Add a conservative metadata fixer for missing risk and source fields,
cover it with tests, and backfill the remaining skills using explicit
source inference only when the provenance is clear. Fall back to the
repo-documented defaults when the file does not support a stronger claim.
Refs #365
* Implemented scripts and a Python utility to optimize agent skills, preventing context window overload, and document their usage.
* feat(infra): add skills optimization scripts with bundle support and fixed archive logic
* Removed Linux / Mac optimize-skills
* Removed the Linux Section
* feat(infra): final robust skill optimization suite with Library Mode
* Removed
* Updated the read me changed the optimisation to activation-skills
* Updated ReadMe
* docs: trim activation script README diff
* docs: update README with activate-skills script instructions
* fix: resolve merge conflict in get-bundle-skills.py with security and compatibility
* fix: resolve merge conflicts in activate-skills.bat and get-bundle-skills.py using line-based iteration
---------
Co-authored-by: sck_0 <samujackson1337@gmail.com>
Make the skill filter helper treat the complete bundle as a
pass-through so categories missing from the hardcoded map are
not silently omitted.
Add a regression test to keep complete bundle behavior aligned
with its name.
Harden batch activation, dev refresh gating, Microsoft sync path
handling, and Jetski skill loading against command injection,
symlink traversal, and client-side star tampering.
Add regression coverage for the security-sensitive paths and
update the internal triage addendum for the Jetski loader fix.
Tighten the remaining high-signal security findings by switching the todo example to a standard Express rate limiter, removing sensitive metadata from boilerplate logging, and replacing fragile HTML tag filtering with parser-based conversion.
Co-Authored-By: Claude <noreply@anthropic.com>
Harden template and example code paths, redact sensitive output, and pin safe transitive npm packages. Consolidate the todo backend on better-sqlite3 so the example no longer pulls the vulnerable sqlite3 chain and still passes build and CRUD smoke checks.
Co-Authored-By: Claude <noreply@anthropic.com>
Update the Claude marketplace entry to use a schema-valid relative source path and add a regression test so invalid marketplace sources fail in the local suite. Also document the maintainer workflow used for stale PR metadata and fork-gated Actions runs.
Fixes#344
* Implemented scripts and a Python utility to optimize agent skills, preventing context window overload, and document their usage.
* feat(infra): add skills optimization scripts with bundle support and fixed archive logic
* Removed Linux / Mac optimize-skills
* Removed the Linux Section
* feat(infra): final robust skill optimization suite with Library Mode
* Removed
* Updated the read me changed the optimisation to activation-skills
* Updated ReadMe
* docs: trim activation script README diff
---------
Co-authored-by: sck_0 <samujackson1337@gmail.com>
Include tools/lib in the published npm files whitelist so the npx installer can resolve symlink-safety at runtime. Add a regression test that checks npm pack --dry-run --json for the expected packaged files.
Fixes#315
Co-Authored-By: Claude <noreply@anthropic.com>
Consolidate the repository into clearer apps, tools, and layered docs areas so contributors can navigate and maintain it more reliably. Align validation, metadata sync, and CI around the same canonical workflow to reduce drift across local checks and GitHub Actions.
