skillsets 0.1.0 → 0.1.2

package/dist/commands/audit.js

@@ -78,6 +78,27 @@ function isBinaryFile(filePath) {
         return false;
     }
 }
+function scanReadmeLinks(cwd) {
+    const readmePath = join(cwd, 'README.md');
+    if (!existsSync(readmePath))
+        return [];
+    const relativeLinks = [];
+    const content = readFileSync(readmePath, 'utf-8');
+    const lines = content.split('\n');
+    // Match markdown links: [text](url)
+    const linkRegex = /\[([^\]]*)\]\(([^)]+)\)/g;
+    for (let i = 0; i < lines.length; i++) {
+        let match;
+        while ((match = linkRegex.exec(lines[i])) !== null) {
+            const url = match[2];
+            // Flag relative links to content/.claude/ that aren't using GitHub URLs
+            if (url.startsWith('content/.claude/') || url.startsWith('./content/.claude/')) {
+                relativeLinks.push({ line: i + 1, link: url });
+            }
+        }
+    }
+    return relativeLinks;
+}
 function scanForSecrets(dir) {
     const secrets = [];
     const files = getAllFiles(dir);
@@ -167,6 +188,7 @@ function generateReport(results, cwd) {
         results.contentStructure.status === 'PASS' &&
         results.fileSize.status !== 'FAIL' &&
         results.secrets.status === 'PASS' &&
+        results.readmeLinks.status === 'PASS' &&
         results.versionCheck.status === 'PASS';
     const submissionType = results.isUpdate
         ? `Update (${results.existingVersion} → ${results.skillsetVersion})`
@@ -197,6 +219,7 @@ function generateReport(results, cwd) {
 | File Size Check | ${statusIcon(results.fileSize.status)} | ${results.fileSize.details} |
 | Binary Detection | ${statusIcon(results.binary.status)} | ${results.binary.details} |
 | Secret Detection | ${statusIcon(results.secrets.status)} | ${results.secrets.details} |
+| README Links | ${statusIcon(results.readmeLinks.status)} | ${results.readmeLinks.details} |
 | Version Check | ${statusIcon(results.versionCheck.status)} | ${results.versionCheck.details} |
 
 ---
@@ -236,6 +259,12 @@ ${results.secrets.findings || 'No secrets detected.'}
 
 ${results.secretsFound.length > 0 ? '**Potential Secrets Found:**\n' + results.secretsFound.map(s => `- ${s.file}:${s.line} (${s.pattern})`).join('\n') : ''}
 
+### 7. README Link Check
+
+${results.readmeLinks.findings || 'All links use valid GitHub URLs.'}
+
+${results.relativeLinks.length > 0 ? '**Relative Links Found:**\n' + results.relativeLinks.map(l => `- Line ${l.line}: ${l.link}`).join('\n') : ''}
+
 ---
 
 ## File Inventory
@@ -285,11 +314,13 @@ export async function audit() {
         binary: { status: 'PASS', details: '' },
         secrets: { status: 'PASS', details: '' },
         versionCheck: { status: 'PASS', details: '' },
+        readmeLinks: { status: 'PASS', details: '' },
         isUpdate: false,
         files: [],
         largeFiles: [],
         binaryFiles: [],
         secretsFound: [],
+        relativeLinks: [],
     };
     // 1. Manifest validation
     spinner.text = 'Validating manifest...';
@@ -396,7 +427,20 @@ export async function audit() {
             findings: 'Remove all API keys, tokens, and passwords before submitting.',
         };
     }
-    // 7. Version check (for updates)
+    // 7. README link check
+    spinner.text = 'Checking README links...';
+    results.relativeLinks = scanReadmeLinks(cwd);
+    if (results.relativeLinks.length === 0) {
+        results.readmeLinks = { status: 'PASS', details: 'All links valid' };
+    }
+    else {
+        results.readmeLinks = {
+            status: 'FAIL',
+            details: `${results.relativeLinks.length} relative link(s)`,
+            findings: 'README links to content/.claude/ must use full GitHub URLs.\nFormat: https://github.com/skillsets-cc/main/blob/main/skillsets/%40username/skillset-name/content/.claude/...',
+        };
+    }
+    // 8. Version check (for updates)
     spinner.text = 'Checking registry...';
     if (results.skillsetName && results.authorHandle) {
         const skillsetId = `${results.authorHandle}/${results.skillsetName}`;
@@ -441,6 +485,7 @@ export async function audit() {
         results.contentStructure.status === 'PASS' &&
         results.fileSize.status !== 'FAIL' &&
         results.secrets.status === 'PASS' &&
+        results.readmeLinks.status === 'PASS' &&
         results.versionCheck.status === 'PASS';
     console.log('\n' + chalk.bold('Audit Summary:'));
     console.log('');
@@ -457,6 +502,7 @@ export async function audit() {
     console.log(`  ${icon(results.fileSize.status)} File Sizes: ${results.fileSize.details}`);
     console.log(`  ${icon(results.binary.status)} Binary Files: ${results.binary.details}`);
     console.log(`  ${icon(results.secrets.status)} Secrets: ${results.secrets.details}`);
+    console.log(`  ${icon(results.readmeLinks.status)} README Links: ${results.readmeLinks.details}`);
     console.log(`  ${icon(results.versionCheck.status)} Version: ${results.versionCheck.details}`);
     console.log('');
     if (allPassed) {

package/dist/commands/init.js

@@ -76,7 +76,7 @@ This skillset has been verified in production.
 [List projects or products built using this skillset]
 `;
 const AUDIT_SKILL_MD = `---
-name: skillset-audit
+name: audit-skill
 description: Qualitative review of skillset content against Claude Code best practices. Evaluates all primitives (skills, agents, hooks, MCP, CLAUDE.md) for proper frontmatter, descriptions, and structure. Appends analysis to AUDIT_REPORT.md.
 ---
 
@@ -419,8 +419,8 @@ export async function init(options) {
         // Generate PROOF.md
         const proof = PROOF_TEMPLATE.replace('{{PRODUCTION_URL}}', productionUrl);
         writeFileSync(join(cwd, 'PROOF.md'), proof);
-        // Install skillset-audit skill to .claude/skills/
-        const skillDir = join(cwd, '.claude', 'skills', 'skillset-audit');
+        // Install audit-skill skill to .claude/skills/
+        const skillDir = join(cwd, '.claude', 'skills', 'audit-skill');
         mkdirSync(skillDir, { recursive: true });
         writeFileSync(join(skillDir, 'SKILL.md'), AUDIT_SKILL_MD);
         writeFileSync(join(skillDir, 'CRITERIA.md'), AUDIT_CRITERIA_MD);
@@ -438,12 +438,12 @@ export async function init(options) {
             console.log('    └── (add your .claude/ and/or CLAUDE.md here)');
         }
         console.log('  .claude/skills/   - Audit skill installed');
-        console.log('    └── skillset-audit/');
+        console.log('    └── audit-skill/');
         console.log(chalk.cyan('\nNext steps:'));
         console.log('  1. Edit PROOF.md with production evidence');
         console.log('  2. Ensure content/ has your skillset files');
         console.log('  3. Run: npx skillsets audit');
-        console.log('  4. Run: /skillset-audit (qualitative review)');
+        console.log('  4. Run: /audit-skill [AUDIT_REPORT.md] [path/to/reference-repo]');
     }
     catch (error) {
         spinner.fail('Failed to create structure');

package/dist/commands/submit.js

@@ -1,6 +1,6 @@
 import chalk from 'chalk';
 import ora from 'ora';
-import { execSync } from 'child_process';
+import { execSync, spawnSync } from 'child_process';
 import { existsSync, readFileSync, mkdirSync, cpSync, rmSync } from 'fs';
 import { join } from 'path';
 import yaml from 'js-yaml';
@@ -59,11 +59,17 @@ function parseSkillsetYaml(cwd) {
     try {
         const content = readFileSync(yamlPath, 'utf-8');
         const data = yaml.load(content);
-        return {
-            name: data.name,
-            author: data.author?.handle?.replace('@', ''),
-            version: data.version,
-        };
+        const name = data.name;
+        const author = data.author?.handle?.replace('@', '');
+        const version = data.version;
+        // Validate format to prevent command injection
+        if (!name || !/^[A-Za-z0-9_-]+$/.test(name))
+            return null;
+        if (!author || !/^[A-Za-z0-9_-]+$/.test(author))
+            return null;
+        if (!version || !/^[0-9]+\.[0-9]+\.[0-9]+$/.test(version))
+            return null;
+        return { name, author, version };
     }
     catch {
         return null;
@@ -185,7 +191,7 @@ export async function submit() {
         execSync(`gh repo clone ${REGISTRY_REPO} "${tempDir}" -- --depth=1`, { stdio: 'ignore' });
         // Create branch
         spinner.text = 'Creating branch...';
-        execSync(`git checkout -b "${branchName}"`, { cwd: tempDir, stdio: 'ignore' });
+        spawnSync('git', ['checkout', '-b', branchName], { cwd: tempDir, stdio: 'ignore' });
         // Create skillset directory
         const skillsetDir = join(tempDir, 'skillsets', `@${skillset.author}`, skillset.name);
         mkdirSync(skillsetDir, { recursive: true });
@@ -199,14 +205,14 @@ export async function submit() {
         }
         // Commit
         spinner.text = 'Committing changes...';
-        execSync('git add .', { cwd: tempDir, stdio: 'ignore' });
+        spawnSync('git', ['add', '.'], { cwd: tempDir, stdio: 'ignore' });
         const commitMsg = isUpdate
             ? `Update ${skillsetId} to v${skillset.version}`
             : `Add ${skillsetId}`;
-        execSync(`git commit -m "${commitMsg}"`, { cwd: tempDir, stdio: 'ignore' });
+        spawnSync('git', ['commit', '-m', commitMsg], { cwd: tempDir, stdio: 'ignore' });
         // Push to fork
         spinner.text = 'Pushing to fork...';
-        execSync(`git push -u origin "${branchName}" --force`, { cwd: tempDir, stdio: 'ignore' });
+        spawnSync('git', ['push', '-u', 'origin', branchName, '--force'], { cwd: tempDir, stdio: 'ignore' });
         // Create PR
         spinner.text = 'Creating pull request...';
         const prTitle = isUpdate
@@ -254,13 +260,19 @@ _Add any additional context for reviewers here._
 ---
 Submitted via \`npx skillsets submit\`
 `;
-        const prResult = execSync(`gh pr create --repo ${REGISTRY_REPO} --title "${prTitle}" --body "${prBody.replace(/"/g, '\\"')}"`, { cwd: tempDir, encoding: 'utf-8' });
+        const prResult = spawnSync('gh', ['pr', 'create', '--repo', REGISTRY_REPO, '--title', prTitle, '--body', prBody], {
+            cwd: tempDir,
+            encoding: 'utf-8',
+        });
+        if (prResult.status !== 0) {
+            throw new Error(prResult.stderr || 'Failed to create PR');
+        }
         // Cleanup
         spinner.text = 'Cleaning up...';
         rmSync(tempDir, { recursive: true, force: true });
         spinner.succeed('Pull request created');
         // Extract PR URL from result
-        const prUrl = prResult.trim();
+        const prUrl = (prResult.stdout || '').trim();
         console.log(chalk.green(`\n✓ ${isUpdate ? 'Update' : 'Submission'} complete!\n`));
         console.log(`  Skillset: ${chalk.bold(skillsetId)}`);
         if (isUpdate) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillsets",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "CLI tool for discovering and installing verified skillsets",
   "type": "module",
   "bin": {