agent-skillforge 0.4.1__tar.gz → 0.4.2__tar.gz

{agent_skillforge-0.4.1/src/agent_skillforge.egg-info → agent_skillforge-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-skillforge
-Version: 0.4.1
+Version: 0.4.2
 Summary: Universal package manager, security auditor, and MCP server for portable agent skills (SKILL.md).
 Author-email: gintingism <gintingism@users.noreply.github.com>
 License-Expression: MIT
@@ -148,9 +148,10 @@ What the auditor scans for:
 - **Progressive Disclosure Budget (QUAL-003):** Flags `SKILL.md` bodies exceeding 500 lines or ~5,000 tokens so heavy references are moved to `references/`.
 - **Broken Disclosure Pointers (QUAL-004):** Verifies cited `references/...` or `scripts/...` exist.
 
-For CI pipelines, pass `--strict` to fail on any warning, or `--json` for automation:
+For CI pipelines, pass `--strict` to fail on any warning, `--json` for automation, or `--sarif` for GitHub Code Scanning:
 ```bash
-skillforge audit ./skills/my-new-skill --strict --json
+# Export standard OASIS SARIF v2.1.0 report
+skillforge audit ./skills/my-new-skill --sarif results.sarif
 ```
 
 ### 3. Profile your project's context token budget (`budget`)
@@ -169,7 +170,67 @@ Context Budget Profile (22 skills)
   Disclosed Resources Cost:           ~349 tokens
 ```
 
-### 4. Generate an official verified badge (`badge`)
+### 4. Test skill trigger accuracy and assertions (`test`)
+
+Verify that your skill description triggers on relevant user prompts, ignores unrelated requests, and respects keyword constraints using a deterministic test suite:
+
+```bash
+# Initialize a starter evals/evals.json test suite
+skillforge test ./skills/my-skill --init
+
+# Run test cases
+skillforge test ./skills/my-skill
+```
+```text
+Running evals for 'my-skill' (4 test cases)...
+  [PASS] trigger_positive_core_my_skill: "Please help me with my-skill following our workflow."
+  [PASS] trigger_positive_task: "I need to execute a task: my skill workflow description"
+  [PASS] suppress_negative_unrelated_math: "Calculate the Fibonacci sequence for n=30 in Python."
+  [PASS] suppress_negative_greeting: "Hello there, what is the weather like in Tokyo today?"
+
+Result: PASSED (4/4 passed)
+```
+
+Use `--json` in CI to verify that changes to `description` do not break activation accuracy.
+
+### 5. Optimize bloated skills with progressive disclosure (`optimize`)
+
+When a skill exceeds the 500-line or 5,000-token progressive disclosure budget (`QUAL-003`), extract heavy reference sections into `references/` while keeping concise pointers in `SKILL.md`:
+
+```bash
+# Refactor an oversized skill directory in-place
+skillforge optimize ./skills/bloated-api-skill --max-lines 400
+
+# Or output to a fresh destination folder
+skillforge optimize ./skills/bloated-api-skill -o ./skills/clean-api-skill
+```
+```text
+Optimized 'bloated-api-skill':
+  Lines:  680 -> 240 (440 lines saved)
+  Tokens: ~6200 -> ~2100 (4100 tokens saved)
+  Extracted References:
+    - references/database-guidelines.md
+    - references/api-endpoints-manual.md
+  Destination: ./skills/clean-api-skill
+  Audit Verification: PASSED
+```
+
+### 6. Convert OpenAPI / Swagger to a portable skill (`import-openapi`)
+
+Convert an existing REST API specification (OpenAPI 3.0, 3.1, or Swagger 2.0 in JSON or YAML) into a progressive disclosure skill package without running external scripts:
+
+```bash
+skillforge import-openapi ./openapi.yaml --output ./skills
+```
+```text
+Successfully imported 'petstore-api' into skills/petstore-api
+  SKILL.md:               28 lines (~320 body tokens)
+  endpoints.md reference: ~1850 tokens
+```
+
+The resulting package contains an executive overview in `SKILL.md` and detailed endpoint schemas in `references/endpoints.md`, keeping turn-by-turn context overhead low.
+
+### 7. Generate an official verified badge (`badge`)
 
 Show users that your skill is clean, secure, and audited. Generate an official badge for your skill repository:
 
@@ -180,7 +241,7 @@ skillforge badge ./my-skill
 [![Audited by SkillForge](https://img.shields.io/badge/SkillForge-Security%20Passed%20100%2F100-2ea44f?logo=shield&style=flat-square)](https://github.com/gintingism/skillforge)
 ```
 
-### 5. Grab a skill directly from GitHub (`add`)
+### 8. Grab a skill directly from GitHub (`add`)
 
 Pull skills directly from remote Git repositories with security auditing and reproducible commit pinning:
 
@@ -197,7 +258,7 @@ skillforge add gintingism/skillforge:systematic-debugging
 
 SkillForge fetches the skill, audits its security, routes it to all detected assistant targets, and pins its SHA-256 digest + Git commit SHA into `skillforge.lock`.
 
-### 6. Verify skill integrity and detect drift (`verify`)
+### 9. Verify skill integrity and detect drift (`verify`)
 
 Check installed skills against `skillforge.lock` in CI/CD or local environments without modifying files or making network requests. Detects file tampering, missing dependencies, or unmanaged skills:
 
@@ -215,7 +276,7 @@ skillforge verify --json
 Verification PASSED: 2 skill(s) match skillforge.lock.
 ```
 
-### 7. Compare changes before updating (`diff`)
+### 10. Compare changes before updating (`diff`)
 
 Inspect diffs between local skills and upstream repositories, or compare two skill versions:
 
@@ -224,7 +285,7 @@ skillforge diff ./skills/my-skill
 skillforge diff my-skill gintingism/skillforge:my-skill
 ```
 
-### 8. Manage installed skills (`list` & `remove`)
+### 11. Manage installed skills (`list` & `remove`)
 
 See which skills are active across your editor targets:
 
@@ -246,7 +307,7 @@ To remove a skill from all detected assistants and update your lockfile:
 skillforge remove antislop-code
 ```
 
-### 9. Create and package your own skills (`create` & `pack`)
+### 12. Create and package your own skills (`create` & `pack`)
 
 Scaffold a single skill file or a full directory package with scripts and reference docs:
 
@@ -268,7 +329,7 @@ skillforge unpack ./db-migrator.zip --output ./skills
 
 ## 🤖 Automate in CI/CD (GitHub Action)
 
-Add SkillForge to your GitHub Actions workflow to audit every Pull Request:
+Add SkillForge to your GitHub Actions workflow to audit pull requests, enforce progressive disclosure budgets, and upload SARIF reports to GitHub Code Scanning:
 
 ```yaml
 name: Audit Agent Skills
@@ -277,6 +338,9 @@ on: [pull_request, push]
 jobs:
   audit:
     runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
     steps:
       - uses: actions/checkout@v4
       - name: Run SkillForge Security & Token Linter
@@ -285,6 +349,13 @@ jobs:
           path: './skills'
           strict: 'true'
           budget: 'true'
+          sarif: 'skillforge-findings.sarif'
+
+      - name: Upload SARIF to GitHub Code Scanning
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: 'skillforge-findings.sarif'
 ```
 
 ---

{agent_skillforge-0.4.1 → agent_skillforge-0.4.2}/README.md

@@ -110,9 +110,10 @@ What the auditor scans for:
 - **Progressive Disclosure Budget (QUAL-003):** Flags `SKILL.md` bodies exceeding 500 lines or ~5,000 tokens so heavy references are moved to `references/`.
 - **Broken Disclosure Pointers (QUAL-004):** Verifies cited `references/...` or `scripts/...` exist.
 
-For CI pipelines, pass `--strict` to fail on any warning, or `--json` for automation:
+For CI pipelines, pass `--strict` to fail on any warning, `--json` for automation, or `--sarif` for GitHub Code Scanning:
 ```bash
-skillforge audit ./skills/my-new-skill --strict --json
+# Export standard OASIS SARIF v2.1.0 report
+skillforge audit ./skills/my-new-skill --sarif results.sarif
 ```
 
 ### 3. Profile your project's context token budget (`budget`)
@@ -131,7 +132,67 @@ Context Budget Profile (22 skills)
   Disclosed Resources Cost:           ~349 tokens
 ```
 
-### 4. Generate an official verified badge (`badge`)
+### 4. Test skill trigger accuracy and assertions (`test`)
+
+Verify that your skill description triggers on relevant user prompts, ignores unrelated requests, and respects keyword constraints using a deterministic test suite:
+
+```bash
+# Initialize a starter evals/evals.json test suite
+skillforge test ./skills/my-skill --init
+
+# Run test cases
+skillforge test ./skills/my-skill
+```
+```text
+Running evals for 'my-skill' (4 test cases)...
+  [PASS] trigger_positive_core_my_skill: "Please help me with my-skill following our workflow."
+  [PASS] trigger_positive_task: "I need to execute a task: my skill workflow description"
+  [PASS] suppress_negative_unrelated_math: "Calculate the Fibonacci sequence for n=30 in Python."
+  [PASS] suppress_negative_greeting: "Hello there, what is the weather like in Tokyo today?"
+
+Result: PASSED (4/4 passed)
+```
+
+Use `--json` in CI to verify that changes to `description` do not break activation accuracy.
+
+### 5. Optimize bloated skills with progressive disclosure (`optimize`)
+
+When a skill exceeds the 500-line or 5,000-token progressive disclosure budget (`QUAL-003`), extract heavy reference sections into `references/` while keeping concise pointers in `SKILL.md`:
+
+```bash
+# Refactor an oversized skill directory in-place
+skillforge optimize ./skills/bloated-api-skill --max-lines 400
+
+# Or output to a fresh destination folder
+skillforge optimize ./skills/bloated-api-skill -o ./skills/clean-api-skill
+```
+```text
+Optimized 'bloated-api-skill':
+  Lines:  680 -> 240 (440 lines saved)
+  Tokens: ~6200 -> ~2100 (4100 tokens saved)
+  Extracted References:
+    - references/database-guidelines.md
+    - references/api-endpoints-manual.md
+  Destination: ./skills/clean-api-skill
+  Audit Verification: PASSED
+```
+
+### 6. Convert OpenAPI / Swagger to a portable skill (`import-openapi`)
+
+Convert an existing REST API specification (OpenAPI 3.0, 3.1, or Swagger 2.0 in JSON or YAML) into a progressive disclosure skill package without running external scripts:
+
+```bash
+skillforge import-openapi ./openapi.yaml --output ./skills
+```
+```text
+Successfully imported 'petstore-api' into skills/petstore-api
+  SKILL.md:               28 lines (~320 body tokens)
+  endpoints.md reference: ~1850 tokens
+```
+
+The resulting package contains an executive overview in `SKILL.md` and detailed endpoint schemas in `references/endpoints.md`, keeping turn-by-turn context overhead low.
+
+### 7. Generate an official verified badge (`badge`)
 
 Show users that your skill is clean, secure, and audited. Generate an official badge for your skill repository:
 
@@ -142,7 +203,7 @@ skillforge badge ./my-skill
 [![Audited by SkillForge](https://img.shields.io/badge/SkillForge-Security%20Passed%20100%2F100-2ea44f?logo=shield&style=flat-square)](https://github.com/gintingism/skillforge)
 ```
 
-### 5. Grab a skill directly from GitHub (`add`)
+### 8. Grab a skill directly from GitHub (`add`)
 
 Pull skills directly from remote Git repositories with security auditing and reproducible commit pinning:
 
@@ -159,7 +220,7 @@ skillforge add gintingism/skillforge:systematic-debugging
 
 SkillForge fetches the skill, audits its security, routes it to all detected assistant targets, and pins its SHA-256 digest + Git commit SHA into `skillforge.lock`.
 
-### 6. Verify skill integrity and detect drift (`verify`)
+### 9. Verify skill integrity and detect drift (`verify`)
 
 Check installed skills against `skillforge.lock` in CI/CD or local environments without modifying files or making network requests. Detects file tampering, missing dependencies, or unmanaged skills:
 
@@ -177,7 +238,7 @@ skillforge verify --json
 Verification PASSED: 2 skill(s) match skillforge.lock.
 ```
 
-### 7. Compare changes before updating (`diff`)
+### 10. Compare changes before updating (`diff`)
 
 Inspect diffs between local skills and upstream repositories, or compare two skill versions:
 
@@ -186,7 +247,7 @@ skillforge diff ./skills/my-skill
 skillforge diff my-skill gintingism/skillforge:my-skill
 ```
 
-### 8. Manage installed skills (`list` & `remove`)
+### 11. Manage installed skills (`list` & `remove`)
 
 See which skills are active across your editor targets:
 
@@ -208,7 +269,7 @@ To remove a skill from all detected assistants and update your lockfile:
 skillforge remove antislop-code
 ```
 
-### 9. Create and package your own skills (`create` & `pack`)
+### 12. Create and package your own skills (`create` & `pack`)
 
 Scaffold a single skill file or a full directory package with scripts and reference docs:
 
@@ -230,7 +291,7 @@ skillforge unpack ./db-migrator.zip --output ./skills
 
 ## 🤖 Automate in CI/CD (GitHub Action)
 
-Add SkillForge to your GitHub Actions workflow to audit every Pull Request:
+Add SkillForge to your GitHub Actions workflow to audit pull requests, enforce progressive disclosure budgets, and upload SARIF reports to GitHub Code Scanning:
 
 ```yaml
 name: Audit Agent Skills
@@ -239,6 +300,9 @@ on: [pull_request, push]
 jobs:
   audit:
     runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
     steps:
       - uses: actions/checkout@v4
       - name: Run SkillForge Security & Token Linter
@@ -247,6 +311,13 @@ jobs:
           path: './skills'
           strict: 'true'
           budget: 'true'
+          sarif: 'skillforge-findings.sarif'
+
+      - name: Upload SARIF to GitHub Code Scanning
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: 'skillforge-findings.sarif'
 ```
 
 ---

{agent_skillforge-0.4.1 → agent_skillforge-0.4.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agent-skillforge"
-version = "0.4.1"
+version = "0.4.2"
 description = "Universal package manager, security auditor, and MCP server for portable agent skills (SKILL.md)."
 readme = "README.md"
 license = "MIT"

{agent_skillforge-0.4.1 → agent_skillforge-0.4.2/src/agent_skillforge.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-skillforge
-Version: 0.4.1
+Version: 0.4.2
 Summary: Universal package manager, security auditor, and MCP server for portable agent skills (SKILL.md).
 Author-email: gintingism <gintingism@users.noreply.github.com>
 License-Expression: MIT
@@ -148,9 +148,10 @@ What the auditor scans for:
 - **Progressive Disclosure Budget (QUAL-003):** Flags `SKILL.md` bodies exceeding 500 lines or ~5,000 tokens so heavy references are moved to `references/`.
 - **Broken Disclosure Pointers (QUAL-004):** Verifies cited `references/...` or `scripts/...` exist.
 
-For CI pipelines, pass `--strict` to fail on any warning, or `--json` for automation:
+For CI pipelines, pass `--strict` to fail on any warning, `--json` for automation, or `--sarif` for GitHub Code Scanning:
 ```bash
-skillforge audit ./skills/my-new-skill --strict --json
+# Export standard OASIS SARIF v2.1.0 report
+skillforge audit ./skills/my-new-skill --sarif results.sarif
 ```
 
 ### 3. Profile your project's context token budget (`budget`)
@@ -169,7 +170,67 @@ Context Budget Profile (22 skills)
   Disclosed Resources Cost:           ~349 tokens
 ```
 
-### 4. Generate an official verified badge (`badge`)
+### 4. Test skill trigger accuracy and assertions (`test`)
+
+Verify that your skill description triggers on relevant user prompts, ignores unrelated requests, and respects keyword constraints using a deterministic test suite:
+
+```bash
+# Initialize a starter evals/evals.json test suite
+skillforge test ./skills/my-skill --init
+
+# Run test cases
+skillforge test ./skills/my-skill
+```
+```text
+Running evals for 'my-skill' (4 test cases)...
+  [PASS] trigger_positive_core_my_skill: "Please help me with my-skill following our workflow."
+  [PASS] trigger_positive_task: "I need to execute a task: my skill workflow description"
+  [PASS] suppress_negative_unrelated_math: "Calculate the Fibonacci sequence for n=30 in Python."
+  [PASS] suppress_negative_greeting: "Hello there, what is the weather like in Tokyo today?"
+
+Result: PASSED (4/4 passed)
+```
+
+Use `--json` in CI to verify that changes to `description` do not break activation accuracy.
+
+### 5. Optimize bloated skills with progressive disclosure (`optimize`)
+
+When a skill exceeds the 500-line or 5,000-token progressive disclosure budget (`QUAL-003`), extract heavy reference sections into `references/` while keeping concise pointers in `SKILL.md`:
+
+```bash
+# Refactor an oversized skill directory in-place
+skillforge optimize ./skills/bloated-api-skill --max-lines 400
+
+# Or output to a fresh destination folder
+skillforge optimize ./skills/bloated-api-skill -o ./skills/clean-api-skill
+```
+```text
+Optimized 'bloated-api-skill':
+  Lines:  680 -> 240 (440 lines saved)
+  Tokens: ~6200 -> ~2100 (4100 tokens saved)
+  Extracted References:
+    - references/database-guidelines.md
+    - references/api-endpoints-manual.md
+  Destination: ./skills/clean-api-skill
+  Audit Verification: PASSED
+```
+
+### 6. Convert OpenAPI / Swagger to a portable skill (`import-openapi`)
+
+Convert an existing REST API specification (OpenAPI 3.0, 3.1, or Swagger 2.0 in JSON or YAML) into a progressive disclosure skill package without running external scripts:
+
+```bash
+skillforge import-openapi ./openapi.yaml --output ./skills
+```
+```text
+Successfully imported 'petstore-api' into skills/petstore-api
+  SKILL.md:               28 lines (~320 body tokens)
+  endpoints.md reference: ~1850 tokens
+```
+
+The resulting package contains an executive overview in `SKILL.md` and detailed endpoint schemas in `references/endpoints.md`, keeping turn-by-turn context overhead low.
+
+### 7. Generate an official verified badge (`badge`)
 
 Show users that your skill is clean, secure, and audited. Generate an official badge for your skill repository:
 
@@ -180,7 +241,7 @@ skillforge badge ./my-skill
 [![Audited by SkillForge](https://img.shields.io/badge/SkillForge-Security%20Passed%20100%2F100-2ea44f?logo=shield&style=flat-square)](https://github.com/gintingism/skillforge)
 ```
 
-### 5. Grab a skill directly from GitHub (`add`)
+### 8. Grab a skill directly from GitHub (`add`)
 
 Pull skills directly from remote Git repositories with security auditing and reproducible commit pinning:
 
@@ -197,7 +258,7 @@ skillforge add gintingism/skillforge:systematic-debugging
 
 SkillForge fetches the skill, audits its security, routes it to all detected assistant targets, and pins its SHA-256 digest + Git commit SHA into `skillforge.lock`.
 
-### 6. Verify skill integrity and detect drift (`verify`)
+### 9. Verify skill integrity and detect drift (`verify`)
 
 Check installed skills against `skillforge.lock` in CI/CD or local environments without modifying files or making network requests. Detects file tampering, missing dependencies, or unmanaged skills:
 
@@ -215,7 +276,7 @@ skillforge verify --json
 Verification PASSED: 2 skill(s) match skillforge.lock.
 ```
 
-### 7. Compare changes before updating (`diff`)
+### 10. Compare changes before updating (`diff`)
 
 Inspect diffs between local skills and upstream repositories, or compare two skill versions:
 
@@ -224,7 +285,7 @@ skillforge diff ./skills/my-skill
 skillforge diff my-skill gintingism/skillforge:my-skill
 ```
 
-### 8. Manage installed skills (`list` & `remove`)
+### 11. Manage installed skills (`list` & `remove`)
 
 See which skills are active across your editor targets:
 
@@ -246,7 +307,7 @@ To remove a skill from all detected assistants and update your lockfile:
 skillforge remove antislop-code
 ```
 
-### 9. Create and package your own skills (`create` & `pack`)
+### 12. Create and package your own skills (`create` & `pack`)
 
 Scaffold a single skill file or a full directory package with scripts and reference docs:
 
@@ -268,7 +329,7 @@ skillforge unpack ./db-migrator.zip --output ./skills
 
 ## 🤖 Automate in CI/CD (GitHub Action)
 
-Add SkillForge to your GitHub Actions workflow to audit every Pull Request:
+Add SkillForge to your GitHub Actions workflow to audit pull requests, enforce progressive disclosure budgets, and upload SARIF reports to GitHub Code Scanning:
 
 ```yaml
 name: Audit Agent Skills
@@ -277,6 +338,9 @@ on: [pull_request, push]
 jobs:
   audit:
     runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
     steps:
       - uses: actions/checkout@v4
       - name: Run SkillForge Security & Token Linter
@@ -285,6 +349,13 @@ jobs:
           path: './skills'
           strict: 'true'
           budget: 'true'
+          sarif: 'skillforge-findings.sarif'
+
+      - name: Upload SARIF to GitHub Code Scanning
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: 'skillforge-findings.sarif'
 ```
 
 ---

{agent_skillforge-0.4.1 → agent_skillforge-0.4.2}/src/agent_skillforge.egg-info/SOURCES.txt

@@ -12,7 +12,10 @@ src/skillforge/__main__.py
 src/skillforge/adapters.py
 src/skillforge/cli.py
 src/skillforge/errors.py
+src/skillforge/evals.py
 src/skillforge/mcp_server.py
+src/skillforge/openapi.py
+src/skillforge/optimizer.py
 src/skillforge/registry.py
 src/skillforge/security.py
 src/skillforge/skill.py
@@ -43,9 +46,13 @@ tests/test_adapters.py
 tests/test_badge.py
 tests/test_builtins.py
 tests/test_cli.py
+tests/test_evals.py
 tests/test_hardening.py
 tests/test_mcp_server.py
+tests/test_openapi.py
+tests/test_optimizer.py
 tests/test_registry.py
+tests/test_sarif.py
 tests/test_security.py
 tests/test_skill.py
 tests/test_verify_and_pinning.py

{agent_skillforge-0.4.1 → agent_skillforge-0.4.2}/src/skillforge/__init__.py

@@ -1,3 +1,3 @@
 """SkillForge: portable skills for AI coding assistants."""
 
-__version__ = "0.4.1"
+__version__ = "0.4.2"

{agent_skillforge-0.4.1 → agent_skillforge-0.4.2}/src/skillforge/cli.py

@@ -13,7 +13,10 @@ import typer
 
 from .adapters import detect_adapters
 from .errors import SecurityAuditError, SkillForgeError
+from .evals import init_evals, run_evals
 from .mcp_server import run_mcp_server
+from .openapi import import_openapi
+from .optimizer import optimize_skill
 from .registry import BuiltinRegistry, CompositeRegistry, GitRemoteRegistry, LocalRegistry, Registry
 from .security import Severity, SkillAuditor, audit_path
 from .skill import Skill, SkillPackage
@@ -61,6 +64,7 @@ def audit(
     path: Path,
     strict: bool = typer.Option(False, "--strict", help="Fail on any warning or low-severity finding."),
     json_output: bool = typer.Option(False, "--json", help="Emit machine-readable JSON."),
+    sarif_output: Path | None = typer.Option(None, "--sarif", help="Emit OASIS SARIF v2.1.0 report for GitHub Code Scanning."),
 ) -> None:
     """Audit a skill for prompt injection, zero-width unicode, and security issues."""
     try:
@@ -72,6 +76,12 @@ def audit(
             typer.echo(f"Audit error: {exc}", err=True)
         raise typer.Exit(code=1) from exc
 
+    if sarif_output:
+        sarif_output.parent.mkdir(parents=True, exist_ok=True)
+        sarif_output.write_text(json.dumps(report.to_sarif(), indent=2), encoding="utf-8")
+        if not json_output:
+            typer.echo(f"Wrote SARIF report to {sarif_output}")
+
     if json_output:
         typer.echo(json.dumps(report.to_dict()))
     else:
@@ -207,6 +217,111 @@ def unpack(archive: Path, output: Path = typer.Option(Path("."), "--output", "-o
     typer.echo(f"Unpacked skill '{package.skill.name}' into {output}")
 
 
+@app.command("import-openapi")
+def import_openapi_cmd(
+    spec_path: Path = typer.Argument(..., help="Path to OpenAPI/Swagger JSON or YAML specification file."),
+    output_dir: Path = typer.Option(Path("./skills"), "--output", "-o", help="Destination skills directory."),
+    name: str | None = typer.Option(None, "--name", "-n", help="Optional override for skill name."),
+) -> None:
+    """Convert an OpenAPI / Swagger specification into a progressive disclosure skill package."""
+    try:
+        pkg = import_openapi(spec_path, output_dir, skill_name=name)
+        dest = output_dir / pkg.skill.name
+        typer.echo(f"Successfully imported '{pkg.skill.name}' into {dest}")
+        typer.echo(f"  SKILL.md:               {pkg.skill.body_lines} lines (~{pkg.skill.body_tokens} body tokens)")
+        typer.echo(f"  endpoints.md reference: ~{pkg.resource_tokens} tokens")
+    except (SkillForgeError, OSError) as exc:
+        typer.echo(f"Import error: {exc}", err=True)
+        raise typer.Exit(code=1) from exc
+
+
+@app.command("test")
+def test_skill(
+    path: Path = typer.Argument(Path("."), help="Path to skill directory or SKILL.md file."),
+    init: bool = typer.Option(False, "--init", help="Generate starter evals/evals.json test suite."),
+    evals_path: Path | None = typer.Option(None, "--evals", help="Path to custom evals.json test suite file."),
+    json_output: bool = typer.Option(False, "--json", help="Emit machine-readable JSON."),
+) -> None:
+    """Run trigger accuracy and output assertions against an evals.json test suite."""
+    try:
+        if init:
+            target_file = init_evals(path)
+            typer.echo(f"Initialized eval suite in {target_file}")
+            return
+
+        report = run_evals(path, evals_path=evals_path)
+    except (SkillForgeError, OSError) as exc:
+        if json_output:
+            typer.echo(json.dumps({"passed": False, "error": str(exc)}))
+        else:
+            typer.echo(f"Eval error: {exc}", err=True)
+        raise typer.Exit(code=1) from exc
+
+    if json_output:
+        typer.echo(json.dumps(report.to_dict(), indent=2))
+    else:
+        typer.echo(f"Running evals for '{report.skill_name}' ({report.total_cases} test cases)...")
+        for r in report.results:
+            status = "PASS" if r.passed else "FAIL"
+            typer.echo(f"  [{status}] {r.case_id}: \"{r.prompt[:50]}\"")
+            if not r.passed:
+                typer.echo(f"         Reason: {r.reason}", err=True)
+
+        status_str = "PASSED" if report.passed else "FAILED"
+        typer.echo(f"\nResult: {status_str} ({report.passed_cases}/{report.total_cases} passed)")
+
+    if not report.passed:
+        raise typer.Exit(code=1)
+
+
+@app.command("optimize")
+def optimize_skill_cmd(
+    path: Path = typer.Argument(Path("."), help="Path to skill directory or SKILL.md file."),
+    output: Path | None = typer.Option(None, "--output", "-o", help="Optional output destination directory."),
+    max_lines: int = typer.Option(400, "--max-lines", help="Maximum lines for SKILL.md body."),
+    max_tokens: int = typer.Option(4000, "--max-tokens", help="Maximum token count for SKILL.md body."),
+    json_output: bool = typer.Option(False, "--json", help="Emit machine-readable JSON."),
+) -> None:
+    """Refactor a bloated SKILL.md into progressive disclosure references."""
+    try:
+        result = optimize_skill(
+            package_dir=path,
+            output_dir=output,
+            max_lines=max_lines,
+            max_tokens=max_tokens,
+        )
+    except (SkillForgeError, OSError) as exc:
+        if json_output:
+            typer.echo(json.dumps({"success": False, "error": str(exc)}))
+        else:
+            typer.echo(f"Optimization error: {exc}", err=True)
+        raise typer.Exit(code=1) from exc
+
+    if json_output:
+        typer.echo(json.dumps(result.to_dict(), indent=2))
+        return
+
+    typer.echo(f"Optimized '{result.skill_name}':")
+    typer.echo(f"  Lines:  {result.original_lines} -> {result.optimized_lines} ({result.lines_saved} lines saved)")
+    typer.echo(f"  Tokens: ~{result.original_tokens} -> ~{result.optimized_tokens} ({result.tokens_saved} tokens saved)")
+
+    if result.extracted_references:
+        typer.echo("  Extracted References:")
+        for ref in result.extracted_references:
+            typer.echo(f"    - {ref}")
+    else:
+        typer.echo("  No sections required extraction (already within budget).")
+
+    if result.saved_path:
+        typer.echo(f"  Destination: {result.saved_path}")
+
+    status_str = "PASSED" if result.passed_audit else "FAILED"
+    typer.echo(f"  Audit Verification: {status_str}")
+    if result.audit_findings:
+        for finding in result.audit_findings:
+            typer.echo(f"    [Finding] {finding}")
+
+
 @app.command()
 def search(query: str, registry: Path = typer.Option(Path(".skillforge"), "--registry")) -> None:
     """Search available skills across local and built-in registries."""