Add installer filters for risk, category, and tags so maintainers and
users can ship smaller skill surfaces to context-sensitive runtimes.
Document the reduced-install flow for OpenCode-style hosts, add the
humanize-chinese community skill, and sync the generated catalog and
plugin-safe artifacts that now reflect the release batch.
Refs #437
Refs #440
Refs #443
Import the official Hugging Face ecosystem skills and sync the\nexisting local coverage with upstream metadata and assets.\n\nRegenerate the canonical catalog, plugin mirrors, docs, and release\nnotes after the maintainer merge batch so main stays in sync.\n\nFixes #417
Add a machine-readable CSV companion for the 2026-03-29 security re-triage so maintainers can consume the refreshed statuses outside the markdown report.\n\nLink the refresh markdown and walkthrough to the new export to keep the historical baseline, addendum, and current-head report aligned.
Re-triage the 2026-03-15 security finding set against current main, keep the old snapshot as historical baseline, and add a current-head refresh with updated counts and finding status.\n\nLink the baseline and addendum to the new refresh report so maintainers have one current source of truth for what is still reproducible on HEAD.
Document the current static web-app behavior, local-only save flow, shallow installer path, and maintainer-only sync controls.\n\nAlign maintainer guides with the active audit-to-risk-sync workflow, canonical artifact bot contract, release/coverage requirements, and updated security triage context so the docs match the repository's real operating model.
Add a maintainers script to safely promote high-confidence legacy risk labels from unknown to concrete values, cover it with tests, and regenerate the canonical skill artifacts and plugin copies. This reduces the legacy unknown backlog without forcing noisy classifications that still need manual review.
Tighten the repo-state automation so canonical bot commits remain
predictable while leaving main clean after each sync.
Make the public catalog UI more honest by hiding dev-only sync,
turning stars into explicit browser-local saves, aligning risk types,
and removing hardcoded catalog counts.
Add shared public asset URL helpers, risk suggestion plumbing,
safer unpack/sync guards, and CI coverage gates so release and
maintainer workflows catch drift earlier.
Document the new Claude Code and Codex plugin distributions and explain how root plugins, bundle plugins, and plugin-safe filtering relate to the full library install.\n\nSync the catalog, plugin compatibility artifacts, and generated plugin-safe subsets so main stays consistent before the v9.0.0 release flow.
Update the recommended GitHub topics to use all available slots with tags
that better match the repository's real tool coverage and search intent.
Refresh the social preview assets so shared links and topic pages present
current positioning and the latest skill count more clearly.
Add fourteen skills from Dimillian/Skills, integrate the merged Snowflake and WordPress updates into the maintainer sync, and refresh registry metadata, attributions, walkthrough notes, and the 8.9.0 release notes while keeping validation warnings within budget.
Refresh maintainer-owned artifacts after the PR merge batch, convert the\nJetski loader example to a directly importable Node ESM module, and add\nthe 8.7.0 changelog entry before release preparation.\n\nRefs #382\nRefs #388
Unify main-branch maintenance around repo-state and release-state commands so generated docs, contributor acknowledgements, tracked web assets, and canonical artifacts stay aligned across CI and scheduled hygiene runs.
Harden release publication by reusing deterministic sync commands, adding package dry-run verification, and covering the new workflow contract with regression tests.
Align public docs and maintainer guidance with the current 1,304-skill catalog state and v8.4.0 release copy.
Refresh README credits for newly imported external sources, update user-facing count references, and document the post-release docs realignment in the changelog and walkthrough.
Import and normalize new skills from anthropics/skills, marketingskills, claude-seo, and obsidian-skills.
Align imported skills to repository validation rules, document provenance, and sync generated registry artifacts after the import.
Harden batch activation, dev refresh gating, Microsoft sync path
handling, and Jetski skill loading against command injection,
symlink traversal, and client-side star tampering.
Add regression coverage for the security-sensitive paths and
update the internal triage addendum for the Jetski loader fix.
- Add docs/maintainers/merging-prs.md: policy to always use Squash and merge,
resolve conflicts on PR branch so PR shows Merged; Co-authored-by for rare
local integration
- Update .github/MAINTENANCE.md: merge via GitHub only, never close after
local integration; conflict resolution on branch then merge
- Update CONTRIBUTING.md Recognition: we always merge accepted PRs on GitHub,
never close after integrating locally
Addresses feedback from @sraphaz on #225 (attribution when PRs are integrated
locally). Going forward PRs will show as Merged so contributors get full credit.
Consolidate the repository into clearer apps, tools, and layered docs areas so contributors can navigate and maintain it more reliably. Align validation, metadata sync, and CI around the same canonical workflow to reduce drift across local checks and GitHub Actions.
