dot-skill / skillerr

Der aufgelöste Abhängigkeitssatz konnte für diesen Bericht nicht erhoben werden: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

Die Installation von npm:skillerr@1.7.0 zieht 74 Pakete nach sich, direkt und transitiv: 0 tragen bekannte Advisories, davon 0 direkte Abhängigkeiten.

Keine bekannten Advisories betreffen die bewerteten Abhängigkeiten.

Ein Advisory bedeutet, dass die im Abhängigkeitsgraphen erfasste Version in den betroffenen Bereich eines Advisories fällt. Erreichbarkeit wird nicht analysiert, und der Graph enthält Entwicklungs- und Test-Pins — ein Fund kann das Werkzeug betreffen und nicht die ausgelieferte Software.

{
  "data": {
    "repo": {
      "topics": [
        "ai-agents",
        "mcp",
        "open-source",
        "protocol",
        "skill",
        "agents",
        "ai-skills",
        "cli",
        "dot-skill",
        "skillerr"
      ],
      "is_fork": false,
      "size_kb": 15531,
      "has_wiki": true,
      "homepage": "https://www.skillerr.com/docs/",
      "languages": {
        "Shell": 1050,
        "JavaScript": 117755,
        "TypeScript": 773900
      },
      "pushed_at": "2026-07-21T03:17:53Z",
      "created_at": "2026-07-12T14:52:25Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-21T03:17:48Z",
      "description": "Open .skill Protocol - a sealed, inspectable package format for AI agent skills. Reference implementation: skillerr.",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "TypeScript",
      "significant_languages": [
        "TypeScript",
        "JavaScript"
      ]
    },
    "owner": {
      "blog": "https://skillerr.com",
      "name": "Skillerr",
      "type": "Organization",
      "login": "dot-skill",
      "company": "Skillerr",
      "location": null,
      "followers": 0,
      "avatar_url": "https://avatars.githubusercontent.com/u/304076320?v=4",
      "created_at": "2026-07-12T15:20:50Z",
      "is_verified": null,
      "public_repos": 4,
      "account_age_days": 15
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v1.1.0",
          "kind": "minor",
          "published_at": "2026-07-15T17:04:33Z"
        },
        {
          "tag": "v1.0.3",
          "kind": "patch",
          "published_at": "2026-07-15T02:08:51Z"
        },
        {
          "tag": "v1.0.2",
          "kind": "patch",
          "published_at": "2026-07-15T01:02:54Z"
        },
        {
          "tag": "v1.0.1",
          "kind": "patch",
          "published_at": "2026-07-15T01:04:46Z"
        },
        {
          "tag": "v1.0.0",
          "kind": "major",
          "published_at": "2026-07-15T01:04:44Z"
        },
        {
          "tag": "v0.9.10",
          "kind": "patch",
          "published_at": "2026-07-15T01:04:42Z"
        },
        {
          "tag": "v0.9.9",
          "kind": "patch",
          "published_at": "2026-07-15T01:04:41Z"
        },
        {
          "tag": "v0.9.8",
          "kind": "patch",
          "published_at": "2026-07-15T01:04:39Z"
        },
        {
          "tag": "v0.9.7",
          "kind": "patch",
          "published_at": "2026-07-15T01:04:37Z"
        },
        {
          "tag": "v0.9.6",
          "kind": "patch",
          "published_at": "2026-07-15T01:04:36Z"
        },
        {
          "tag": "v0.9.5",
          "kind": "patch",
          "published_at": "2026-07-15T01:04:34Z"
        },
        {
          "tag": "v0.9.4",
          "kind": "patch",
          "published_at": "2026-07-15T01:04:32Z"
        },
        {
          "tag": "v0.9.2",
          "kind": "patch",
          "published_at": "2026-07-15T01:04:30Z"
        },
        {
          "tag": "v0.9.1",
          "kind": "patch",
          "published_at": "2026-07-15T01:04:28Z"
        },
        {
          "tag": "v0.9.0",
          "kind": "minor",
          "published_at": "2026-07-15T01:04:27Z"
        },
        {
          "tag": "v0.8.1",
          "kind": "patch",
          "published_at": "2026-07-15T01:04:24Z"
        },
        {
          "tag": "v0.7.1",
          "kind": "patch",
          "published_at": "2026-07-15T01:04:23Z"
        },
        {
          "tag": "v0.7.0",
          "kind": "minor",
          "published_at": "2026-07-15T01:04:21Z"
        },
        {
          "tag": "v0.6.4",
          "kind": "patch",
          "published_at": "2026-07-15T01:04:19Z"
        },
        {
          "tag": "v0.6.3",
          "kind": "patch",
          "published_at": "2026-07-15T01:04:17Z"
        },
        {
          "tag": "v0.6.2",
          "kind": "patch",
          "published_at": "2026-07-15T01:04:15Z"
        },
        {
          "tag": "v0.6.1",
          "kind": "patch",
          "published_at": "2026-07-15T01:04:13Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "20ff4245fff289095642e74c1febf3f6a30e4b04",
          "body": "release: 1.7.0 — SessionSource inference-free capture intake",
          "is_bot": false,
          "headline": "Merge pull request #61 from dot-skill/release/1.7.0",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-21T03:17:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8e7abfd801303eae32ea1c3aa0e113accf21890a",
          "body": "Lockstep bump. Ships listSessionCandidates / resolveSession /\nloadSessionContext and captureSession({ from, sessionId }) so Continuity\ncan merge local agent session stores over the git floor without a model.\n\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>\nCo-authored-by: Cursor <cursoragent@cursor.com>",
          "is_bot": false,
          "headline": "release: 1.7.0 — SessionSource inference-free capture intake",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-21T03:13:10Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "396d910ac5f42e09c60233651d419c49d8b498a1",
          "body": "feat(core): SessionSource APIs for inference-free agent session capture",
          "is_bot": false,
          "headline": "Merge pull request #60 from dot-skill/feature/session-source",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-21T03:12:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1f5986323ba1fdbad4d8929b4492908f743bb8e6",
          "body": "Claude-style path slugs included drive-letter `:` (e.g. C:-Users-...),\nwhich is illegal in Windows directory names and broke the CI matrix\nfixtures. Strip Windows-illegal characters and normalize related-path\nchecks to forward slashes.\n\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>\nCo-authored-by: Cursor <cursoragent@cursor.com>",
          "is_bot": false,
          "headline": "fix(core): sanitize SessionSource project slugs for Windows paths",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-21T03:08:40Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "1e1c36d9fe69c082c30fdfe439456dfedbbf6a92",
          "body": "Add listSessionCandidates / resolveSession / loadSessionContext for\nclaude-code|codex|cursor local stores (no model calls), wired into\ncaptureSession({ from, sessionId }) on top of the existing git floor.\nNormalize claude ↔ claude-code; scrub session lines and attach bytes.\nCLI: skill capture --from\n[…]\n\nINTEGRATION_NOTES ACTION for registry to drop cli/session-sources.mjs.\n\nAI-assisted (Cursor).\n\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>\nCo-authored-by: Cursor <cursoragent@cursor.com>",
          "is_bot": false,
          "headline": "feat(core): SessionSource APIs for inference-free agent session capture",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-21T03:05:56Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d01090f29b5d2a004bad028446aaedbe67bdb1f5",
          "body": "release: 1.6.0 — trust spine, capture/continuity, scrub, Merkle log, Apache-2.0",
          "is_bot": false,
          "headline": "Merge pull request #59 from dot-skill/release/1.6.0",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-21T02:48:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6e1beb649dffc4d337d0b49e256e127b1dea6ed4",
          "body": "…Apache-2.0\n\nLockstep bump across all seven packages. Ships the develop-accumulated work\nCursor has been mocking: captureSession + Resume Contract 1.0, trust-spine\nverify/SBOM, Merkle log, deterministic scrubbing, Apache-2.0 relicense, and\ndoc-audit CI (DOC-MAP, license + link checks). Test badge updated to 285.\n\nAI-assisted (Cursor).\n\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>\nCo-authored-by: Cursor <cursoragent@cursor.com>",
          "is_bot": false,
          "headline": "release: 1.6.0 — trust spine, capture/continuity, scrub, Merkle log, …",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-21T02:40:56Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "b2fc38548c00afa17a5c089d3563f3f211e53175",
          "body": "docs: DOC-MAP + license/link CI checks (doc-audit remainder)",
          "is_bot": false,
          "headline": "Merge pull request #58 from dot-skill/feature/doc-audit-remainder",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-21T02:37:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "259a391972af35f71bb1223d882ffdf515b125c1",
          "body": "Add docs/DOC-MAP.md as the index of every doc surface and owning module,\nwire license-consistency and dead-internal-link checks into CI, and add a\nDocs impact section to CONTRIBUTING that points at the map. Prevents the\nMIT/Apache drift that landed on main from recurring, and catches broken\nrelative links before merge.\n\nAI-assisted (Cursor).\n\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>\nCo-authored-by: Cursor <cursoragent@cursor.com>",
          "is_bot": false,
          "headline": "docs: DOC-MAP + license/link CI checks (doc-audit remainder)",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-21T02:33:01Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "73f768494ccdd0f779bd61d08fdffed50413fe82",
          "body": "feat(core): real session capture + Resume Contract 1.0 (fixes hollow handoff)",
          "is_bot": false,
          "headline": "Merge pull request #57 from dot-skill/feature/session-capture",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-21T01:42:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9fb334676eef383a1d1af483b317c9a45a940a5e",
          "body": "…handoff)\n\nThe prod bug: `capture -> resume` produced an empty payload — a one-line\njourney (\"Checkpoint captured: CLI capture (redacted metadata)\"), no gaps,\nno knowledge, no working set, and a \"_preview (Resume Contract pending)_\"\nheader — because the real capture/render functions were never shipp\n[…]\ntake schema, and the stale-@skillerr/add-version pin note.\n\nAI-assisted (Claude Code).\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
          "is_bot": false,
          "headline": "feat(core): real session capture + Resume Contract 1.0 (fixes hollow …",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-21T01:40:00Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "33f46dcbfb1ab6c02d5d3e3b5744ad7a0fec4638",
          "body": "The docs site moved to its own subdomain (docs.skillerr.com) in an earlier\nchange, but this repo's own references to the canonical docs URL were never\nupdated to match — README, FAQ, TRANSPARENCY, WHAT-IS-VERIFIABLE, ROADMAP,\nand the synced npm README all still pointed at www.skillerr.com/docs/.\npackages/skillerr/README.md regenerated via scripts/sync-npm-readme.mjs.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
          "is_bot": false,
          "headline": "docs: update stale skillerr.com/docs URLs to docs.skillerr.com",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-21T01:25:15Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "24e26037bf80adbf3583aec341f1418016c68fff",
          "body": "feat(core): verify() unified entry point + generateSBOM (CycloneDX)",
          "is_bot": false,
          "headline": "Merge pull request #56 from dot-skill/feature/verify-and-sbom",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-20T19:53:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "125a02976b99bdb909e184af502aa70960578c27",
          "body": "verify(digest, evidence): the keystone a CLI verify command and the\nregistry's /api/verify are meant to sit on top of. Composes\nverifySignature + verifyInclusion directly (both self-contained, checked\nhere for real) with caller-supplied pre-checked anchored/revocation\nresults — a Commitment's real v\n[…]\ng\neverything merged to develop so far, not yet published).\n\nAI-assisted (Claude Code).\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
          "is_bot": false,
          "headline": "feat(core): verify() unified entry point + generateSBOM (CycloneDX)",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-20T19:51:21Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "a5e98e7163877d6d4493cbc9caecf49db0a7a6c5",
          "body": "feat(core): continuity surface (isContinuity/openContinuity/resumePreview)",
          "is_bot": false,
          "headline": "Merge pull request #55 from dot-skill/feature/continuity-surface",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-20T19:43:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a39a4f4463d94b6b10fc39f0ae90ec14d25dc923",
          "body": "…view)\n\nResume Contract 1.0 (RFC 0009): built directly on real continuity-profile\ndata (manifest.compile_profile, provenance.journey — an already-typed\nJourneyProvenance, not unknown — and knowledge), not on any invented file\nconvention. isContinuity is sufficient on its own since mint requires\ncomp\n[…]\ntry-coupling.mjs -> check-core-registry-independence.mjs).\n\nAI-assisted (Claude Code).\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
          "is_bot": false,
          "headline": "feat(core): continuity surface (isContinuity/openContinuity/resumePre…",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-20T19:39:31Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "39815546c686b042b8c01526086a1264e4b5e4ae",
          "body": "feat(core): trust-spine adapter layer + Merkle-log spine, relicense to Apache-2.0",
          "is_bot": false,
          "headline": "Merge pull request #54 from dot-skill/protocol/trust-spine",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-20T19:28:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5e148be660e78268346594012fe0cc402fd691c9",
          "body": "Signed-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>\n\n# Conflicts:\n#\tpackages/core/package.json",
          "is_bot": false,
          "headline": "Merge remote-tracking branch 'origin/develop' into protocol/trust-spine",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-20T19:25:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f74e6a43f2fe0869ed5e40f7b65a9bf066d88a3d",
          "body": "feat(core): deterministic secret scrubber (Phase 1)",
          "is_bot": false,
          "headline": "Merge pull request #53 from dot-skill/feature/deterministic-scrub",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-20T19:23:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2501eeebba87052bf4d2be2f23c79ca3b37c4c5b",
          "body": "…ency)\n\nThe one primitive in spec/CONTRACT.md's frozen contract with nothing to\nadapt from — no Merkle-tree/transparency-log concept existed anywhere in\nthis codebase before this (packages/registry is an unrelated flat\nappend-only log). A from-scratch RFC 6962-style implementation (Certificate\nTrans\n[…]\nests, 0 failures), core-registry-independence check clean.\n\nAI-assisted (Claude Code).\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
          "is_bot": false,
          "headline": "feat(core): Merkle-log spine (buildLeaf/verifyInclusion/verifyConsist…",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-20T19:14:11Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d87cf4f46ac05b10fb4830ff25b5976d2058273e",
          "body": "Sole-author decision (no third-party contributor consent needed to\nrelicense past contributions), resolving the disagreement spec/CONTRACT.md\nflagged between this repo's actual MIT license and the frozen contract's\nApache-2.0 requirement. Root LICENSE, every package's LICENSE and\npackage.json, and e\n[…]\nose version numbers, as with any relicense —\nthis governs the code going forward only.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
          "is_bot": false,
          "headline": "license: relicense to Apache-2.0",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-20T19:09:19Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6808d9ceb5d1ac3a9724605a6d2ed4ff047c2a15",
          "body": "Status table in spec/CONTRACT.md now reflects seal/openSealed/sign/\nverifySignature/Anchor+RekorAnchor/CapabilitySchema/evaluateReleaseProfile\nas shipped (with their known, honestly-documented gaps), and\nINTEGRATION_NOTES.md has the handshake entry for skillerr-registry to read\nonce this branch releases.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
          "is_bot": false,
          "headline": "docs(spec): mark adapter layer shipped, update integration handshake",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-20T18:43:41Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "804665cda5f97603b4dd3912bec606af9139920e",
          "body": "Thin, real wrappers matching spec/CONTRACT.md's Section 3a shape, each\ndelegating to an existing, already-tested primitive:\n\n- seal()/openSealed(): async/Buffer wrappers over packSkill/unpackSkill,\n  round-tripping through unpackSkill so the returned manifest can never\n  drift from what's actually e\n[…]\nests, 0 failures),\ncore-registry-independence check clean.\n\nAI-assisted (Claude Code).\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
          "is_bot": false,
          "headline": "feat(core): adapter layer for the frozen registry contract",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-20T18:42:22Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "75417122cf33309fe6f9474967a11fc865697138",
          "body": "New scripts/check-core-registry-independence.mjs, run in CI: fails if\npackages/core ever gains a dependency on skillerr-registry, imports it, or\ncalls its API directly. Deliberately narrow — the existing\nANCHOR_PREDICATE_TYPE (a legitimate in-toto predicate-type namespace URI\nusing the skillerr.com domain as an identifier, not a live endpoint) is\nnot flagged.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
          "is_bot": false,
          "headline": "ci: enforce @skillerr/core never depends on the registry",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-20T18:33:23Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "9b3ba8f518109b241af39fbd7bc7eeb545e71265",
          "body": "spec/CONTRACT.md is the source of truth for the @skillerr/core public API\nand registry wire protocol both sides build against, plus a status table\ntracking what already exists in this repo versus what's still needed.\nINTEGRATION_NOTES.md is the only handshake to skillerr-registry: version\nbumps get noted there, this repo never reaches into the registry directly.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
          "is_bot": false,
          "headline": "docs(spec): freeze core<->registry contract, add integration handshake",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-20T18:33:16Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "3c96fafc3698999c60e1d012910656f56b7d5b6c",
          "body": "…port, sealed provenance/redaction.json\n\nFour confidence-ordered layers (opt-in env-value exact match, known-format\nvendor rules, project custom rules, entropy-based flagging) with a pinned\nrules_version/rules_digest so identical input always reproduces an\nidentical report, no LLM or network anywher\n[…]\nd in docs/ROADMAP.md as architected-for but not\nyet built.\n\nAI-assisted (Claude Code).\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
          "is_bot": false,
          "headline": "Add deterministic secret scrubber (Phase 1): skill scrub, RedactionRe…",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-20T14:13:08Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "a578ea6c72ddd593cc82ffde71a5720c0bdf2ff1",
          "body": null,
          "is_bot": false,
          "headline": "Sync develop with main after 1.5.2 release",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-18T14:43:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7052171538c536b45f831723fdbf2f3c7b391ddd",
          "body": "* Add git-flow branching model: develop + release/* + hotfix/* only into main (#51)\n\nmain now only accepts merges from release/* or hotfix/* branches, enforced\nby a new required CI check (enforce-branch-flow.yml) plus branch\nprotection requiring it. Feature/task work branches off develop and PRs\nbac\n[…]\npic.com>\n\n* Release 1.5.2: lockstep version bump for the branch-flow change\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Sonnet 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Release 1.5.2: git-flow branching model (#52)",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-18T14:41:36Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1d8353c7883be1a71aec4b51e6c1befa3111340e",
          "body": "…o main (#51)\n\nmain now only accepts merges from release/* or hotfix/* branches, enforced\nby a new required CI check (enforce-branch-flow.yml) plus branch\nprotection requiring it. Feature/task work branches off develop and PRs\nback into develop instead. CI now also runs on push to develop for fast\nintegration feedback. Documented in CONTRIBUTING.md's new \"Branch flow\"\nsection.\n\nCo-authored-by: Claude Sonnet 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Add git-flow branching model: develop + release/* + hotfix/* only int…",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-18T14:28:29Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "d9cebc1d8bfca4017c95a8641b23317ba87f4d67",
          "body": "Several docs (PROTOCOL.md's opening status line, FAQ.md, README.md,\nGOVERNANCE.md, CONTRIBUTING.md) stated the protocol spec version\n(\"1.0.0 (Stable)\", correct and intentionally static) with no package/CLI\nversion anywhere nearby, reading as if the whole project were frozen at\n1.0.0. Every one now s\n[…]\nackage version in the same file, so\nthis can't silently recur. Patch bump per real semver discipline: this is\na doc fix, not new functionality.\n\nCo-authored-by: Claude Sonnet 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Fix stale-reading protocol-version-only mentions (1.5.1) (#50)",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-18T13:58:49Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1738c260f39e77acf079104c519fc3ca4a23f9fd",
          "body": "… (1.5.0) (#49)\n\n* External-agent bug sweep: transparency, mint validation, trust labels (1.5.0)\n\nFixes several real bugs surfaced by testing the CLI with an external AI\nagent: Rekor anchors were submitted as a hash-only entry kind so the\nsubject-bearing statement was never actually retrievable from\n[…]\nract,\nwired into contract-check's output as a separate schema_issues array.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Sonnet 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "External-agent bug sweep: transparency, mint validation, trust labels…",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-18T11:25:19Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "623d7dbd8ac3009037f439741480ce1f1bba910c",
          "body": "…anup, drift check (#48)\n\nFixes a real bug: skill agent-guide's header printed the bare protocol\nspec version (\"v1.0.0\") unqualified, easy to misread as the CLI's own\nversion even though skillerr itself is well past that. Now labeled\nclearly (spec vX.Y.Z, skillerr CLI vA.B.C), and its content update\n[…]\ndocs/ROADMAP.md\nstill said \"seven RFCs... RFC 0007... have since shipped\", missing that\nthere are now eight RFCs and RFC 0008 has also shipped.\n\nCo-authored-by: Claude Sonnet 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Consistency sweep: agent-guide version clarity, CLI-FLOW.md, wiki cle…",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-18T05:11:24Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "119e7e4b8f2fc8e74f5d5b38b9e0dde24352b747",
          "body": "…provenance URL (#47)\n\n* Frictionless flow (code): ingest->release bridge + zero-setup public provenance URL\n\nPHASE 1 (ingest -> release bridge):\n- New materializeSkillIntoWorkspace() in @skillerr/workspace: `skill load\n  <file.skill> --into <dir>` (or plain `skill load` inside a workspace)\n  now wr\n[…]\nctive on macOS/Linux); only the test assertion is now\nplatform-conditional.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Frictionless flow (1.3.0): ingest→release bridge + zero-setup public …",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-17T18:26:03Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "ba4682eff1895c4954ac75ebb7c4c3a2a8dff69a",
          "body": "…ust positioning (#46)\n\nLockstep version bump for both feature sets already merged to main this\ncycle: RFC 0008 (Agent Skills frontmatter fidelity, multi-skill discovery,\nexport-skill, verify-skill) and the cryptographic-trust-standard\npositioning (README/npm/docs). See CHANGELOG.md for the full summary.\n\nCo-authored-by: Claude Sonnet 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Release 1.2.0: Agent Skills ecosystem compatibility, cryptographic tr…",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-16T18:36:38Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "d098e7b2b74e58c42ed46213d3014321f2280b13",
          "body": "Merging to main and shipping to npm have drifted out of sync repeatedly\nthis cycle, since publishing required a separate manual git tag push\nafter merge and that step is easy to forget. publish_one already skips\nany package whose current version is already on npm, so this is safe on\nevery merge, not\n[…]\nop (everything's already\npublished, the release already exists), just an extra CI run, so this\nwas a deliberate scope choice, not an oversight.\n\nCo-authored-by: Claude Sonnet 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Publish workflow: also trigger on every push to main (#45)",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-16T17:31:45Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "782732c489fdb1de2dbb8b649c7b398d7e041b77",
          "body": "Elevates identity/authorship/provenance (content-addressed digests,\nEd25519 + Sigstore Fulcio, Rekor transparency log, verified vs\nself_reported claims) as the headline story on README and npm, with a\ncanonical trust ladder (Development -> Verified issuer -> Publicly\nanchored) now documented in-repo\n[…]\nerately no blockchain/nft/web3 keywords). Test count badge corrected\nto the real current 189. Docs/copy only, no runtime/protocol/wire changes.\n\nCo-authored-by: Claude Sonnet 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Position .skill as the cryptographic trust standard for AI skills (#44)",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-16T17:15:18Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f73d0c72534992331c3d2c47d902d5e4f60555ff",
          "body": "…rt-skill, verify-skill (#43)\n\nskill ingest now maps the complete Agent Skills frontmatter (license,\ncompatibility, nested/dotted metadata, allowed-tools) instead of parsing\nthen dropping most of it, and recognizes multi-skill folders via the same\nplugin-manifest and skills/<name>/ catalog conventio\n[…]\ne's configured title.\n\nAll additive, no wire-id/seal/container change. See RFC 0008 and\ndocs/AGENT-SKILLS.md for the full compatibility matrix.\n\nCo-authored-by: Claude Sonnet 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Agent Skills ecosystem compatibility: full frontmatter fidelity, expo…",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-15T19:23:17Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e567ea49ed9331f98ebb4cf78fa811ea4f5c6568",
          "body": "…#42)\n\nDocs/messaging only, no runtime behavior changes.\n\nThe Agent Skills world has three layers: authoring (the spec/SKILL.md),\ndistribution (npx skills add, skills.sh), and trust/integrity, which\nskillerr owns and nothing else in the ecosystem provides today. Makes\nthat positioning explicit and c\n[…]\nest does NOT map yet (license, compatibility, allowed-tools:\nparsed then dropped; metadata: not parseable at all, the frontmatter\nreader is flat-key-only) -- a real, tracked gap, not silently ignored.",
          "is_bot": false,
          "headline": "Position skillerr as the trust layer for the Agent Skills ecosystem (…",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-15T17:40:23Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0f6186e0d46b5ba80e7d2636e34c929ce2a9077b",
          "body": "…#41)\n\nDocs/governance/repo-meta only, no runtime behavior changes.\n\n- RFC 0007 (docs/rfcs/0007-subject-bearing-transparency-anchor.md):\n  the design doc for the subject-bearing transparency anchors shipped\n  in #40, marked Implemented since it describes the real merged code.\n\n- One canonical, in-re\n[…]\nlates already existed). README gets a short Contributing callout.\n  ROADMAP.md now notes packages/skillerr/package.json as the version\n  single source of truth and marks @skillerr/skill-score Preview.",
          "is_bot": false,
          "headline": "RFC 0007 and contribution-readiness (governance, RFC home, backlog) (…",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-15T17:24:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d773c827806775ac345ece159c502a7c8e7fba2c",
          "body": "skill mint --transparency/--keyless now sign a minimal in-toto\nStatement naming the skill (skill_id + package_digest), instead of a\nbare digest. The resulting public Rekor entry is self-describing and\ncross-linkable: a stranger can see which skill an entry belongs to\nwithout already holding the pack\n[…]\nied against the real public Rekor log end to end, not just unit\n  tests: https://search.sigstore.dev/?logIndex=2173022811\n\nVersion 1.1.0 (minor: additive new capability) across all packages,\nlockstep.",
          "is_bot": false,
          "headline": "Subject-bearing transparency anchors (RFC 0007) (#40)",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-15T17:02:53Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "80b4a8601256c60eee366f42b84a379151a4a4c0",
          "body": "… (#39)\n\nNew one-line description across package.json (root, skillerr) and\nREADME's opening: \"Create, inspect, and run portable .skill packages\nfor AI agents — typed, sealed, and verifiable before anyone runs\nthem.\" Replaces vaguer framing that undersold the actual integrity/\ntrust-ladder story.\n\nAl\n[…]\ning \"container\" nicknames in prose (not the\nformal Container spec heading, which stays) -> \"package\"/\"format\",\nmatching the project's naming conventions (.skill is a format; an\ninstance is a package).",
          "is_bot": false,
          "headline": "Rewrite public messaging: lead with capability, fix terminology drift…",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-15T12:39:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0172063e5dff695e10ecabe357296f9f580a3962",
          "body": "The three skill mint/skill keygen --help strings that referenced\ndocs/KEY-CEREMONY.md now point at the wiki, matching the move in\nthe previous release.\n\nVersion 1.0.3 across all packages, lockstep.",
          "is_bot": false,
          "headline": "Release 1.0.3: point shipped CLI help text at the wiki (#38)",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-15T02:06:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8e3caaf1fb89819702d41b0b67fa5d2cae1de1df",
          "body": "Deep-reference/governance material (read occasionally, by depth) moves\nto github.com/dot-skill/skillerr/wiki so docs/ stays focused on\ntask-oriented guides read on every task. Rewrote every cross-reference\nacross ~20 files: links between the four moved pages/RFCs are now\nwiki-relative, links to docs\n[…]\n Threat Model's key-ceremony pointer said \"forthcoming\" and\n\"Phase 10\" for a doc and phase that had already shipped, and README.md\nhad two more docs/rfcs/ links the earlier version-bump passes missed.",
          "is_bot": false,
          "headline": "Move Key Ceremony, Naming, Threat Model, and RFCs to the wiki (#37)",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-15T01:55:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "af4b2e7b7c5465230ba7753f032977835f5d3b6c",
          "body": "…Hub Releases (#36)\n\nskill agent-guide, skill --help, 5 schema $ids, a validate.ts error message,\nand skill keygen's trust-store setup snippet still said \"0.5\" after the\nprotocol version moved to 1.0.0. Found by testing the published CLI\nend-to-end rather than only grepping docs. The keygen snippet \n[…]\nkill verify-trust rejects.\n\nAlso adds a GitHub Release creation step to publish.yml so the repo's\nReleases page reflects what's actually published to npm.\n\nVersion 1.0.2 across all packages, lockstep.",
          "is_bot": false,
          "headline": "Fix leftover 0.5 strings from the protocol version bump; automate Git…",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-15T01:01:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7fba2712444f44b0300cc0dea0c9d97162479caf",
          "body": "Protocol specification is now versioned 1.0.0 and marked Stable. The\nprevious maturity gate (Stable requires independent conforming\nruntimes beyond this reference implementation) is removed: a single,\nthoroughly-tested reference implementation (165 tests, an adversarial\nsecurity corpus, multi-OS/Nod\n[…]\nen Stable after two independent runtimes\" reference, including\nPROTOCOL.md's protocol/CLI compatibility table, AUTHORING-CONTRACT.md,\nWORKSPACE.md, and skillerr-com's roadmap/protocol/faq/index pages.",
          "is_bot": false,
          "headline": "release: protocol 1.0.0 (Stable), packages 1.0.1 (#35)",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T21:04:37Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "461090e8eb755956a0afcf71d4ae1aa95970afa1",
          "body": "First stable release of the reference implementation. The public API\nacross all seven @skillerr/* packages (and the skillerr CLI) is now\nconsidered stable: breaking changes to exported functions, types, CLI\nflags, or the .skill container format land as a new major version.\n\nThis covers the reference\n[…]\nn every push. See docs/ROADMAP.md.\n\nAlso fixed a stale test-count badge in README.md (148 -> 165) missed\nin earlier version bumps this session.\n\nSee CHANGELOG.md for what's shipped as of this release.",
          "is_bot": false,
          "headline": "release: 1.0.0 -- stable public API (#34)",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T20:33:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "477e9948f234a51b94f6dbc0deadc8763c8cb851",
          "body": "…G.md examples (#33)\n\nMINT.md's own \"Anchors\" section, the canonical doc for what mint\nactually does, only mentioned the local registry (skill registry) --\nno mention of --transparency or --keyless at all, despite both being\nreal mint-time flags. A reader following only this doc would have no\nidea e\n[…]\nclaimed CI runs on\n\"Node 20 and 22\" when the actual matrix is 22/24 (matching README.md).\nReplaced the hardcoded version with vX.Y.Z placeholder syntax so this\ndoesn't go stale again on every release.",
          "is_bot": false,
          "headline": "docs: content-polish pass -- MINT.md anchors section, stale PUBLISHIN…",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T20:11:41Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2152fd25941e497f2f1b95cbf8eee3a04436c428",
          "body": "Found doing end-to-end verification of 0.9.9's license field against\na fresh npm install: license/license_url reached manifest/skill\ninspect's plain summary correctly, but never made it into TrustView --\nmeaning skill inspect --trust, skill verify-trust, assessClaims's\nself-reported list, and by ext\n[…]\nnspectTrustView, and added both to assessClaims's self-reported list\n-- never verified, same reasoning as every other self-reported field.\n\nLockstep version bump 0.9.9 -> 0.9.10 across all 7 packages.",
          "is_bot": false,
          "headline": "fix: license field never reached TrustView/assessClaims (0.9.10) (#32)",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T19:19:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6399a7e5c9645e05056e6106cd98331b3bac29ee",
          "body": "manifest.license already existed in the type and JSON schema but was\ncompletely dormant -- never settable from SkillSource, never surfaced\nby any command, undocumented anywhere. Wired it up end to end:\nSkillSource.license/.license_url -> compileSkillSource/\ncompileRecipeToSkill (with a CompileOption\n[…]\ncommerce/payment/marketplace code lands in this repo -- the\nprotocol stays payment-agnostic, per docs/TRANSPARENCY.md's \"What this\nis not\".\n\nLockstep version bump 0.9.8 -> 0.9.9 across all 7 packages.",
          "is_bot": false,
          "headline": "feat: license/terms manifest slot, Phase F scoped down (0.9.9) (#31)",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T18:58:03Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d725348ea293dbcd0b02319abb2af0068da3b772",
          "body": "docs/WHAT-IS-VERIFIABLE.md has always drawn a line in prose between\nwhat's cryptographically checked and what's merely self-reported --\nbut nothing stopped a UI or agent parsing TrustView's JSON from\ndisplaying a self-reported field (like agent.host) next to a\n\"verified\" badge, since both kinds of c\n[…]\nms (offline; anchors not re-verified) and\nskill verify-trust --claims (includes anchor verification results\nwhen present) both expose this.\n\nLockstep version bump 0.9.7 -> 0.9.8 across all 7 packages.",
          "is_bot": false,
          "headline": "feat: per-claim assurance model, assessClaims (0.9.8) (#30)",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T18:37:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f13174466efa8af5b47f4734a29842d37b755458",
          "body": "The design already reads whatever ambient OIDC token the actual\ninvoking environment provides (CIContextProvider), with no special\nrelationship to dot-skill/skillerr's own CI — GitHub injects a fresh,\nrepo/workflow/ref-scoped token into any job with id-token: write,\nregardless of which repo that job\n[…]\nntity gets logged?\" section spelling this out, and\nreworded the \"what's shipped\" line so \"the same mechanism npm\ntrusted publishing uses\" can't be misread as \"this repo's own\ncredential specifically.\"",
          "is_bot": false,
          "headline": "docs: clarify whose identity --keyless actually binds (#29)",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T18:18:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a7432095b9cf481e11c279c8b44dc0006e010ee5",
          "body": "skill mint --keyless adds a second, independent anchor\n(PermanenceAnchor { kind: \"keyless_identity\" }) alongside whatever the\ncontainer's own seal already is: an ephemeral, single-use keypair\nsigned by a Fulcio-issued certificate bound to the caller's OIDC\nidentity, then logged to Rekor exactly like\n[…]\ns own seal;\nwhat shipped is a separate additive anchor instead, to avoid\nconflating a pre-pinned-key trust mechanism with an ephemeral one.\n\nLockstep version bump 0.9.6 -> 0.9.7 across all 7 packages.",
          "is_bot": false,
          "headline": "feat: Fulcio keyless mint, CI-ambient path (0.9.7) (#28)",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T18:00:29Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a6cae4a85f72cb095e2722c0c6a2492a626202c5",
          "body": "Neither the CLI nor the website's verify page should be able to say\n\"this is verified\" without also handing back a way to check that\nindependently. New rekorSearchUrl() in @skillerr/core builds a\nsearch.sigstore.dev link for a verified transparency_log anchor —\nundefined (not a guessed/broken link) \n[…]\nless/Fulcio\n  as already shipped when it isn't (ROADMAP.md and\n  WHAT-IS-VERIFIABLE.md already had this right; this doc alone was\n  stale).\n\nLockstep version bump 0.9.5 -> 0.9.6 across all 7 packages.",
          "is_bot": false,
          "headline": "feat: independent Rekor verification link (0.9.6) (#27)",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T17:22:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a1cc58bd8c3397b5abdf4a953a078298fec4eb16",
          "body": "…s (0.9.5) (#26)\n\nloadSchema() read JSON Schema files via new URL(relativePath,\nimport.meta.url) where relativePath came from a lookup object — a\nvariable, not a literal, at the call site. Bundlers that statically\ntrace file dependencies to decide what ships with a deployment (e.g.\nVercel's @vercel/\n[…]\n literal new URL(...) call; the\nschema JSON files themselves haven't moved.\n\nVersion bump: all 7 packages 0.9.4 -> 0.9.5 (lockstep), matching\nREADME/ROADMAP/THREAT-MODEL version strings and CHANGELOG.",
          "is_bot": false,
          "headline": "fix: make @skillerr/protocol schema paths traceable by static bundler…",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T17:08:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "295d96e329e557e42e53d914da91f5e29bccb31f",
          "body": "feat: wire www.skillerr.com everywhere (0.9.4)",
          "is_bot": false,
          "headline": "Merge pull request #25 from dot-skill/feat/skillerr-com-domain",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T15:44:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f882227a7436da68465fc540fcb10784b803db8c",
          "body": "www.skillerr.com is live on Vercel (docs under /docs/, root reserved\nfor a future product). Updates every dot-skill.github.io/skillerr-com\nreference across README.md, docs/*.md, examples/README.md,\npackages/skillerr/README.md, and every package.json's homepage field.\n\nReal user-facing bug fixed: skill --help's own footer was printing\nthe stale GitHub Pages docs URL to every CLI user.",
          "is_bot": false,
          "headline": "feat: wire www.skillerr.com everywhere (0.9.4)",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T15:37:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cd7b48b4f16d64c01c358ed1647f229eb84d00dd",
          "body": "docs: fix stale transparency-log status + reframe remaining draft language",
          "is_bot": false,
          "headline": "Merge pull request #24 from dot-skill/docs/fix-stale-transparency-status",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T14:58:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "02f38bf16feef05bcdfb8349689627feb44eb4bb",
          "body": "…guage\n\nWHAT-IS-VERIFIABLE.md still said public transparency logging was\n\"planned but not yet implemented\" and cited reference packages 0.8.0\n— both wrong since Phase E shipped Rekor anchoring last session. Adds\nthe real \"what's cryptographic and publicly checkable, if anchored\"\nsection, updates the\n[…]\nd\nthe same limitation-first \"draft\"/\"development\" framing already fixed\nin README.md — reframed both the same way (capability-first, RFC\nprocess named explicitly), consistent with 0.9.3's README pass.",
          "is_bot": false,
          "headline": "docs: fix stale transparency-log status + reframe remaining draft lan…",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T14:53:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "903e20b14851eb95d800362f2e65271750b2ced5",
          "body": "docs: README content pass — reframe draft/dev-only signals (0.9.3)",
          "is_bot": false,
          "headline": "Merge pull request #23 from dot-skill/docs/readme-content-pass",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T14:47:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9aa6e5a8eca8f17a3c3242946affb0bbb1714c80",
          "body": "The orange \"0.5.0 draft\" badge and a limitation-first sentence about\nthe default signing key read as \"unfinished project\" even though the\nunderlying facts are accurate and necessary disclosures. Reframed\nrather than removed or hidden — see CHANGELOG.md for the full\nreasoning, including why \"continuity draft\" mentions were left\nuntouched (real protocol vocabulary, not maturity signaling).",
          "is_bot": false,
          "headline": "docs: README content pass — reframe draft/dev-only signals (0.9.3)",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T14:44:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9941b97f04ab308605ccc0e84ea35fcc56456628",
          "body": "docs: remove banner image from README (0.9.2)",
          "is_bot": false,
          "headline": "Merge pull request #22 from dot-skill/docs/remove-readme-banner",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T14:11:34Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "275a6386800926d57204f4f70d6938234ca58e9e",
          "body": "Single mark image is the intended header, not a banner plus a mark.\nRoot README.md changed; packages/skillerr/README.md picks it up\nautomatically via scripts/sync-npm-readme.mjs.",
          "is_bot": false,
          "headline": "docs: remove banner image from README (0.9.2)",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T14:08:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "eb0fb2150a3e8f3b20ade2f00304aa6f890095b9",
          "body": "fix(docs): structural fix for npm/GitHub README drift (0.9.1)",
          "is_bot": false,
          "headline": "Merge pull request #21 from dot-skill/fix/npm-readme-sync",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T13:38:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8e5f3ba50be190731ce690a8d15d8f4e8a156462",
          "body": "…ep (0.9.1)\n\nThe npm README (packages/skillerr/README.md) and the GitHub README\n(README.md) were two independently hand-edited files with nothing\nforcing them to stay in sync. Every prior fix (0.7.1, 0.8.0) patched\none snapshot; the files drifted apart again the next time either was\nedited alone — w\n[…]\neting format\").\n\n144/148 -> 148/148 tests still passing (no test-suite behavior\nchanged, docs + build tooling only). npm run build && npm test &&\nnpm run test:examples && npm run pack:check all green.",
          "is_bot": false,
          "headline": "fix(docs): structural fix for npm/GitHub README drift + narration swe…",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T13:35:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "38478635b9524af491c95b297c75d0a408cc1842",
          "body": "feat(core,cli): Phase E (partial) — Rekor transparency-log anchoring (0.9.0)",
          "is_bot": false,
          "headline": "Merge pull request #20 from dot-skill/phase-e/transparency-rekor",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T13:16:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c0beebec74b5036993c7b098fd9c923e93e546e9",
          "body": "…(0.9.0)\n\nOptional public transparency-log anchoring, built on the official\n@sigstore/* client libraries rather than a hand-rolled Merkle-proof\nimplementation. See docs/TRANSPARENCY.md for what this proves and\ndoesn't.\n\n- skill mint --transparency [--rekor-url <url>]: after signing\n  (requires --sig\n[…]\nI + website utility, Phase E2's per-claim\nassurance model. See ROADMAP.md.\n\n148/148 tests passing (was 141, +7 new). npm run build && npm test &&\nnpm run test:examples && npm run pack:check all green.",
          "is_bot": false,
          "headline": "feat(core,cli): Phase E (partial) — Rekor transparency-log anchoring …",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T13:13:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "77afc381f3b411158b17d6e8f8021e76b2ae427f",
          "body": "docs(cli): Phase D — trust/threat/verifiability docs (0.8.1)",
          "is_bot": false,
          "headline": "Merge pull request #19 from dot-skill/phase-d/trust-threat-docs",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T11:21:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8e45a1bcc5a997a99173a06ef84db21b8f93078a",
          "body": "- docs/TRUST-MODEL.md: plain-language explanation of the four\n  trust_state values, explicit that development/self_reported are not\n  safe to run blindly, why SKILL_HOST alone is self_reported, why the\n  bundled key is dev-only, and exactly when execute refuses.\n- docs/WHAT-IS-VERIFIABLE.md: attribu\n[…]\n, everything else\n  along for versioning consistency).\n\n141/141 tests still passing (docs + one additive JSON field, no\nbehavior changes). npm run build && npm test && npm run test:examples\nall green.",
          "is_bot": false,
          "headline": "docs(cli): Phase D — trust/threat/verifiability docs (0.8.1)",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T11:19:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8d39b919ab7ed654c0f2e7296e00950128fce2a1",
          "body": "docs: Phase C — resolve the tri-naming (docs/NAMING.md)",
          "is_bot": false,
          "headline": "Merge pull request #18 from dot-skill/phase-c/naming",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T11:04:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6d5705dfff7ffb8b40aeff70c16b7b502008ae5c",
          "body": "Five strings mean five different things across this codebase (Open\n.skill Protocol, .skill, dot-skill, @skillerr/*, skillerr) and nothing\npreviously said so in one place. Adds docs/NAMING.md as the single\nreference, linked from README. Explicitly does not change any wire\nidentifier, media type, extension, or package name — pure\ndocumentation, consistent with what the protocol-first framing work\nearlier this cycle already established in practice.",
          "is_bot": false,
          "headline": "docs: Phase C — resolve the tri-naming (docs/NAMING.md)",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T11:02:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5c2f6daeb1a5ed5ed3d8718401c6def95480d3bd",
          "body": "fix(core,cli): Phase B — first-run polish + lockstep versions (0.8.0)",
          "is_bot": false,
          "headline": "Merge pull request #17 from dot-skill/phase-b/first-run-polish",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T10:58:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "112edd03c0fcadc74fa1f111d05db09230639a03",
          "body": "- Register ajv-formats so validate/inspect --trust/score stop printing\n  \"unknown format \\\"date-time\\\" ignored\" noise (ajv-formats' CJS default\n  export needed the documented .default cast workaround for NodeNext\n  without esModuleInterop — see the comment in validate.ts).\n- skill score --emit witho\n[…]\nned to 0.8.0,\n  every internal @skillerr/* dependency range updated to match.\n\n138 -> 141 tests (3 new regressions). npm run build && npm test &&\nnpm run test:examples && npm run pack:check all green.",
          "is_bot": false,
          "headline": "fix(core,cli): Phase B — first-run polish + lockstep versions (0.8.0)",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T10:55:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "465a7933982ad7ce4d2d6dc1824550be2b37c8ac",
          "body": "fix(cli): Phase A — launch blockers (ingest digest, score fallback)",
          "is_bot": false,
          "headline": "Merge pull request #16 from dot-skill/phase-a/launch-blockers",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T10:40:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2995902e2324315da489d20c16c4e07afb8158b0",
          "body": "1. skill ingest printed a stale package_digest: compileSkillSource\n   finalizes the manifest before resources/assets get merged into\n   compiled.files, and packSkill's internal re-finalization (which\n   produces the real, correct digest) was discarded — only the bytes\n   were kept. Re-finalize the m\n[…]\nxpected behavior (see\n   docs/evaluate-and-score.md's \"gracefully degrades\" claim, which this\n   ok:false contradicted in practice). Now ok:true, scored:false, with\n   a notice field instead of error.",
          "is_bot": false,
          "headline": "fix(cli): Phase A — truthful ingest digest, graceful score fallback",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T10:38:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8b616a3d1b5f008421192bef71abd0fc6b5e2827",
          "body": "release: 0.7.1 — republish with fixed READMEs",
          "is_bot": false,
          "headline": "Merge pull request #15 from dot-skill/release/0.7.1",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T09:45:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ca79b3c277f0a8349469873f3bb6b7adfb336a53",
          "body": "npm freezes a package's README at publish time; the protocol-first\ntitle fix and stale-trust-claim fix from the previous commit landed\nin git after 0.7.0 was already on the registry, so npmjs.com was\nstill showing the old README. Patch bump for just the three packages\nwhose README actually changed (skillerr, core, runtime) — their\nexisting ^0.7.0 internal dependency ranges already resolve to 0.7.1\nvia caret, no other package needs a version bump.",
          "is_bot": false,
          "headline": "release: 0.7.1 — republish skillerr/core/runtime with the fixed READMEs",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-14T09:43:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "713e6011f51c130b40b011926d2118cd26ced7c2",
          "body": "…trust-accuracy\n\ndocs: protocol-first README titles + fix stale trust/version claims",
          "is_bot": false,
          "headline": "Merge pull request #14 from dot-skill/docs/readme-protocol-first-and-…",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-13T23:43:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cd97578e8a978f36cfe28f5c188d945da503be35",
          "body": "Titles led with \"Skillerr\" as a brand; it's the package/CLI name, not\nthe project identity — same protocol-first framing already applied to\nthe site. Drops the redundant centered brand tagline, converts\nbrand-noun prose (\"point your AI at Skillerr\") to package-name\nreferences in code font, and adds \n[…]\nccurate since the Ed25519 configured-signer work (KEY-CEREMONY.md);\na configured signer key mints as verified_issuer. And updates the\nroot README's \"Reference CLI @ 0.6.x\" to the just-published 0.7.0.",
          "is_bot": false,
          "headline": "docs: protocol-first README titles + fix stale trust/version claims",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-13T23:41:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5e9b521d22026571ff0f529fde085aec45e0c3cf",
          "body": "release: 0.7.0 — first real publish since 0.6.0",
          "is_bot": false,
          "headline": "Merge pull request #13 from dot-skill/release/0.7.0",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-13T23:21:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f2f4df168a3793fb119954be5c851ffc67337d0a",
          "body": "…nce 0.6.0\n\n@skillerr/protocol, core, runtime, registry, workspace, and cli were\npublished once at 0.6.0 and never again — every commit since (all of\nTier 0-4 security hardening and Phases 1-10: ingest, eval, mint w/\nreal Ed25519 signer, trust store, permission grammar, JSON Schemas,\nresources seman\n[…]\nper to\n0.7.0 and updates every internal ^0.6.0 dependency range to match\n(npm's caret range on 0.x versions doesn't span minor bumps, so this\nis required for install resolution, not just bookkeeping).",
          "is_bot": false,
          "headline": "release: 0.7.0 — publish the reference packages for the first time si…",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-13T23:19:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c269269c5407eb0a4ce9051b25cdc26b61e7ffd7",
          "body": "fix(cli): skill mint <file> works standalone, no workspace required",
          "is_bot": false,
          "headline": "Merge pull request #11 from dot-skill/fix/mint-standalone-file",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-13T22:51:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d2e2e9f32b881026dc211768aa75d161e7fcc94d",
          "body": "`skill mint` already accepted an explicit .skill file argument\n(`rest.find(a => a.endsWith(\".skill\"))`), but called `requireWorkspace()`\nunconditionally regardless — so pointing it at an arbitrary file (e.g.\n`skill pack <source.json>` output, never touched by `skill init`) failed\nwith \"Not a skill w\n[…]\nd25519 signer, no `skill init` anywhere in\nthe temp dir). Full suite: 136/136 passing.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
          "is_bot": false,
          "headline": "fix(cli): skill mint <file> works standalone, no workspace required",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-13T22:50:06Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "060dabda165de822c8a9ae7140e01e8a8309169c",
          "body": "docs: make copy-paste AI prompts directive, not hedged",
          "is_bot": false,
          "headline": "Merge pull request #10 from dot-skill/docs/directive-prompts",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-13T22:31:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2fcb64f3164d65fdf040ffb0802e22a9d65080cb",
          "body": "\"Install skillerr if needed (npm i -g skillerr)\" asks the agent reading\nit to infer both whether an install is needed and how to check — an\nagent unfamiliar with this specific package has no strong signal to act\non a parenthetical aside. Rewrote the two headline on-ramp prompts\n(create-from-chat, co\n[…]\nsion || npm i -g skillerr` for the same\ncheck-before-install pattern, for consistency.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
          "is_bot": false,
          "headline": "docs: make copy-paste AI prompts directive, not hedged",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-13T22:30:53Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "905ccb51b0fd36b24ab9f7f03cae1b62fbcd6d24",
          "body": "Phase 7: README overhaul + CLI banner + docs polish",
          "is_bot": false,
          "headline": "Merge pull request #9 from dot-skill/feature/phase-7-docs-polish",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-13T18:43:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c8ff527adbeabebc54d0c9aeed74f2a07d62068a",
          "body": "README hero now leads with the pitch, the convert-on-ramp, and a sealed-\npackage advantage table before install/prompts, per the ground rule's\nprescribed order:\n\n- One-liner: \"The integrity + evaluation layer for AI skills. Your\n  SKILL.md still works — .skill seals it, scores it, and makes it\n  por\n[…]\non or URL drift found across skillerr,\nskill-score, and skillerr-com during this pass.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
          "is_bot": false,
          "headline": "docs(readme,cli): Phase 7 — README overhaul + CLI banner + docs polish",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-13T18:42:01Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "49a9421f3d941d197189a9c5f8b0541621eb11e3",
          "body": "fix: repair CI — npm ci EUSAGE + brand job non-determinism",
          "is_bot": false,
          "headline": "Merge pull request #8 from dot-skill/fix/ci-npm-ci-and-brand-determinism",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-13T18:39:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a073c4becd27a9a0389387518797c0851bbdac00",
          "body": "…ase 3\n\nCI has been failing on every push/PR since the Phase 6 merge and I never\nactually checked GitHub Actions status after any of the merges this\nsession — only ran tests locally, which didn't reproduce either failure\nmode. Both root causes:\n\n1. packages/cli/package.json declared @skillerr/skill-\n[…]\nly: `npm ci` (exact CI command) now succeeds; full build +\ntest suite green (135/135).\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
          "is_bot": false,
          "headline": "fix(ci): repair main branch CI — broken since Phase 6, worse since Ph…",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-13T18:38:32Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "92e19541bed964bc83444257568749eea5442fd6",
          "body": "Phase 5: skillerr-authoring SKILL.md (the front door)",
          "is_bot": false,
          "headline": "Merge pull request #7 from dot-skill/feature/phase-5-authoring",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-13T18:24:34Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4dda65d3d6cff28462694f868bdc71163991f0b0",
          "body": "Distributes skillerr *as* a skill: examples/skillerr-authoring/SKILL.md\nwalks an agent through interview -> contract-init -> fill .skill/\ncontract.json -> contract-check -> propose -> (optional) skill eval ->\nhuman review -> compile --approve --mint, in skill-creator's\nexplain-the-why tone rather th\n[…]\nDME.md (\"Create a skill from this chat\" section) and\ndocs/AGENT.md (\"Create\" section).\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
          "is_bot": false,
          "headline": "docs: Phase 5 — skillerr-authoring SKILL.md (the front door)",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-13T18:23:52Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1e8af87eff7d35da0edb9d0b52495a3efaa337f3",
          "body": "Phase 4: bundled-script/progressive-disclosure semantics + exec deny-by-default fix",
          "is_bot": false,
          "headline": "Merge pull request #6 from dot-skill/feature/phase-4-resources",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-13T18:19:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ee8881362b9904478ed341b61f453dc8deab3f99",
          "body": "…mantics\n\nDocuments the most common skill-creator pattern (bundle a helper script,\nsplit large reference material) and, in the process of writing that\ndocumentation accurately, found and fixed a real security gap: exec-class\ncapabilities had no deny-by-default gate at all.\n\n- packages/runtime/src/in\n[…]\nll suite: 135/135 passing across all 6 workspaces; test:examples and\npack:check green.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
          "is_bot": false,
          "headline": "fix(runtime),docs: Phase 4 — bundled-script/progressive-disclosure se…",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-13T18:18:32Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "cfebd8acf53f708feac0361f1e85ef7a168300b2",
          "body": "Phase 3: wire @skillerr/skill-score in",
          "is_bot": false,
          "headline": "Merge pull request #5 from dot-skill/feature/phase-3-skill-score",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-13T18:08:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "822f52c7d9d300497e808d28db66e4f4a8cc3e7a",
          "body": "Turns eval output into a portable, sealed quality-score receipt. The\nscorer stays a separate, independently-versioned package (its formula,\nweights, and gate caps are untouched) — this only builds the bridge and\nreserves the container slot, per the architecture note in the original\naudit (\"skill-sco\n[…]\nskill/skill-score renames the package scope to\n@skillerr/skill-score (already merged).\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
          "is_bot": false,
          "headline": "feat(cli,core): Phase 3 — wire @skillerr/skill-score in",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-13T18:07:19Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "57972688efcb28bb16a05d9b1d5e8fd48b27d94a",
          "body": "Phase 2: native eval/benchmark loop",
          "is_bot": false,
          "headline": "Merge pull request #4 from dot-skill/feature/phase-2-eval-benchmark",
          "author_name": "bharatdudeja13-cmd",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-13T17:49:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "86f0b8e12d0e1147746ea3a66ea68b2c794a3786",
          "body": "A .skill can now be run and measured, not just structurally validated —\nthe native counterpart to skill-creator's test-prompt-and-grade loop.\n\n- protocol: SkillContract.evals? (optional, unlike every other contract\n  field — not required for either compile profile) with EvalCase\n  {id, prompt, asser\n[…]\nked bytes. Full suite:\n  126/126 passing across all 6 workspaces; test:examples green.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
          "is_bot": false,
          "headline": "feat(core,workspace,cli): Phase 2 — native eval/benchmark loop",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-13T17:45:21Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1f3ef0d704cf32c5385bd792fd1eae4c2731536e",
          "body": "…mark\n\nOne master SVG traced from the real logo, a reproducible build script, and\na completed icon-slot container convention — replacing ~7 duplicated PNG\ncopies with no master vector.\n\n- assets/source/dot-skill-official.png: the official reference mark\n  (supplied by the brand owner), kept permanen\n[…]\nple-touch-icon, and OG/Twitter image meta\n  tags wired into docs/.vitepress/config.ts.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
          "is_bot": false,
          "headline": "feat(brand): Phase 6 — single-source branding from the real official …",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-13T17:30:06Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "47e331a0b4495f2f7a4957d6f4a0554e0ece9891",
          "body": "The headline on-ramp: an existing skill-creator-style folder (SKILL.md +\noptional scripts/, references/, assets/, evals/evals.json) becomes a\nsealed, typed .skill in one command. Distinct from the existing lossy\nto-skill-md export (that's the reverse adapter; markdown is never the\nsource of truth). \n[…]\n\n  all get the copy-paste prompt, docs/ROADMAP.md moves the round-trip item\n  to done.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
          "is_bot": false,
          "headline": "feat(core,cli): Phase 1 — SKILL.md -> .skill ingest (skill ingest)",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-13T17:27:07Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6879744d80ad3ab8dae49843f8bc034482905105",
          "body": "Implements RFC 0001 (PROTO-2) for real, replacing the \"spec-only\" status\nfrom the Tier 4 RFC batch. The public-dev HMAC path is completely\nunchanged (still the zero-config local default, still hard-capped at\ntrust_state=development) — this adds an alternative, opt-in path so\nverified_issuer can mean\n[…]\n) + 1 adversarial.test.ts case. Full\n  suite: 110/110 passing across all 6 workspaces.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
          "is_bot": false,
          "headline": "feat(core,cli): Phase 10 — pluggable Ed25519 issuer signer + trust store",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-13T17:07:02Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7b5309e960b75051d0e43e5863b55dcfef08f54c",
          "body": "…ecklist\n\nCloses out the original task's required final deliverable: every\nsilent-fallback instance found during the BUG-3 sweep with its disposition\n(fixed vs. intentional-and-documented vs. open-RFC), plus a checklist\nmapping every SEC-*/PROTO-* item to the test file or spec section that\nproves it holds.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
          "is_bot": false,
          "headline": "docs: Tier 0-4 final summary — BUG-3 disposition table + SEC/PROTO ch…",
          "author_name": "Bharat Dudeja",
          "author_login": "bharatdudeja13-cmd",
          "committed_at": "2026-07-13T16:50:11Z",
          "body_truncated": false,
          "is_coding_agent": true
        }
      ],
      "releases_count": 22,
      "commits_last_year": 153,
      "latest_release_at": "2026-07-15T17:04:33Z",
      "latest_release_tag": "v1.1.0",
      "releases_from_tags": false,
      "days_since_last_push": 6,
      "active_weeks_last_year": 3,
      "days_since_latest_release": 12,
      "mean_days_between_releases": 0.1
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": true,
      "health_percentage": 87,
      "has_issue_template": false,
      "has_code_of_conduct": true,
      "has_pull_request_template": true
    },
    "ecosystem": {
      "packages": [
        {
          "name": "@skillerr/cli",
          "exists": true,
          "license": "Apache-2.0",
          "keywords": [
            "skill",
            "skillerr",
            ".skill",
            "ai-agents",
            "agent-skills",
            "cli",
            "protocol"
          ],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@skillerr/cli",
          "is_deprecated": false,
          "latest_version": "1.7.0",
          "repository_url": "https://github.com/dot-skill/skillerr",
          "versions_count": 26,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 4471,
          "first_published_at": "2026-07-13T01:21:29.050000Z",
          "latest_published_at": "2026-07-21T03:19:15.292000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 6
        },
        {
          "name": "@skillerr/core",
          "exists": true,
          "license": "Apache-2.0",
          "keywords": [
            "skill",
            ".skill",
            "ai-agents",
            "agent-skills",
            "compile",
            "mint"
          ],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@skillerr/core",
          "is_deprecated": false,
          "latest_version": "1.7.0",
          "repository_url": "https://github.com/dot-skill/skillerr",
          "versions_count": 27,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 5762,
          "first_published_at": "2026-07-13T01:21:11.528000Z",
          "latest_published_at": "2026-07-21T03:18:53.859000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 6
        },
        {
          "name": "@skillerr/runtime",
          "exists": true,
          "license": "Apache-2.0",
          "keywords": [
            "skill",
            ".skill",
            "ai-agents",
            "agent-skills",
            "runtime",
            "dry-run"
          ],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@skillerr/runtime",
          "is_deprecated": false,
          "latest_version": "1.7.0",
          "repository_url": "https://github.com/dot-skill/skillerr",
          "versions_count": 27,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 4895,
          "first_published_at": "2026-07-13T01:21:15.891000Z",
          "latest_published_at": "2026-07-21T03:18:59.066000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 6
        },
        {
          "name": "@skillerr/protocol",
          "exists": true,
          "license": "Apache-2.0",
          "keywords": [
            "skill",
            ".skill",
            "ai-agents",
            "agent-skills",
            "protocol",
            "types"
          ],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@skillerr/protocol",
          "is_deprecated": false,
          "latest_version": "1.7.0",
          "repository_url": "https://github.com/dot-skill/skillerr",
          "versions_count": 26,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 5720,
          "first_published_at": "2026-07-13T01:21:06.729000Z",
          "latest_published_at": "2026-07-21T03:18:46.744000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 6
        },
        {
          "name": "@skillerr/registry",
          "exists": true,
          "license": "Apache-2.0",
          "keywords": [
            "skill",
            ".skill",
            "ai-agents",
            "transparency-log",
            "registry"
          ],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@skillerr/registry",
          "is_deprecated": false,
          "latest_version": "1.7.0",
          "repository_url": "https://github.com/dot-skill/skillerr",
          "versions_count": 26,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 4617,
          "first_published_at": "2026-07-13T01:21:19.559000Z",
          "latest_published_at": "2026-07-21T03:19:03.986000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 6
        },
        {
          "name": "skillerr",
          "exists": true,
          "license": "Apache-2.0",
          "keywords": [
            "skill",
            "skillerr",
            ".skill",
            "ai-agents",
            "agent-skills",
            "cli",
            "protocol",
            "portable",
            "inspectable",
            "provenance",
            "signing",
            "ed25519",
            "sigstore",
            "attestation",
            "transparency-log",
            "content-addressed",
            "supply-chain",
            "verifiable",
            "trust"
          ],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/skillerr",
          "is_deprecated": false,
          "latest_version": "1.7.0",
          "repository_url": "https://github.com/dot-skill/skillerr",
          "versions_count": 31,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 5224,
          "first_published_at": "2026-07-13T00:49:58.464000Z",
          "latest_published_at": "2026-07-21T03:19:19.233000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 6
        },
        {
          "name": "@skillerr/workspace",
          "exists": true,
          "license": "Apache-2.0",
          "keywords": [
            "skill",
            ".skill",
            "ai-agents",
            "agent-skills",
            "workspace",
            "continuity"
          ],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@skillerr/workspace",
          "is_deprecated": false,
          "latest_version": "1.7.0",
          "repository_url": "https://github.com/dot-skill/skillerr",
          "versions_count": 26,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 4652,
          "first_published_at": "2026-07-13T01:21:23.501000Z",
          "latest_published_at": "2026-07-21T03:19:09.276000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 6
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 3,
      "watchers": 1,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": null,
      "open_issues_and_prs": 2
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "examples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": false,
      "bootstrap_files": [],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [
        "packages/cli/tsconfig.json",
        "packages/core/tsconfig.json",
        "packages/protocol/tsconfig.json",
        "packages/registry/tsconfig.json",
        "packages/runtime/tsconfig.json",
        "packages/workspace/tsconfig.json"
      ],
      "toolchain_manifests": [],
      "largest_source_bytes": 114102,
      "source_files_sampled": 68,
      "oversized_source_files": 2,
      "agent_instruction_files": [
        "docs/AGENT.md"
      ],
      "agent_instruction_max_bytes": 8517
    },
    "dependencies": {
      "manifests": [
        "package.json"
      ],
      "advisories": {
        "error": null,
        "scope": "published_package",
        "source": "osv",
        "findings": [],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 74,
        "malicious_count": 0,
        "assessed_package": "npm:skillerr@1.7.0",
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "npm"
      ],
      "dependencies": [
        {
          "name": "@skillerr/core",
          "manifest": "packages/cli/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.7.0"
        },
        {
          "name": "@skillerr/protocol",
          "manifest": "packages/cli/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.7.0"
        },
        {
          "name": "@skillerr/registry",
          "manifest": "packages/cli/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.7.0"
        },
        {
          "name": "@skillerr/runtime",
          "manifest": "packages/cli/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.7.0"
        },
        {
          "name": "@skillerr/workspace",
          "manifest": "packages/cli/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.7.0"
        },
        {
          "name": "@sigstore/bundle",
          "manifest": "packages/core/package.json",
          "ecosystem": "npm",
          "version_constraint": "^5.0.0"
        },
        {
          "name": "@sigstore/core",
          "manifest": "packages/core/package.json",
          "ecosystem": "npm",
          "version_constraint": "^4.0.1"
        },
        {
          "name": "@sigstore/sign",
          "manifest": "packages/core/package.json",
          "ecosystem": "npm",
          "version_constraint": "^5.0.0"
        },
        {
          "name": "@sigstore/tuf",
          "manifest": "packages/core/package.json",
          "ecosystem": "npm",
          "version_constraint": "^4.0.2"
        },
        {
          "name": "@sigstore/verify",
          "manifest": "packages/core/package.json",
          "ecosystem": "npm",
          "version_constraint": "^4.1.0"
        },
        {
          "name": "@skillerr/protocol",
          "manifest": "packages/core/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.7.0"
        },
        {
          "name": "ajv",
          "manifest": "packages/core/package.json",
          "ecosystem": "npm",
          "version_constraint": "^8.17.1"
        },
        {
          "name": "ajv-formats",
          "manifest": "packages/core/package.json",
          "ecosystem": "npm",
          "version_constraint": "^3.0.1"
        },
        {
          "name": "fflate",
          "manifest": "packages/core/package.json",
          "ecosystem": "npm",
          "version_constraint": "^0.8.2"
        },
        {
          "name": "@skillerr/core",
          "manifest": "packages/registry/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.7.0"
        },
        {
          "name": "@skillerr/protocol",
          "manifest": "packages/registry/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.7.0"
        },
        {
          "name": "@skillerr/core",
          "manifest": "packages/runtime/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.7.0"
        },
        {
          "name": "@skillerr/protocol",
          "manifest": "packages/runtime/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.7.0"
        },
        {
          "name": "@skillerr/cli",
          "manifest": "packages/skillerr/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.7.0"
        },
        {
          "name": "@skillerr/core",
          "manifest": "packages/workspace/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.7.0"
        },
        {
          "name": "@skillerr/protocol",
          "manifest": "packages/workspace/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.7.0"
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 57,
        "open_issues": 2,
        "closed_ratio": 0.333,
        "closed_issues": 1,
        "closed_unmerged_prs": 1
      },
      "bus_factor": 1,
      "bot_contributors": 0,
      "top_contributors": [
        {
          "type": "User",
          "login": "bharatdudeja13-cmd",
          "commits": 153,
          "avatar_url": "https://avatars.githubusercontent.com/u/251474831?v=4"
        }
      ],
      "contributors_sampled": 1,
      "top_contributor_share": 1
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml",
        "enforce-branch-flow.yml",
        "publish.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [],
      "has_editorconfig": false,
      "has_linter_config": false,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "package-lock.json"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 3,
            "reason": "branch protection is not maximal on development and all release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 10,
            "reason": "12 out of 12 merged PRs checked by a CI test -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/12 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 0,
            "reason": "project has 0 contributing companies or organizations -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 2,
            "reason": "dependency not pinned by hash detected -- score normalized to 2",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "SAST tool is not run on all commits -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 4,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 8,
            "reason": "2 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "20ff4245fff289095642e74c1febf3f6a30e4b04",
        "ran_at": "2026-07-27T23:07:55Z",
        "aggregate_score": 4,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": true,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-21T03:19:37Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": "2026-07-21T03:17:43Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": [
        {
          "number": 1,
          "created_at": "2026-07-12T14:59:41Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 3,
          "created_at": "2026-07-12T14:59:44Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ]
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/dot-skill/skillerr",
    "host": "github.com",
    "name": "skillerr",
    "owner": "dot-skill"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 61,
      "inputs": {
        "security": 52,
        "vitality": 74,
        "community": 53,
        "governance": 45,
        "engineering": 81
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 74,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 56,
            "inputs": {
              "commits_last_year": 153,
              "human_commit_share": 1,
              "days_since_last_push": 6,
              "active_weeks_last_year": 3
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 6 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 6
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "3/52 weeks with commits",
                "points": 2.1,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 3
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "153 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 153
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "releases_count": 22,
              "latest_release_tag": "v1.1.0",
              "releases_from_tags": false,
              "days_since_latest_release": 12,
              "mean_days_between_releases": 0.1
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "22 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 22
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 12 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 12
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~0.1 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 0.1
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "moderate",
        "name": "Community & Adoption",
        "value": 53,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 5,
            "inputs": {
              "forks": 0,
              "stars": 3,
              "watchers": 1,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "3 stars",
                "points": 4.9,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "1 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "excellent",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 92,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": true,
              "has_issue_template": false,
              "has_code_of_conduct": true,
              "has_pull_request_template": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 18,
                "status": "met",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 13.5,
                "status": "met",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 6.3,
                "status": "met",
                "details": [],
                "max_points": 6.3
              }
            ]
          },
          {
            "key": "ecosystem_adoption",
            "band": "good",
            "name": "Ecosystem adoption (downloads)",
            "note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "registry_dependents"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 76,
            "inputs": {
              "packages": [
                "@skillerr/cli",
                "@skillerr/core",
                "@skillerr/runtime",
                "@skillerr/protocol",
                "@skillerr/registry",
                "skillerr",
                "@skillerr/workspace"
              ],
              "dependents": null,
              "ecosystems": "npm",
              "total_downloads": null,
              "monthly_downloads": 35341
            },
            "components": [
              {
                "key": "monthly_downloads",
                "name": "Monthly downloads",
                "detail": "35,341 downloads/month across npm",
                "points": 60.6,
                "status": "partial",
                "details": [
                  {
                    "code": "downloads_monthly",
                    "params": {
                      "count": 35341,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 80
              },
              {
                "key": "registry_dependents",
                "name": "Registry dependents",
                "detail": "not reported by this ecosystem",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_reported_by_this_ecosystem",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 45,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 10,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 1,
              "top_contributor_share": 1
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "1 contributors",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "moderate",
            "name": "Issue & PR responsiveness",
            "note": null,
            "notes": [],
            "value": 53,
            "inputs": {
              "merged_prs": 57,
              "open_issues": 2,
              "closed_issues": 1,
              "issue_closed_ratio": 0.333,
              "closed_unmerged_prs": 1
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "33% of issues closed",
                "points": 15.6,
                "status": "partial",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 33
                    }
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "57/58 decided PRs merged",
                "points": 37.6,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 57,
                      "decided": 58
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/12 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "at_risk",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 35,
            "inputs": {
              "followers": 0,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "dot-skill",
              "public_repos": 4,
              "account_age_days": 15
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "0 followers of dot-skill",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 0,
                      "login": "dot-skill"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "4 public repos, account ~0 yr old",
                "points": 5.2,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 4
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 0
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "@skillerr/cli",
                "@skillerr/core",
                "@skillerr/runtime",
                "@skillerr/protocol",
                "@skillerr/registry",
                "skillerr",
                "@skillerr/workspace"
              ],
              "ecosystems": "npm",
              "any_deprecated": false,
              "min_days_since_publish": 6
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "7 package(s) on npm",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 7,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 6 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 6
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "31 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 31
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 81,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "moderate",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 68,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": false,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "3 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "12 out of 12 merged PRs checked by a CI test -- score normalized to 10",
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "excellent",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "topics": [
                "ai-agents",
                "mcp",
                "open-source",
                "protocol",
                "skill",
                "agents",
                "ai-skills",
                "cli",
                "dot-skill",
                "skillerr"
              ],
              "has_wiki": true,
              "homepage": "https://www.skillerr.com/docs/",
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": "https://www.skillerr.com/docs/",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "10 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 10
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "moderate",
        "name": "Security",
        "value": 52,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "at_risk",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 40,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 17,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 1,
              "scorecard_aggregate": 4
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection is not maximal on development and all release branches",
                "points": 2.2,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "12 out of 12 merged PRs checked by a CI test -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/12 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 2",
                "points": 1,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 2,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "2 existing vulnerabilities detected",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the npm:skillerr@1.7.0 runtime dependency closure — what installing the published package pulls in — 74 packages. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_published",
                "params": {
                  "package": "npm:skillerr@1.7.0",
                  "assessed": 74
                }
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 0,
              "affected_packages": 0,
              "assessed_packages": 74,
              "unassessed_packages": 0,
              "affected_by_severity": "none",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "no indirect dependency carries a known advisory",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "no_indirect_advisories",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 74,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "moderate",
        "name": "AI Readiness",
        "value": 68,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.99,
              "agent_instruction_files": [
                "docs/AGENT.md"
              ],
              "agent_instruction_max_bytes": 8517
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "docs/AGENT.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "docs/AGENT.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "99 of 100 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 99,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "moderate",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 55,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "package-lock.json"
              ],
              "has_dockerfile": false,
              "typed_language": true,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": false,
              "typecheck_configs": [
                "packages/cli/tsconfig.json",
                "packages/core/tsconfig.json",
                "packages/protocol/tsconfig.json",
                "packages/registry/tsconfig.json",
                "packages/runtime/tsconfig.json",
                "packages/workspace/tsconfig.json"
              ],
              "agent_commit_share": 0.38,
              "toolchain_manifests": [],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "packages/cli/tsconfig.json, packages/core/tsconfig.json, packages/protocol/tsconfig.json, packages/registry/tsconfig.json, packages/runtime/tsconfig.json, packages/workspace/tsconfig.json",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "packages/cli/tsconfig.json, packages/core/tsconfig.json, packages/protocol/tsconfig.json, packages/registry/tsconfig.json, packages/runtime/tsconfig.json, packages/workspace/tsconfig.json"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "38 of the last 100 commits agent-authored or agent-credited",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "agent_authored_commits",
                    "params": {
                      "count": 38,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 2",
                "points": 2,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 98,
            "inputs": {
              "primary_language": "TypeScript",
              "largest_source_bytes": 114102,
              "source_files_sampled": 68,
              "oversized_source_files": 2
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "TypeScript (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "TypeScript"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "2/68 source files over 60KB",
                "points": 53.4,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 68,
                      "oversized": 2
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "at_risk",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [
                "examples"
              ],
              "has_mcp_signal": false,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-27T23:08:11.623950Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/d/dot-skill/skillerr.svg",
  "full_name": "dot-skill/skillerr",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}