression Denial of Service) protection
+
+**File Content Validation**
+- SKILL.md size validation before and after reading
+- UTF-8 encoding validation
+- Maximum line length limits (2000 chars)
+- Maximum line count limits (1000 lines)
+
+### Reporting Security Issues
+
+If you discover a security vulnerability, please email: monogatree@gmail.com
+
+## Changelog
+
+### v1.5.0 (2026-01-05)
+
+**Security Enhancements:**
+- Added comprehensive YAML bomb protection with alias limits
+- Implemented ZIP bomb detection with compression ratio checks
+- Enhanced path traversal protection for ZIP entries
+- Added ReDoS (Regular Expression Denial of Service) protection
+- Implemented strict input validation for collection IDs and skill names
+- Added file content size validation
+- Enhanced network request validation with content-type checks
+
+**Improvements:**
+- Automatic YAML frontmatter preprocessing for special characters
+- Better error messages for invalid inputs
+- Improved handling of malformed SKILL.md files
+
+### v1.4.3 and earlier
+
+Previous versions available on [npm](https://www.npmjs.com/package/skillscokac).
+
 ## License
 
 ISC

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillscokac",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "description": "CLI tool to install and manage Claude Code skills from skills.cokac.com",
   "main": "bin/skillscokac.js",
   "bin": {