公开记录中等
软件健康报告模式 0.27.0 · 指标 1.13.0 · 2026-07-27 23:08 UTC
dot-skill / skillerr
Open .skill Protocol - a sealed, inspectable package format for AI agent skills. Reference implementation: skillerr.
dot-skill/skillerr 的健康指数为 100 分中的 61 分，处于「中等」区间。 其得分最高的类别是Engineering Quality（81/100），最低的是Sustainability & Governance（45/100）。 最近一次更新在 6 天前。 近期的大部分工作由 1 位贡献者完成。
61
总分 / 100软件健康指数
指标归入加权类别，统一采用 1–100 量表。总体分先取类别加权平均；当公开证据触发高风险司法辖区政策时，评级会按政策调整，并设置 49（有风险）的上限。AI 就绪度不计入总体分。
61
优秀85-100堪称典范；基本满足所有检验标准
良好70-84健康；仅有轻微不足
中等50-69可接受，但存在明显不足；建议进行审查
存在风险30-49存在重大薄弱环节；采用时应保持审慎
危急1-29问题严重（项目被弃置、仅有单一维护者、缺乏基本工程规范）
评分画像
每条轴代表一个类别。形状比平均值更重要——健康的对象会填满整个图形，而“一峰一谷”式画像意味着某一维度的优势正掩盖另一维度的风险。
所有权
软件包生态系统
| 注册表 | 软件包 | 版本 | 月下载量 | 版本数 | 最近发布 | 标签 |
|---|---|---|---|---|---|---|
| npm | @skillerr/cli | 1.7.0 | 4,471 | 26 | 6 天前 | skillskillerrai-agentsagent-skillscliprotocol |
| npm | @skillerr/core | 1.7.0 | 5,762 | 27 | 6 天前 | skillai-agentsagent-skillscompilemint |
| npm | @skillerr/runtime | 1.7.0 | 4,895 | 27 | 6 天前 | skillai-agentsagent-skillsruntimedry-run |
| npm | @skillerr/protocol | 1.7.0 | 5,720 | 26 | 6 天前 | skillai-agentsagent-skillsprotocoltypes |
| npm | @skillerr/registry | 1.7.0 | 4,617 | 26 | 6 天前 | skillai-agentstransparency-logregistry |
| npm | skillerr | 1.7.0 | 5,224 | 31 | 6 天前 | skillskillerrai-agentsagent-skillscliprotocolportableinspectableprovenancesigninged25519sigstoreattestationtransparency-logcontent-addressedsupply-chainverifiabletrust |
| npm | @skillerr/workspace | 1.7.0 | 4,652 | 26 | 6 天前 | skillai-agentsagent-skillsworkspacecontinuity |
按类别列示的指标
活力
项目是否仍有生命——是否仍在编写代码，是否仍在发布版本？
74
开发活跃度
56中等
评分方式
| 36/36 | 推送新近度 — 最近一次推送于 6 天前 |
| 2.1/36 | 提交节奏 — 52 周中有 3 周有提交 |
| 18/18 | 提交量 — 最近一年 153 次提交 |
| 0/10 | OpenSSF Scorecard：Maintained — project was created within the last 90 days. Please review its contents carefully |
所用输入
| commits_last_year | 153 |
| human_commit_share | 1 |
| days_since_last_push | 6 |
| active_weeks_last_year | 3 |
发布纪律
100优秀
评分方式
| 27/27 | 有发布版本 — 已发布 22 个发布版本 |
| 36/36 | 发布时效 — 最近一次发布版本于 12 天前 |
| 27/27 | 发布节奏 — 约每 0.1 天发布一次 |
| 0/10 | OpenSSF Scorecard：Signed-Releases — 无数据 |
所用输入
| releases_count | 22 |
| latest_release_tag | v1.1.0 |
| releases_from_tags | 否 |
| days_since_latest_release | 12 |
| mean_days_between_releases | 0.1 |
已排除计分（无数据或不适用）：OpenSSF Scorecard：Signed-Releases。 其余权重已重新归一化。
社区与采用
项目是否拥有用户、下载量与关注度，并具备欢迎贡献者参与的配置？
53
流行度与采用
5危急
评分方式
| 4.9/60 | 星标 — 3 个星标 |
| 0/25 | 复刻 — 0 个复刻 |
| 0/15 | 关注者 — 1 位关注者 |
所用输入
| forks | 0 |
| stars | 3 |
| watchers | 1 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
社区健康
92优秀
评分方式
| 22.5/22.5 | README |
| 22.5/22.5 | 许可证 — 可识别的许可证（Apache-2.0） |
| 18/18 | CONTRIBUTING 指南 |
| 13.5/13.5 | 行为准则 |
| 0/7.2 | 议题模板 |
| 6.3/6.3 | PR 模板 |
所用输入
| has_readme | 是 |
| has_license | 是 |
| has_contributing | 是 |
| has_issue_template | 否 |
| has_code_of_conduct | 是 |
| has_pull_request_template | 是 |
生态采用（下载量）
76良好
评分方式
| 60.6/80 | 月度下载量 — npm 合计每月 35,341 次下载 |
| 0/20 | 注册表被依赖数 — 该生态系统不报告此项 |
所用输入
| packages | @skillerr/cli, @skillerr/core, @skillerr/runtime, @skillerr/protocol, @skillerr/registry, skillerr, @skillerr/workspace |
| dependents | — |
| ecosystems | npm |
| total_downloads | — |
| monthly_downloads | 35,341 |
已排除计分（无数据或不适用）：注册表被依赖数。 其余权重已重新归一化。
可持续性与治理
项目能否在其成员之外延续——巴士系数、响应能力、由谁支持，以及软件包的维护状况？
45
维护者韧性（巴士系数）
10危急
评分方式
| 9/54 | 巴士系数 — 1 位贡献者贡献了半数提交 |
| 0/22.5 | 提交分布 — 头号贡献者编写了 100% 的提交 |
| 1.4/13.5 | 贡献者广度 — 1 位贡献者 |
| 0/10 | OpenSSF Scorecard：Contributors — project has 0 contributing companies or organizations -- score normalized to 0 |
所用输入
| bus_factor | 1 |
| contributors_sampled | 1 |
| top_contributor_share | 1 |
议题与 PR 响应能力
53中等
评分方式
| 15.6/46.8 | 议题解决 — 33% 的议题已关闭 |
| 37.6/38.3 | PR 接受 — 已裁定的 PR 中 57/58 已合并 |
| 0/15 | OpenSSF Scorecard：Code-Review — Found 0/12 approved changesets -- score normalized to 0 |
所用输入
| merged_prs | 57 |
| open_issues | 2 |
| closed_issues | 1 |
| issue_closed_ratio | 0.333 |
| closed_unmerged_prs | 1 |
所有权与托管责任
35存在风险
评分方式
| 30/30 | 所有权背书 — 组织持有 |
| 0/20 | 已验证域名 |
| 0/25 | 所有者影响力 — dot-skill 有 0 位关注者 |
| 5.2/25 | 既往记录 — 4 个公开仓库，账户约 0 年 |
所用输入
| followers | 0 |
| owner_type | Organization |
| is_verified | — |
| owner_login | dot-skill |
| public_repos | 4 |
| account_age_days | 15 |
软件包维护
100优秀
评分方式
| 25/25 | 已发布且可解析 — npm 上有 7 个软件包 |
| 35/35 | 发布时效 — 最近一次发布于 6 天前 |
| 20/20 | 版本历史 — 31 个已发布版本 |
| 20/20 | 未被弃用 — 活跃，未被弃用或撤回 |
所用输入
| packages | @skillerr/cli, @skillerr/core, @skillerr/runtime, @skillerr/protocol, @skillerr/registry, skillerr, @skillerr/workspace |
| ecosystems | npm |
| any_deprecated | 否 |
| min_days_since_publish | 6 |
工程质量
基础的工程与文档实践是否到位？
81
工程实践
68中等
评分方式
| 24/24 | CI 工作流 — 3 个工作流 |
| 24/24 | 存在测试 |
| 0/16 | Linter 配置 |
| 0/9.6 | Pre-commit 钩子 |
| 0/6.4 | .editorconfig |
| 20/20 | OpenSSF Scorecard：CI-Tests — 12 out of 12 merged PRs checked by a CI test -- score normalized to 10 |
所用输入
| has_ci | 是 |
| has_tests | 是 |
| has_editorconfig | 否 |
| has_linter_config | 否 |
| has_precommit_config | 否 |
文档
100优秀
评分方式
| 30/30 | README |
| 25/25 | 文档目录 |
| 15/15 | 文档 / 主页站点 — https://www.skillerr.com/docs/ |
| 10/10 | 仓库描述 |
| 10/10 | 主题标签 — 10 个主题标签 |
| 10/10 | Wiki |
所用输入
| topics | ai-agents, mcp, open-source, protocol, skill, agents, ai-skills, cli, dot-skill, skillerr |
| has_wiki | 是 |
| homepage | https://www.skillerr.com/docs/ |
| has_readme | 是 |
| has_docs_dir | 是 |
| has_description | 是 |
安全
可见的安全与供应链实践是否稳固，且不存在未解决的高风险司法辖区暴露？
52
安全态势
40存在风险
评分方式
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 2.2/7.5 | Branch-Protection — branch protection is not maximal on development and all release branches |
| 2.5/2.5 | CI-Tests — 12 out of 12 merged PRs checked by a CI test -- score normalized to 10 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 0/12 approved changesets -- score normalized to 0 |
| 0/2.5 | Contributors — project has 0 contributing companies or organizations -- score normalized to 0 |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 0/7.5 | Dependency-Update-Tool — no update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.5/2.5 | 许可证 — license file detected |
| 0/7.5 | Maintained — project was created within the last 90 days. Please review its contents carefully |
| 5/5 | Packaging — packaging workflow detected |
| 1/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 2 |
| 0/5 | SAST — SAST tool is not run on all commits -- score normalized to 0 |
| 2/5 | Security-Policy — security policy file detected |
| 0/7.5 | Signed-Releases — 无数据 |
| 0/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 6/7.5 | Vulnerabilities — 2 existing vulnerabilities detected |
所用输入
| source | openssf_scorecard |
| checks_evaluated | 17 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 1 |
| scorecard_aggregate | 4 |
已排除计分（无数据或不适用）：signed_releases。 其余权重已重新归一化。
依赖安全公告
100优秀
评分方式
| 35/35 | 直接依赖不含已知公告 — 没有直接依赖携带已知公告 |
| 25/25 | 间接依赖不含已知公告 — 没有间接依赖携带已知公告 |
| 0/40 | 没有长期未处理的公告 — 没有公告带有发布日期 |
所用输入
| source | osv |
| advisories | 0 |
| affected_packages | 0 |
| assessed_packages | 74 |
| unassessed_packages | 0 |
| affected_by_severity | none |
| direct_affected_packages | 0 |
已排除计分（无数据或不适用）：没有长期未处理的公告。 其余权重已重新归一化。 比对的是 npm:skillerr@1.7.0 的运行时依赖闭包——安装已发布的软件包时真正被拉取进来的内容——共 74 个软件包。 未对可达性进行分析。
AI 就绪度
该仓库在多大程度上具备与 AI 编码代理协同开发与维护的条件？这是一枚独立的实验性徽章——权重为 0.0，因此单独呈现，不影响总体健康评分。
68
AI 代理上下文与指引
85优秀
评分方式
| 45/45 | 代理指令 — docs/AGENT.md |
| 0/15 | 机器可读文档（llms.txt） |
| 40/40 | 可读的提交历史 — 100 次人类提交中有 99 次说明了意图（结构化标题或解释性正文） |
所用输入
| has_llms_txt | 否 |
| legible_history_share | 0.99 |
| agent_instruction_files | docs/AGENT.md |
| agent_instruction_max_bytes | 8,517 |
评分方式
| 0/18 | 一条命令的引导启动 |
| 22/22 | 自动化测试 |
| 0/11 | Lint / 格式化配置 |
| 11/11 | 静态类型检查 — packages/cli/tsconfig.json, packages/core/tsconfig.json, packages/protocol/tsconfig.json, packages/registry/tsconfig.json, packages/runtime/tsconfig.json, packages/workspace/tsconfig.json |
| 10/10 | 可复现环境 — lockfile |
| 10/10 | 已体现的代理实践 — 最近 100 次提交中有 38 次由代理编写或署名代理 |
| 0/8 | 自动化维护 — 未观察到自动依赖更新 |
| 2/10 | OpenSSF Scorecard：Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 2 |
所用输入
| has_nix | 否 |
| has_tests | 是 |
| lockfiles | package-lock.json |
| has_dockerfile | 否 |
| typed_language | 是 |
| bootstrap_files | — |
| has_devcontainer | 否 |
| has_linter_config | 否 |
| typecheck_configs | packages/cli/tsconfig.json, packages/core/tsconfig.json, packages/protocol/tsconfig.json, packages/registry/tsconfig.json, packages/runtime/tsconfig.json, packages/workspace/tsconfig.json |
| agent_commit_share | 0.38 |
| toolchain_manifests | — |
| dependency_bot_commit_share | 0 |
面向模型的代码可读性
98优秀
评分方式
| 45/45 | 可类型检查的代码 — TypeScript（静态类型） |
| 53.4/55 | 可控的文件大小 — 采样的 68 个源文件中有 2 个超过 60KB |
所用输入
| primary_language | TypeScript |
| largest_source_bytes | 114,102 |
| source_files_sampled | 68 |
| oversized_source_files | 2 |
机器可读接口
40存在风险
评分方式
| 0/40 | API 模式（OpenAPI/GraphQL/proto） |
| 0/20 | MCP 服务器 |
| 40/40 | 可运行示例 — examples |
所用输入
| example_dirs | examples |
| has_mcp_signal | 否 |
| api_schema_files | — |
关键数据
3GitHub 星标
1贡献者
153最近 12 个月提交数
6距最近推送天数
22发布版本数
1巴士系数（bus factor）
2开放议题
npm软件包生态系统数
数据采集警告
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
- GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
更多细节
OpenSSF Scorecard 4.0 / 10
4.0综合
来自开源项目 OpenSSF Scorecard 的独立、工具无关的安全评估。每项检查奖励的是安全实践本身，而非特定供应商的工具。Scorecard 无法判定的检查项标记为 不适用，并从安全评分中剔除（绝不按零分计）。
| 10 | Binary-Artifacts | no binaries found in the repo |
| 3 | Branch-Protection | branch protection is not maximal on development and all release branches |
| 10 | CI-Tests | 12 out of 12 merged PRs checked by a CI test -- score normalized to 10 |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 0/12 approved changesets -- score normalized to 0 |
| 0 | Contributors | project has 0 contributing companies or organizations -- score normalized to 0 |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 0 | Dependency-Update-Tool | no update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 10 | License | license file detected |
| 0 | Maintained | project was created within the last 90 days. Please review its contents carefully |
| 10 | Packaging | packaging workflow detected |
| 2 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 2 |
| 0 | SAST | SAST tool is not run on all commits -- score normalized to 0 |
| 4 | Security-Policy | security policy file detected |
| 不适用 | Signed-Releases | no releases found |
| 0 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 8 | Vulnerabilities | 2 existing vulnerabilities detected |
直接依赖 21
| 注册表 | 软件包 | 版本约束 | 清单文件 |
|---|---|---|---|
| npm | @skillerr/core | ^1.7.0 | packages/cli/package.json |
| npm | @skillerr/protocol | ^1.7.0 | packages/cli/package.json |
| npm | @skillerr/registry | ^1.7.0 | packages/cli/package.json |
| npm | @skillerr/runtime | ^1.7.0 | packages/cli/package.json |
| npm | @skillerr/workspace | ^1.7.0 | packages/cli/package.json |
| npm | @sigstore/bundle | ^5.0.0 | packages/core/package.json |
| npm | @sigstore/core | ^4.0.1 | packages/core/package.json |
| npm | @sigstore/sign | ^5.0.0 | packages/core/package.json |
| npm | @sigstore/tuf | ^4.0.2 | packages/core/package.json |
| npm | @sigstore/verify | ^4.1.0 | packages/core/package.json |
| npm | @skillerr/protocol | ^1.7.0 | packages/core/package.json |
| npm | ajv | ^8.17.1 | packages/core/package.json |
| npm | ajv-formats | ^3.0.1 | packages/core/package.json |
| npm | fflate | ^0.8.2 | packages/core/package.json |
| npm | @skillerr/core | ^1.7.0 | packages/registry/package.json |
| npm | @skillerr/protocol | ^1.7.0 | packages/registry/package.json |
| npm | @skillerr/core | ^1.7.0 | packages/runtime/package.json |
| npm | @skillerr/protocol | ^1.7.0 | packages/runtime/package.json |
| npm | @skillerr/cli | ^1.7.0 | packages/skillerr/package.json |
| npm | @skillerr/core | ^1.7.0 | packages/workspace/package.json |
| npm | @skillerr/protocol | ^1.7.0 | packages/workspace/package.json |
全部依赖 未采集
本报告未能采集到解析后的依赖集合：GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
依赖安全公告 0
安装 npm:skillerr@1.7.0 会引入 74 个包（直接与传递）：其中 0 个存在已知公告，0 个为直接依赖。
没有已知公告影响已评估的依赖。
公告表示依赖图中记录的版本落入某条公告的受影响范围。可达性未经分析，且依赖图包含开发与测试的版本固定——某项发现可能只涉及工具链而非交付的软件。
原始 JSON 报告 机器可读
{
"data": {
"repo": {
"topics": [
"ai-agents",
"mcp",
"open-source",
"protocol",
"skill",
"agents",
"ai-skills",
"cli",
"dot-skill",
"skillerr"
],
"is_fork": false,
"size_kb": 15531,
"has_wiki": true,
"homepage": "https://www.skillerr.com/docs/",
"languages": {
"Shell": 1050,
"JavaScript": 117755,
"TypeScript": 773900
},
"pushed_at": "2026-07-21T03:17:53Z",
"created_at": "2026-07-12T14:52:25Z",
"owner_type": "Organization",
"updated_at": "2026-07-21T03:17:48Z",
"description": "Open .skill Protocol - a sealed, inspectable package format for AI agent skills. Reference implementation: skillerr.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "Apache-2.0",
"default_branch": "main",
"license_spdx_raw": "Apache-2.0",
"primary_language": "TypeScript",
"significant_languages": [
"TypeScript",
"JavaScript"
]
},
"owner": {
"blog": "https://skillerr.com",
"name": "Skillerr",
"type": "Organization",
"login": "dot-skill",
"company": "Skillerr",
"location": null,
"followers": 0,
"avatar_url": "https://avatars.githubusercontent.com/u/304076320?v=4",
"created_at": "2026-07-12T15:20:50Z",
"is_verified": null,
"public_repos": 4,
"account_age_days": 15
},
"license": {
"state": "standard",
"spdx_id": "Apache-2.0",
"raw_spdx": "Apache-2.0",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v1.1.0",
"kind": "minor",
"published_at": "2026-07-15T17:04:33Z"
},
{
"tag": "v1.0.3",
"kind": "patch",
"published_at": "2026-07-15T02:08:51Z"
},
{
"tag": "v1.0.2",
"kind": "patch",
"published_at": "2026-07-15T01:02:54Z"
},
{
"tag": "v1.0.1",
"kind": "patch",
"published_at": "2026-07-15T01:04:46Z"
},
{
"tag": "v1.0.0",
"kind": "major",
"published_at": "2026-07-15T01:04:44Z"
},
{
"tag": "v0.9.10",
"kind": "patch",
"published_at": "2026-07-15T01:04:42Z"
},
{
"tag": "v0.9.9",
"kind": "patch",
"published_at": "2026-07-15T01:04:41Z"
},
{
"tag": "v0.9.8",
"kind": "patch",
"published_at": "2026-07-15T01:04:39Z"
},
{
"tag": "v0.9.7",
"kind": "patch",
"published_at": "2026-07-15T01:04:37Z"
},
{
"tag": "v0.9.6",
"kind": "patch",
"published_at": "2026-07-15T01:04:36Z"
},
{
"tag": "v0.9.5",
"kind": "patch",
"published_at": "2026-07-15T01:04:34Z"
},
{
"tag": "v0.9.4",
"kind": "patch",
"published_at": "2026-07-15T01:04:32Z"
},
{
"tag": "v0.9.2",
"kind": "patch",
"published_at": "2026-07-15T01:04:30Z"
},
{
"tag": "v0.9.1",
"kind": "patch",
"published_at": "2026-07-15T01:04:28Z"
},
{
"tag": "v0.9.0",
"kind": "minor",
"published_at": "2026-07-15T01:04:27Z"
},
{
"tag": "v0.8.1",
"kind": "patch",
"published_at": "2026-07-15T01:04:24Z"
},
{
"tag": "v0.7.1",
"kind": "patch",
"published_at": "2026-07-15T01:04:23Z"
},
{
"tag": "v0.7.0",
"kind": "minor",
"published_at": "2026-07-15T01:04:21Z"
},
{
"tag": "v0.6.4",
"kind": "patch",
"published_at": "2026-07-15T01:04:19Z"
},
{
"tag": "v0.6.3",
"kind": "patch",
"published_at": "2026-07-15T01:04:17Z"
},
{
"tag": "v0.6.2",
"kind": "patch",
"published_at": "2026-07-15T01:04:15Z"
},
{
"tag": "v0.6.1",
"kind": "patch",
"published_at": "2026-07-15T01:04:13Z"
}
],
"recent_commits": [
{
"oid": "20ff4245fff289095642e74c1febf3f6a30e4b04",
"body": "release: 1.7.0 — SessionSource inference-free capture intake",
"is_bot": false,
"headline": "Merge pull request #61 from dot-skill/release/1.7.0",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-21T03:17:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8e7abfd801303eae32ea1c3aa0e113accf21890a",
"body": "Lockstep bump. Ships listSessionCandidates / resolveSession /\nloadSessionContext and captureSession({ from, sessionId }) so Continuity\ncan merge local agent session stores over the git floor without a model.\n\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>\nCo-authored-by: Cursor <cursoragent@cursor.com>",
"is_bot": false,
"headline": "release: 1.7.0 — SessionSource inference-free capture intake",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-21T03:13:10Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "396d910ac5f42e09c60233651d419c49d8b498a1",
"body": "feat(core): SessionSource APIs for inference-free agent session capture",
"is_bot": false,
"headline": "Merge pull request #60 from dot-skill/feature/session-source",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-21T03:12:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1f5986323ba1fdbad4d8929b4492908f743bb8e6",
"body": "Claude-style path slugs included drive-letter `:` (e.g. C:-Users-...),\nwhich is illegal in Windows directory names and broke the CI matrix\nfixtures. Strip Windows-illegal characters and normalize related-path\nchecks to forward slashes.\n\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>\nCo-authored-by: Cursor <cursoragent@cursor.com>",
"is_bot": false,
"headline": "fix(core): sanitize SessionSource project slugs for Windows paths",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-21T03:08:40Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "1e1c36d9fe69c082c30fdfe439456dfedbbf6a92",
"body": "Add listSessionCandidates / resolveSession / loadSessionContext for\nclaude-code|codex|cursor local stores (no model calls), wired into\ncaptureSession({ from, sessionId }) on top of the existing git floor.\nNormalize claude ↔ claude-code; scrub session lines and attach bytes.\nCLI: skill capture --from\n[…]\n\nINTEGRATION_NOTES ACTION for registry to drop cli/session-sources.mjs.\n\nAI-assisted (Cursor).\n\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>\nCo-authored-by: Cursor <cursoragent@cursor.com>",
"is_bot": false,
"headline": "feat(core): SessionSource APIs for inference-free agent session capture",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-21T03:05:56Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d01090f29b5d2a004bad028446aaedbe67bdb1f5",
"body": "release: 1.6.0 — trust spine, capture/continuity, scrub, Merkle log, Apache-2.0",
"is_bot": false,
"headline": "Merge pull request #59 from dot-skill/release/1.6.0",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-21T02:48:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6e1beb649dffc4d337d0b49e256e127b1dea6ed4",
"body": "…Apache-2.0\n\nLockstep bump across all seven packages. Ships the develop-accumulated work\nCursor has been mocking: captureSession + Resume Contract 1.0, trust-spine\nverify/SBOM, Merkle log, deterministic scrubbing, Apache-2.0 relicense, and\ndoc-audit CI (DOC-MAP, license + link checks). Test badge updated to 285.\n\nAI-assisted (Cursor).\n\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>\nCo-authored-by: Cursor <cursoragent@cursor.com>",
"is_bot": false,
"headline": "release: 1.6.0 — trust spine, capture/continuity, scrub, Merkle log, …",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-21T02:40:56Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "b2fc38548c00afa17a5c089d3563f3f211e53175",
"body": "docs: DOC-MAP + license/link CI checks (doc-audit remainder)",
"is_bot": false,
"headline": "Merge pull request #58 from dot-skill/feature/doc-audit-remainder",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-21T02:37:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "259a391972af35f71bb1223d882ffdf515b125c1",
"body": "Add docs/DOC-MAP.md as the index of every doc surface and owning module,\nwire license-consistency and dead-internal-link checks into CI, and add a\nDocs impact section to CONTRIBUTING that points at the map. Prevents the\nMIT/Apache drift that landed on main from recurring, and catches broken\nrelative links before merge.\n\nAI-assisted (Cursor).\n\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>\nCo-authored-by: Cursor <cursoragent@cursor.com>",
"is_bot": false,
"headline": "docs: DOC-MAP + license/link CI checks (doc-audit remainder)",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-21T02:33:01Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "73f768494ccdd0f779bd61d08fdffed50413fe82",
"body": "feat(core): real session capture + Resume Contract 1.0 (fixes hollow handoff)",
"is_bot": false,
"headline": "Merge pull request #57 from dot-skill/feature/session-capture",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-21T01:42:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9fb334676eef383a1d1af483b317c9a45a940a5e",
"body": "…handoff)\n\nThe prod bug: `capture -> resume` produced an empty payload — a one-line\njourney (\"Checkpoint captured: CLI capture (redacted metadata)\"), no gaps,\nno knowledge, no working set, and a \"_preview (Resume Contract pending)_\"\nheader — because the real capture/render functions were never shipp\n[…]\ntake schema, and the stale-@skillerr/add-version pin note.\n\nAI-assisted (Claude Code).\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
"is_bot": false,
"headline": "feat(core): real session capture + Resume Contract 1.0 (fixes hollow …",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-21T01:40:00Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "33f46dcbfb1ab6c02d5d3e3b5744ad7a0fec4638",
"body": "The docs site moved to its own subdomain (docs.skillerr.com) in an earlier\nchange, but this repo's own references to the canonical docs URL were never\nupdated to match — README, FAQ, TRANSPARENCY, WHAT-IS-VERIFIABLE, ROADMAP,\nand the synced npm README all still pointed at www.skillerr.com/docs/.\npackages/skillerr/README.md regenerated via scripts/sync-npm-readme.mjs.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
"is_bot": false,
"headline": "docs: update stale skillerr.com/docs URLs to docs.skillerr.com",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-21T01:25:15Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "24e26037bf80adbf3583aec341f1418016c68fff",
"body": "feat(core): verify() unified entry point + generateSBOM (CycloneDX)",
"is_bot": false,
"headline": "Merge pull request #56 from dot-skill/feature/verify-and-sbom",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-20T19:53:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "125a02976b99bdb909e184af502aa70960578c27",
"body": "verify(digest, evidence): the keystone a CLI verify command and the\nregistry's /api/verify are meant to sit on top of. Composes\nverifySignature + verifyInclusion directly (both self-contained, checked\nhere for real) with caller-supplied pre-checked anchored/revocation\nresults — a Commitment's real v\n[…]\ng\neverything merged to develop so far, not yet published).\n\nAI-assisted (Claude Code).\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
"is_bot": false,
"headline": "feat(core): verify() unified entry point + generateSBOM (CycloneDX)",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-20T19:51:21Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a5e98e7163877d6d4493cbc9caecf49db0a7a6c5",
"body": "feat(core): continuity surface (isContinuity/openContinuity/resumePreview)",
"is_bot": false,
"headline": "Merge pull request #55 from dot-skill/feature/continuity-surface",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-20T19:43:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a39a4f4463d94b6b10fc39f0ae90ec14d25dc923",
"body": "…view)\n\nResume Contract 1.0 (RFC 0009): built directly on real continuity-profile\ndata (manifest.compile_profile, provenance.journey — an already-typed\nJourneyProvenance, not unknown — and knowledge), not on any invented file\nconvention. isContinuity is sufficient on its own since mint requires\ncomp\n[…]\ntry-coupling.mjs -> check-core-registry-independence.mjs).\n\nAI-assisted (Claude Code).\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
"is_bot": false,
"headline": "feat(core): continuity surface (isContinuity/openContinuity/resumePre…",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-20T19:39:31Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "39815546c686b042b8c01526086a1264e4b5e4ae",
"body": "feat(core): trust-spine adapter layer + Merkle-log spine, relicense to Apache-2.0",
"is_bot": false,
"headline": "Merge pull request #54 from dot-skill/protocol/trust-spine",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-20T19:28:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5e148be660e78268346594012fe0cc402fd691c9",
"body": "Signed-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>\n\n# Conflicts:\n#\tpackages/core/package.json",
"is_bot": false,
"headline": "Merge remote-tracking branch 'origin/develop' into protocol/trust-spine",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-20T19:25:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f74e6a43f2fe0869ed5e40f7b65a9bf066d88a3d",
"body": "feat(core): deterministic secret scrubber (Phase 1)",
"is_bot": false,
"headline": "Merge pull request #53 from dot-skill/feature/deterministic-scrub",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-20T19:23:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2501eeebba87052bf4d2be2f23c79ca3b37c4c5b",
"body": "…ency)\n\nThe one primitive in spec/CONTRACT.md's frozen contract with nothing to\nadapt from — no Merkle-tree/transparency-log concept existed anywhere in\nthis codebase before this (packages/registry is an unrelated flat\nappend-only log). A from-scratch RFC 6962-style implementation (Certificate\nTrans\n[…]\nests, 0 failures), core-registry-independence check clean.\n\nAI-assisted (Claude Code).\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
"is_bot": false,
"headline": "feat(core): Merkle-log spine (buildLeaf/verifyInclusion/verifyConsist…",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-20T19:14:11Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d87cf4f46ac05b10fb4830ff25b5976d2058273e",
"body": "Sole-author decision (no third-party contributor consent needed to\nrelicense past contributions), resolving the disagreement spec/CONTRACT.md\nflagged between this repo's actual MIT license and the frozen contract's\nApache-2.0 requirement. Root LICENSE, every package's LICENSE and\npackage.json, and e\n[…]\nose version numbers, as with any relicense —\nthis governs the code going forward only.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
"is_bot": false,
"headline": "license: relicense to Apache-2.0",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-20T19:09:19Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "6808d9ceb5d1ac3a9724605a6d2ed4ff047c2a15",
"body": "Status table in spec/CONTRACT.md now reflects seal/openSealed/sign/\nverifySignature/Anchor+RekorAnchor/CapabilitySchema/evaluateReleaseProfile\nas shipped (with their known, honestly-documented gaps), and\nINTEGRATION_NOTES.md has the handshake entry for skillerr-registry to read\nonce this branch releases.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
"is_bot": false,
"headline": "docs(spec): mark adapter layer shipped, update integration handshake",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-20T18:43:41Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "804665cda5f97603b4dd3912bec606af9139920e",
"body": "Thin, real wrappers matching spec/CONTRACT.md's Section 3a shape, each\ndelegating to an existing, already-tested primitive:\n\n- seal()/openSealed(): async/Buffer wrappers over packSkill/unpackSkill,\n round-tripping through unpackSkill so the returned manifest can never\n drift from what's actually e\n[…]\nests, 0 failures),\ncore-registry-independence check clean.\n\nAI-assisted (Claude Code).\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
"is_bot": false,
"headline": "feat(core): adapter layer for the frozen registry contract",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-20T18:42:22Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "75417122cf33309fe6f9474967a11fc865697138",
"body": "New scripts/check-core-registry-independence.mjs, run in CI: fails if\npackages/core ever gains a dependency on skillerr-registry, imports it, or\ncalls its API directly. Deliberately narrow — the existing\nANCHOR_PREDICATE_TYPE (a legitimate in-toto predicate-type namespace URI\nusing the skillerr.com domain as an identifier, not a live endpoint) is\nnot flagged.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
"is_bot": false,
"headline": "ci: enforce @skillerr/core never depends on the registry",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-20T18:33:23Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "9b3ba8f518109b241af39fbd7bc7eeb545e71265",
"body": "spec/CONTRACT.md is the source of truth for the @skillerr/core public API\nand registry wire protocol both sides build against, plus a status table\ntracking what already exists in this repo versus what's still needed.\nINTEGRATION_NOTES.md is the only handshake to skillerr-registry: version\nbumps get noted there, this repo never reaches into the registry directly.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
"is_bot": false,
"headline": "docs(spec): freeze core<->registry contract, add integration handshake",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-20T18:33:16Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "3c96fafc3698999c60e1d012910656f56b7d5b6c",
"body": "…port, sealed provenance/redaction.json\n\nFour confidence-ordered layers (opt-in env-value exact match, known-format\nvendor rules, project custom rules, entropy-based flagging) with a pinned\nrules_version/rules_digest so identical input always reproduces an\nidentical report, no LLM or network anywher\n[…]\nd in docs/ROADMAP.md as architected-for but not\nyet built.\n\nAI-assisted (Claude Code).\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
"is_bot": false,
"headline": "Add deterministic secret scrubber (Phase 1): skill scrub, RedactionRe…",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-20T14:13:08Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a578ea6c72ddd593cc82ffde71a5720c0bdf2ff1",
"body": null,
"is_bot": false,
"headline": "Sync develop with main after 1.5.2 release",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-18T14:43:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7052171538c536b45f831723fdbf2f3c7b391ddd",
"body": "* Add git-flow branching model: develop + release/* + hotfix/* only into main (#51)\n\nmain now only accepts merges from release/* or hotfix/* branches, enforced\nby a new required CI check (enforce-branch-flow.yml) plus branch\nprotection requiring it. Feature/task work branches off develop and PRs\nbac\n[…]\npic.com>\n\n* Release 1.5.2: lockstep version bump for the branch-flow change\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Sonnet 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Release 1.5.2: git-flow branching model (#52)",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-18T14:41:36Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1d8353c7883be1a71aec4b51e6c1befa3111340e",
"body": "…o main (#51)\n\nmain now only accepts merges from release/* or hotfix/* branches, enforced\nby a new required CI check (enforce-branch-flow.yml) plus branch\nprotection requiring it. Feature/task work branches off develop and PRs\nback into develop instead. CI now also runs on push to develop for fast\nintegration feedback. Documented in CONTRIBUTING.md's new \"Branch flow\"\nsection.\n\nCo-authored-by: Claude Sonnet 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Add git-flow branching model: develop + release/* + hotfix/* only int…",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-18T14:28:29Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "d9cebc1d8bfca4017c95a8641b23317ba87f4d67",
"body": "Several docs (PROTOCOL.md's opening status line, FAQ.md, README.md,\nGOVERNANCE.md, CONTRIBUTING.md) stated the protocol spec version\n(\"1.0.0 (Stable)\", correct and intentionally static) with no package/CLI\nversion anywhere nearby, reading as if the whole project were frozen at\n1.0.0. Every one now s\n[…]\nackage version in the same file, so\nthis can't silently recur. Patch bump per real semver discipline: this is\na doc fix, not new functionality.\n\nCo-authored-by: Claude Sonnet 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Fix stale-reading protocol-version-only mentions (1.5.1) (#50)",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-18T13:58:49Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1738c260f39e77acf079104c519fc3ca4a23f9fd",
"body": "… (1.5.0) (#49)\n\n* External-agent bug sweep: transparency, mint validation, trust labels (1.5.0)\n\nFixes several real bugs surfaced by testing the CLI with an external AI\nagent: Rekor anchors were submitted as a hash-only entry kind so the\nsubject-bearing statement was never actually retrievable from\n[…]\nract,\nwired into contract-check's output as a separate schema_issues array.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Sonnet 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "External-agent bug sweep: transparency, mint validation, trust labels…",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-18T11:25:19Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "623d7dbd8ac3009037f439741480ce1f1bba910c",
"body": "…anup, drift check (#48)\n\nFixes a real bug: skill agent-guide's header printed the bare protocol\nspec version (\"v1.0.0\") unqualified, easy to misread as the CLI's own\nversion even though skillerr itself is well past that. Now labeled\nclearly (spec vX.Y.Z, skillerr CLI vA.B.C), and its content update\n[…]\ndocs/ROADMAP.md\nstill said \"seven RFCs... RFC 0007... have since shipped\", missing that\nthere are now eight RFCs and RFC 0008 has also shipped.\n\nCo-authored-by: Claude Sonnet 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Consistency sweep: agent-guide version clarity, CLI-FLOW.md, wiki cle…",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-18T05:11:24Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "119e7e4b8f2fc8e74f5d5b38b9e0dde24352b747",
"body": "…provenance URL (#47)\n\n* Frictionless flow (code): ingest->release bridge + zero-setup public provenance URL\n\nPHASE 1 (ingest -> release bridge):\n- New materializeSkillIntoWorkspace() in @skillerr/workspace: `skill load\n <file.skill> --into <dir>` (or plain `skill load` inside a workspace)\n now wr\n[…]\nctive on macOS/Linux); only the test assertion is now\nplatform-conditional.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Frictionless flow (1.3.0): ingest→release bridge + zero-setup public …",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-17T18:26:03Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "ba4682eff1895c4954ac75ebb7c4c3a2a8dff69a",
"body": "…ust positioning (#46)\n\nLockstep version bump for both feature sets already merged to main this\ncycle: RFC 0008 (Agent Skills frontmatter fidelity, multi-skill discovery,\nexport-skill, verify-skill) and the cryptographic-trust-standard\npositioning (README/npm/docs). See CHANGELOG.md for the full summary.\n\nCo-authored-by: Claude Sonnet 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Release 1.2.0: Agent Skills ecosystem compatibility, cryptographic tr…",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-16T18:36:38Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "d098e7b2b74e58c42ed46213d3014321f2280b13",
"body": "Merging to main and shipping to npm have drifted out of sync repeatedly\nthis cycle, since publishing required a separate manual git tag push\nafter merge and that step is easy to forget. publish_one already skips\nany package whose current version is already on npm, so this is safe on\nevery merge, not\n[…]\nop (everything's already\npublished, the release already exists), just an extra CI run, so this\nwas a deliberate scope choice, not an oversight.\n\nCo-authored-by: Claude Sonnet 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Publish workflow: also trigger on every push to main (#45)",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-16T17:31:45Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "782732c489fdb1de2dbb8b649c7b398d7e041b77",
"body": "Elevates identity/authorship/provenance (content-addressed digests,\nEd25519 + Sigstore Fulcio, Rekor transparency log, verified vs\nself_reported claims) as the headline story on README and npm, with a\ncanonical trust ladder (Development -> Verified issuer -> Publicly\nanchored) now documented in-repo\n[…]\nerately no blockchain/nft/web3 keywords). Test count badge corrected\nto the real current 189. Docs/copy only, no runtime/protocol/wire changes.\n\nCo-authored-by: Claude Sonnet 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Position .skill as the cryptographic trust standard for AI skills (#44)",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-16T17:15:18Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "f73d0c72534992331c3d2c47d902d5e4f60555ff",
"body": "…rt-skill, verify-skill (#43)\n\nskill ingest now maps the complete Agent Skills frontmatter (license,\ncompatibility, nested/dotted metadata, allowed-tools) instead of parsing\nthen dropping most of it, and recognizes multi-skill folders via the same\nplugin-manifest and skills/<name>/ catalog conventio\n[…]\ne's configured title.\n\nAll additive, no wire-id/seal/container change. See RFC 0008 and\ndocs/AGENT-SKILLS.md for the full compatibility matrix.\n\nCo-authored-by: Claude Sonnet 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Agent Skills ecosystem compatibility: full frontmatter fidelity, expo…",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-15T19:23:17Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e567ea49ed9331f98ebb4cf78fa811ea4f5c6568",
"body": "…#42)\n\nDocs/messaging only, no runtime behavior changes.\n\nThe Agent Skills world has three layers: authoring (the spec/SKILL.md),\ndistribution (npx skills add, skills.sh), and trust/integrity, which\nskillerr owns and nothing else in the ecosystem provides today. Makes\nthat positioning explicit and c\n[…]\nest does NOT map yet (license, compatibility, allowed-tools:\nparsed then dropped; metadata: not parseable at all, the frontmatter\nreader is flat-key-only) -- a real, tracked gap, not silently ignored.",
"is_bot": false,
"headline": "Position skillerr as the trust layer for the Agent Skills ecosystem (…",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-15T17:40:23Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0f6186e0d46b5ba80e7d2636e34c929ce2a9077b",
"body": "…#41)\n\nDocs/governance/repo-meta only, no runtime behavior changes.\n\n- RFC 0007 (docs/rfcs/0007-subject-bearing-transparency-anchor.md):\n the design doc for the subject-bearing transparency anchors shipped\n in #40, marked Implemented since it describes the real merged code.\n\n- One canonical, in-re\n[…]\nlates already existed). README gets a short Contributing callout.\n ROADMAP.md now notes packages/skillerr/package.json as the version\n single source of truth and marks @skillerr/skill-score Preview.",
"is_bot": false,
"headline": "RFC 0007 and contribution-readiness (governance, RFC home, backlog) (…",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-15T17:24:01Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d773c827806775ac345ece159c502a7c8e7fba2c",
"body": "skill mint --transparency/--keyless now sign a minimal in-toto\nStatement naming the skill (skill_id + package_digest), instead of a\nbare digest. The resulting public Rekor entry is self-describing and\ncross-linkable: a stranger can see which skill an entry belongs to\nwithout already holding the pack\n[…]\nied against the real public Rekor log end to end, not just unit\n tests: https://search.sigstore.dev/?logIndex=2173022811\n\nVersion 1.1.0 (minor: additive new capability) across all packages,\nlockstep.",
"is_bot": false,
"headline": "Subject-bearing transparency anchors (RFC 0007) (#40)",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-15T17:02:53Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "80b4a8601256c60eee366f42b84a379151a4a4c0",
"body": "… (#39)\n\nNew one-line description across package.json (root, skillerr) and\nREADME's opening: \"Create, inspect, and run portable .skill packages\nfor AI agents — typed, sealed, and verifiable before anyone runs\nthem.\" Replaces vaguer framing that undersold the actual integrity/\ntrust-ladder story.\n\nAl\n[…]\ning \"container\" nicknames in prose (not the\nformal Container spec heading, which stays) -> \"package\"/\"format\",\nmatching the project's naming conventions (.skill is a format; an\ninstance is a package).",
"is_bot": false,
"headline": "Rewrite public messaging: lead with capability, fix terminology drift…",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-15T12:39:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0172063e5dff695e10ecabe357296f9f580a3962",
"body": "The three skill mint/skill keygen --help strings that referenced\ndocs/KEY-CEREMONY.md now point at the wiki, matching the move in\nthe previous release.\n\nVersion 1.0.3 across all packages, lockstep.",
"is_bot": false,
"headline": "Release 1.0.3: point shipped CLI help text at the wiki (#38)",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-15T02:06:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8e3caaf1fb89819702d41b0b67fa5d2cae1de1df",
"body": "Deep-reference/governance material (read occasionally, by depth) moves\nto github.com/dot-skill/skillerr/wiki so docs/ stays focused on\ntask-oriented guides read on every task. Rewrote every cross-reference\nacross ~20 files: links between the four moved pages/RFCs are now\nwiki-relative, links to docs\n[…]\n Threat Model's key-ceremony pointer said \"forthcoming\" and\n\"Phase 10\" for a doc and phase that had already shipped, and README.md\nhad two more docs/rfcs/ links the earlier version-bump passes missed.",
"is_bot": false,
"headline": "Move Key Ceremony, Naming, Threat Model, and RFCs to the wiki (#37)",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-15T01:55:14Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "af4b2e7b7c5465230ba7753f032977835f5d3b6c",
"body": "…Hub Releases (#36)\n\nskill agent-guide, skill --help, 5 schema $ids, a validate.ts error message,\nand skill keygen's trust-store setup snippet still said \"0.5\" after the\nprotocol version moved to 1.0.0. Found by testing the published CLI\nend-to-end rather than only grepping docs. The keygen snippet \n[…]\nkill verify-trust rejects.\n\nAlso adds a GitHub Release creation step to publish.yml so the repo's\nReleases page reflects what's actually published to npm.\n\nVersion 1.0.2 across all packages, lockstep.",
"is_bot": false,
"headline": "Fix leftover 0.5 strings from the protocol version bump; automate Git…",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-15T01:01:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7fba2712444f44b0300cc0dea0c9d97162479caf",
"body": "Protocol specification is now versioned 1.0.0 and marked Stable. The\nprevious maturity gate (Stable requires independent conforming\nruntimes beyond this reference implementation) is removed: a single,\nthoroughly-tested reference implementation (165 tests, an adversarial\nsecurity corpus, multi-OS/Nod\n[…]\nen Stable after two independent runtimes\" reference, including\nPROTOCOL.md's protocol/CLI compatibility table, AUTHORING-CONTRACT.md,\nWORKSPACE.md, and skillerr-com's roadmap/protocol/faq/index pages.",
"is_bot": false,
"headline": "release: protocol 1.0.0 (Stable), packages 1.0.1 (#35)",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T21:04:37Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "461090e8eb755956a0afcf71d4ae1aa95970afa1",
"body": "First stable release of the reference implementation. The public API\nacross all seven @skillerr/* packages (and the skillerr CLI) is now\nconsidered stable: breaking changes to exported functions, types, CLI\nflags, or the .skill container format land as a new major version.\n\nThis covers the reference\n[…]\nn every push. See docs/ROADMAP.md.\n\nAlso fixed a stale test-count badge in README.md (148 -> 165) missed\nin earlier version bumps this session.\n\nSee CHANGELOG.md for what's shipped as of this release.",
"is_bot": false,
"headline": "release: 1.0.0 -- stable public API (#34)",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T20:33:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "477e9948f234a51b94f6dbc0deadc8763c8cb851",
"body": "…G.md examples (#33)\n\nMINT.md's own \"Anchors\" section, the canonical doc for what mint\nactually does, only mentioned the local registry (skill registry) --\nno mention of --transparency or --keyless at all, despite both being\nreal mint-time flags. A reader following only this doc would have no\nidea e\n[…]\nclaimed CI runs on\n\"Node 20 and 22\" when the actual matrix is 22/24 (matching README.md).\nReplaced the hardcoded version with vX.Y.Z placeholder syntax so this\ndoesn't go stale again on every release.",
"is_bot": false,
"headline": "docs: content-polish pass -- MINT.md anchors section, stale PUBLISHIN…",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T20:11:41Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2152fd25941e497f2f1b95cbf8eee3a04436c428",
"body": "Found doing end-to-end verification of 0.9.9's license field against\na fresh npm install: license/license_url reached manifest/skill\ninspect's plain summary correctly, but never made it into TrustView --\nmeaning skill inspect --trust, skill verify-trust, assessClaims's\nself-reported list, and by ext\n[…]\nnspectTrustView, and added both to assessClaims's self-reported list\n-- never verified, same reasoning as every other self-reported field.\n\nLockstep version bump 0.9.9 -> 0.9.10 across all 7 packages.",
"is_bot": false,
"headline": "fix: license field never reached TrustView/assessClaims (0.9.10) (#32)",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T19:19:50Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6399a7e5c9645e05056e6106cd98331b3bac29ee",
"body": "manifest.license already existed in the type and JSON schema but was\ncompletely dormant -- never settable from SkillSource, never surfaced\nby any command, undocumented anywhere. Wired it up end to end:\nSkillSource.license/.license_url -> compileSkillSource/\ncompileRecipeToSkill (with a CompileOption\n[…]\ncommerce/payment/marketplace code lands in this repo -- the\nprotocol stays payment-agnostic, per docs/TRANSPARENCY.md's \"What this\nis not\".\n\nLockstep version bump 0.9.8 -> 0.9.9 across all 7 packages.",
"is_bot": false,
"headline": "feat: license/terms manifest slot, Phase F scoped down (0.9.9) (#31)",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T18:58:03Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d725348ea293dbcd0b02319abb2af0068da3b772",
"body": "docs/WHAT-IS-VERIFIABLE.md has always drawn a line in prose between\nwhat's cryptographically checked and what's merely self-reported --\nbut nothing stopped a UI or agent parsing TrustView's JSON from\ndisplaying a self-reported field (like agent.host) next to a\n\"verified\" badge, since both kinds of c\n[…]\nms (offline; anchors not re-verified) and\nskill verify-trust --claims (includes anchor verification results\nwhen present) both expose this.\n\nLockstep version bump 0.9.7 -> 0.9.8 across all 7 packages.",
"is_bot": false,
"headline": "feat: per-claim assurance model, assessClaims (0.9.8) (#30)",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T18:37:49Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f13174466efa8af5b47f4734a29842d37b755458",
"body": "The design already reads whatever ambient OIDC token the actual\ninvoking environment provides (CIContextProvider), with no special\nrelationship to dot-skill/skillerr's own CI — GitHub injects a fresh,\nrepo/workflow/ref-scoped token into any job with id-token: write,\nregardless of which repo that job\n[…]\nntity gets logged?\" section spelling this out, and\nreworded the \"what's shipped\" line so \"the same mechanism npm\ntrusted publishing uses\" can't be misread as \"this repo's own\ncredential specifically.\"",
"is_bot": false,
"headline": "docs: clarify whose identity --keyless actually binds (#29)",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T18:18:16Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a7432095b9cf481e11c279c8b44dc0006e010ee5",
"body": "skill mint --keyless adds a second, independent anchor\n(PermanenceAnchor { kind: \"keyless_identity\" }) alongside whatever the\ncontainer's own seal already is: an ephemeral, single-use keypair\nsigned by a Fulcio-issued certificate bound to the caller's OIDC\nidentity, then logged to Rekor exactly like\n[…]\ns own seal;\nwhat shipped is a separate additive anchor instead, to avoid\nconflating a pre-pinned-key trust mechanism with an ephemeral one.\n\nLockstep version bump 0.9.6 -> 0.9.7 across all 7 packages.",
"is_bot": false,
"headline": "feat: Fulcio keyless mint, CI-ambient path (0.9.7) (#28)",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T18:00:29Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a6cae4a85f72cb095e2722c0c6a2492a626202c5",
"body": "Neither the CLI nor the website's verify page should be able to say\n\"this is verified\" without also handing back a way to check that\nindependently. New rekorSearchUrl() in @skillerr/core builds a\nsearch.sigstore.dev link for a verified transparency_log anchor —\nundefined (not a guessed/broken link) \n[…]\nless/Fulcio\n as already shipped when it isn't (ROADMAP.md and\n WHAT-IS-VERIFIABLE.md already had this right; this doc alone was\n stale).\n\nLockstep version bump 0.9.5 -> 0.9.6 across all 7 packages.",
"is_bot": false,
"headline": "feat: independent Rekor verification link (0.9.6) (#27)",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T17:22:09Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a1cc58bd8c3397b5abdf4a953a078298fec4eb16",
"body": "…s (0.9.5) (#26)\n\nloadSchema() read JSON Schema files via new URL(relativePath,\nimport.meta.url) where relativePath came from a lookup object — a\nvariable, not a literal, at the call site. Bundlers that statically\ntrace file dependencies to decide what ships with a deployment (e.g.\nVercel's @vercel/\n[…]\n literal new URL(...) call; the\nschema JSON files themselves haven't moved.\n\nVersion bump: all 7 packages 0.9.4 -> 0.9.5 (lockstep), matching\nREADME/ROADMAP/THREAT-MODEL version strings and CHANGELOG.",
"is_bot": false,
"headline": "fix: make @skillerr/protocol schema paths traceable by static bundler…",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T17:08:12Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "295d96e329e557e42e53d914da91f5e29bccb31f",
"body": "feat: wire www.skillerr.com everywhere (0.9.4)",
"is_bot": false,
"headline": "Merge pull request #25 from dot-skill/feat/skillerr-com-domain",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T15:44:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f882227a7436da68465fc540fcb10784b803db8c",
"body": "www.skillerr.com is live on Vercel (docs under /docs/, root reserved\nfor a future product). Updates every dot-skill.github.io/skillerr-com\nreference across README.md, docs/*.md, examples/README.md,\npackages/skillerr/README.md, and every package.json's homepage field.\n\nReal user-facing bug fixed: skill --help's own footer was printing\nthe stale GitHub Pages docs URL to every CLI user.",
"is_bot": false,
"headline": "feat: wire www.skillerr.com everywhere (0.9.4)",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T15:37:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cd7b48b4f16d64c01c358ed1647f229eb84d00dd",
"body": "docs: fix stale transparency-log status + reframe remaining draft language",
"is_bot": false,
"headline": "Merge pull request #24 from dot-skill/docs/fix-stale-transparency-status",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T14:58:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "02f38bf16feef05bcdfb8349689627feb44eb4bb",
"body": "…guage\n\nWHAT-IS-VERIFIABLE.md still said public transparency logging was\n\"planned but not yet implemented\" and cited reference packages 0.8.0\n— both wrong since Phase E shipped Rekor anchoring last session. Adds\nthe real \"what's cryptographic and publicly checkable, if anchored\"\nsection, updates the\n[…]\nd\nthe same limitation-first \"draft\"/\"development\" framing already fixed\nin README.md — reframed both the same way (capability-first, RFC\nprocess named explicitly), consistent with 0.9.3's README pass.",
"is_bot": false,
"headline": "docs: fix stale transparency-log status + reframe remaining draft lan…",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T14:53:51Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "903e20b14851eb95d800362f2e65271750b2ced5",
"body": "docs: README content pass — reframe draft/dev-only signals (0.9.3)",
"is_bot": false,
"headline": "Merge pull request #23 from dot-skill/docs/readme-content-pass",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T14:47:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9aa6e5a8eca8f17a3c3242946affb0bbb1714c80",
"body": "The orange \"0.5.0 draft\" badge and a limitation-first sentence about\nthe default signing key read as \"unfinished project\" even though the\nunderlying facts are accurate and necessary disclosures. Reframed\nrather than removed or hidden — see CHANGELOG.md for the full\nreasoning, including why \"continuity draft\" mentions were left\nuntouched (real protocol vocabulary, not maturity signaling).",
"is_bot": false,
"headline": "docs: README content pass — reframe draft/dev-only signals (0.9.3)",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T14:44:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9941b97f04ab308605ccc0e84ea35fcc56456628",
"body": "docs: remove banner image from README (0.9.2)",
"is_bot": false,
"headline": "Merge pull request #22 from dot-skill/docs/remove-readme-banner",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T14:11:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "275a6386800926d57204f4f70d6938234ca58e9e",
"body": "Single mark image is the intended header, not a banner plus a mark.\nRoot README.md changed; packages/skillerr/README.md picks it up\nautomatically via scripts/sync-npm-readme.mjs.",
"is_bot": false,
"headline": "docs: remove banner image from README (0.9.2)",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T14:08:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "eb0fb2150a3e8f3b20ade2f00304aa6f890095b9",
"body": "fix(docs): structural fix for npm/GitHub README drift (0.9.1)",
"is_bot": false,
"headline": "Merge pull request #21 from dot-skill/fix/npm-readme-sync",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T13:38:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8e5f3ba50be190731ce690a8d15d8f4e8a156462",
"body": "…ep (0.9.1)\n\nThe npm README (packages/skillerr/README.md) and the GitHub README\n(README.md) were two independently hand-edited files with nothing\nforcing them to stay in sync. Every prior fix (0.7.1, 0.8.0) patched\none snapshot; the files drifted apart again the next time either was\nedited alone — w\n[…]\neting format\").\n\n144/148 -> 148/148 tests still passing (no test-suite behavior\nchanged, docs + build tooling only). npm run build && npm test &&\nnpm run test:examples && npm run pack:check all green.",
"is_bot": false,
"headline": "fix(docs): structural fix for npm/GitHub README drift + narration swe…",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T13:35:31Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "38478635b9524af491c95b297c75d0a408cc1842",
"body": "feat(core,cli): Phase E (partial) — Rekor transparency-log anchoring (0.9.0)",
"is_bot": false,
"headline": "Merge pull request #20 from dot-skill/phase-e/transparency-rekor",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T13:16:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c0beebec74b5036993c7b098fd9c923e93e546e9",
"body": "…(0.9.0)\n\nOptional public transparency-log anchoring, built on the official\n@sigstore/* client libraries rather than a hand-rolled Merkle-proof\nimplementation. See docs/TRANSPARENCY.md for what this proves and\ndoesn't.\n\n- skill mint --transparency [--rekor-url <url>]: after signing\n (requires --sig\n[…]\nI + website utility, Phase E2's per-claim\nassurance model. See ROADMAP.md.\n\n148/148 tests passing (was 141, +7 new). npm run build && npm test &&\nnpm run test:examples && npm run pack:check all green.",
"is_bot": false,
"headline": "feat(core,cli): Phase E (partial) — Rekor transparency-log anchoring …",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T13:13:47Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "77afc381f3b411158b17d6e8f8021e76b2ae427f",
"body": "docs(cli): Phase D — trust/threat/verifiability docs (0.8.1)",
"is_bot": false,
"headline": "Merge pull request #19 from dot-skill/phase-d/trust-threat-docs",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T11:21:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8e45a1bcc5a997a99173a06ef84db21b8f93078a",
"body": "- docs/TRUST-MODEL.md: plain-language explanation of the four\n trust_state values, explicit that development/self_reported are not\n safe to run blindly, why SKILL_HOST alone is self_reported, why the\n bundled key is dev-only, and exactly when execute refuses.\n- docs/WHAT-IS-VERIFIABLE.md: attribu\n[…]\n, everything else\n along for versioning consistency).\n\n141/141 tests still passing (docs + one additive JSON field, no\nbehavior changes). npm run build && npm test && npm run test:examples\nall green.",
"is_bot": false,
"headline": "docs(cli): Phase D — trust/threat/verifiability docs (0.8.1)",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T11:19:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8d39b919ab7ed654c0f2e7296e00950128fce2a1",
"body": "docs: Phase C — resolve the tri-naming (docs/NAMING.md)",
"is_bot": false,
"headline": "Merge pull request #18 from dot-skill/phase-c/naming",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T11:04:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6d5705dfff7ffb8b40aeff70c16b7b502008ae5c",
"body": "Five strings mean five different things across this codebase (Open\n.skill Protocol, .skill, dot-skill, @skillerr/*, skillerr) and nothing\npreviously said so in one place. Adds docs/NAMING.md as the single\nreference, linked from README. Explicitly does not change any wire\nidentifier, media type, extension, or package name — pure\ndocumentation, consistent with what the protocol-first framing work\nearlier this cycle already established in practice.",
"is_bot": false,
"headline": "docs: Phase C — resolve the tri-naming (docs/NAMING.md)",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T11:02:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5c2f6daeb1a5ed5ed3d8718401c6def95480d3bd",
"body": "fix(core,cli): Phase B — first-run polish + lockstep versions (0.8.0)",
"is_bot": false,
"headline": "Merge pull request #17 from dot-skill/phase-b/first-run-polish",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T10:58:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "112edd03c0fcadc74fa1f111d05db09230639a03",
"body": "- Register ajv-formats so validate/inspect --trust/score stop printing\n \"unknown format \\\"date-time\\\" ignored\" noise (ajv-formats' CJS default\n export needed the documented .default cast workaround for NodeNext\n without esModuleInterop — see the comment in validate.ts).\n- skill score --emit witho\n[…]\nned to 0.8.0,\n every internal @skillerr/* dependency range updated to match.\n\n138 -> 141 tests (3 new regressions). npm run build && npm test &&\nnpm run test:examples && npm run pack:check all green.",
"is_bot": false,
"headline": "fix(core,cli): Phase B — first-run polish + lockstep versions (0.8.0)",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T10:55:36Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "465a7933982ad7ce4d2d6dc1824550be2b37c8ac",
"body": "fix(cli): Phase A — launch blockers (ingest digest, score fallback)",
"is_bot": false,
"headline": "Merge pull request #16 from dot-skill/phase-a/launch-blockers",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T10:40:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2995902e2324315da489d20c16c4e07afb8158b0",
"body": "1. skill ingest printed a stale package_digest: compileSkillSource\n finalizes the manifest before resources/assets get merged into\n compiled.files, and packSkill's internal re-finalization (which\n produces the real, correct digest) was discarded — only the bytes\n were kept. Re-finalize the m\n[…]\nxpected behavior (see\n docs/evaluate-and-score.md's \"gracefully degrades\" claim, which this\n ok:false contradicted in practice). Now ok:true, scored:false, with\n a notice field instead of error.",
"is_bot": false,
"headline": "fix(cli): Phase A — truthful ingest digest, graceful score fallback",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T10:38:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8b616a3d1b5f008421192bef71abd0fc6b5e2827",
"body": "release: 0.7.1 — republish with fixed READMEs",
"is_bot": false,
"headline": "Merge pull request #15 from dot-skill/release/0.7.1",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T09:45:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ca79b3c277f0a8349469873f3bb6b7adfb336a53",
"body": "npm freezes a package's README at publish time; the protocol-first\ntitle fix and stale-trust-claim fix from the previous commit landed\nin git after 0.7.0 was already on the registry, so npmjs.com was\nstill showing the old README. Patch bump for just the three packages\nwhose README actually changed (skillerr, core, runtime) — their\nexisting ^0.7.0 internal dependency ranges already resolve to 0.7.1\nvia caret, no other package needs a version bump.",
"is_bot": false,
"headline": "release: 0.7.1 — republish skillerr/core/runtime with the fixed READMEs",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-14T09:43:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "713e6011f51c130b40b011926d2118cd26ced7c2",
"body": "…trust-accuracy\n\ndocs: protocol-first README titles + fix stale trust/version claims",
"is_bot": false,
"headline": "Merge pull request #14 from dot-skill/docs/readme-protocol-first-and-…",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-13T23:43:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cd97578e8a978f36cfe28f5c188d945da503be35",
"body": "Titles led with \"Skillerr\" as a brand; it's the package/CLI name, not\nthe project identity — same protocol-first framing already applied to\nthe site. Drops the redundant centered brand tagline, converts\nbrand-noun prose (\"point your AI at Skillerr\") to package-name\nreferences in code font, and adds \n[…]\nccurate since the Ed25519 configured-signer work (KEY-CEREMONY.md);\na configured signer key mints as verified_issuer. And updates the\nroot README's \"Reference CLI @ 0.6.x\" to the just-published 0.7.0.",
"is_bot": false,
"headline": "docs: protocol-first README titles + fix stale trust/version claims",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-13T23:41:14Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5e9b521d22026571ff0f529fde085aec45e0c3cf",
"body": "release: 0.7.0 — first real publish since 0.6.0",
"is_bot": false,
"headline": "Merge pull request #13 from dot-skill/release/0.7.0",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-13T23:21:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f2f4df168a3793fb119954be5c851ffc67337d0a",
"body": "…nce 0.6.0\n\n@skillerr/protocol, core, runtime, registry, workspace, and cli were\npublished once at 0.6.0 and never again — every commit since (all of\nTier 0-4 security hardening and Phases 1-10: ingest, eval, mint w/\nreal Ed25519 signer, trust store, permission grammar, JSON Schemas,\nresources seman\n[…]\nper to\n0.7.0 and updates every internal ^0.6.0 dependency range to match\n(npm's caret range on 0.x versions doesn't span minor bumps, so this\nis required for install resolution, not just bookkeeping).",
"is_bot": false,
"headline": "release: 0.7.0 — publish the reference packages for the first time si…",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-13T23:19:26Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c269269c5407eb0a4ce9051b25cdc26b61e7ffd7",
"body": "fix(cli): skill mint <file> works standalone, no workspace required",
"is_bot": false,
"headline": "Merge pull request #11 from dot-skill/fix/mint-standalone-file",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-13T22:51:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d2e2e9f32b881026dc211768aa75d161e7fcc94d",
"body": "`skill mint` already accepted an explicit .skill file argument\n(`rest.find(a => a.endsWith(\".skill\"))`), but called `requireWorkspace()`\nunconditionally regardless — so pointing it at an arbitrary file (e.g.\n`skill pack <source.json>` output, never touched by `skill init`) failed\nwith \"Not a skill w\n[…]\nd25519 signer, no `skill init` anywhere in\nthe temp dir). Full suite: 136/136 passing.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
"is_bot": false,
"headline": "fix(cli): skill mint <file> works standalone, no workspace required",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-13T22:50:06Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "060dabda165de822c8a9ae7140e01e8a8309169c",
"body": "docs: make copy-paste AI prompts directive, not hedged",
"is_bot": false,
"headline": "Merge pull request #10 from dot-skill/docs/directive-prompts",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-13T22:31:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2fcb64f3164d65fdf040ffb0802e22a9d65080cb",
"body": "\"Install skillerr if needed (npm i -g skillerr)\" asks the agent reading\nit to infer both whether an install is needed and how to check — an\nagent unfamiliar with this specific package has no strong signal to act\non a parenthetical aside. Rewrote the two headline on-ramp prompts\n(create-from-chat, co\n[…]\nsion || npm i -g skillerr` for the same\ncheck-before-install pattern, for consistency.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
"is_bot": false,
"headline": "docs: make copy-paste AI prompts directive, not hedged",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-13T22:30:53Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "905ccb51b0fd36b24ab9f7f03cae1b62fbcd6d24",
"body": "Phase 7: README overhaul + CLI banner + docs polish",
"is_bot": false,
"headline": "Merge pull request #9 from dot-skill/feature/phase-7-docs-polish",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-13T18:43:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c8ff527adbeabebc54d0c9aeed74f2a07d62068a",
"body": "README hero now leads with the pitch, the convert-on-ramp, and a sealed-\npackage advantage table before install/prompts, per the ground rule's\nprescribed order:\n\n- One-liner: \"The integrity + evaluation layer for AI skills. Your\n SKILL.md still works — .skill seals it, scores it, and makes it\n por\n[…]\non or URL drift found across skillerr,\nskill-score, and skillerr-com during this pass.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
"is_bot": false,
"headline": "docs(readme,cli): Phase 7 — README overhaul + CLI banner + docs polish",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-13T18:42:01Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "49a9421f3d941d197189a9c5f8b0541621eb11e3",
"body": "fix: repair CI — npm ci EUSAGE + brand job non-determinism",
"is_bot": false,
"headline": "Merge pull request #8 from dot-skill/fix/ci-npm-ci-and-brand-determinism",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-13T18:39:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a073c4becd27a9a0389387518797c0851bbdac00",
"body": "…ase 3\n\nCI has been failing on every push/PR since the Phase 6 merge and I never\nactually checked GitHub Actions status after any of the merges this\nsession — only ran tests locally, which didn't reproduce either failure\nmode. Both root causes:\n\n1. packages/cli/package.json declared @skillerr/skill-\n[…]\nly: `npm ci` (exact CI command) now succeeds; full build +\ntest suite green (135/135).\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
"is_bot": false,
"headline": "fix(ci): repair main branch CI — broken since Phase 6, worse since Ph…",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-13T18:38:32Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "92e19541bed964bc83444257568749eea5442fd6",
"body": "Phase 5: skillerr-authoring SKILL.md (the front door)",
"is_bot": false,
"headline": "Merge pull request #7 from dot-skill/feature/phase-5-authoring",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-13T18:24:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4dda65d3d6cff28462694f868bdc71163991f0b0",
"body": "Distributes skillerr *as* a skill: examples/skillerr-authoring/SKILL.md\nwalks an agent through interview -> contract-init -> fill .skill/\ncontract.json -> contract-check -> propose -> (optional) skill eval ->\nhuman review -> compile --approve --mint, in skill-creator's\nexplain-the-why tone rather th\n[…]\nDME.md (\"Create a skill from this chat\" section) and\ndocs/AGENT.md (\"Create\" section).\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
"is_bot": false,
"headline": "docs: Phase 5 — skillerr-authoring SKILL.md (the front door)",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-13T18:23:52Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1e8af87eff7d35da0edb9d0b52495a3efaa337f3",
"body": "Phase 4: bundled-script/progressive-disclosure semantics + exec deny-by-default fix",
"is_bot": false,
"headline": "Merge pull request #6 from dot-skill/feature/phase-4-resources",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-13T18:19:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ee8881362b9904478ed341b61f453dc8deab3f99",
"body": "…mantics\n\nDocuments the most common skill-creator pattern (bundle a helper script,\nsplit large reference material) and, in the process of writing that\ndocumentation accurately, found and fixed a real security gap: exec-class\ncapabilities had no deny-by-default gate at all.\n\n- packages/runtime/src/in\n[…]\nll suite: 135/135 passing across all 6 workspaces; test:examples and\npack:check green.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
"is_bot": false,
"headline": "fix(runtime),docs: Phase 4 — bundled-script/progressive-disclosure se…",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-13T18:18:32Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "cfebd8acf53f708feac0361f1e85ef7a168300b2",
"body": "Phase 3: wire @skillerr/skill-score in",
"is_bot": false,
"headline": "Merge pull request #5 from dot-skill/feature/phase-3-skill-score",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-13T18:08:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "822f52c7d9d300497e808d28db66e4f4a8cc3e7a",
"body": "Turns eval output into a portable, sealed quality-score receipt. The\nscorer stays a separate, independently-versioned package (its formula,\nweights, and gate caps are untouched) — this only builds the bridge and\nreserves the container slot, per the architecture note in the original\naudit (\"skill-sco\n[…]\nskill/skill-score renames the package scope to\n@skillerr/skill-score (already merged).\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
"is_bot": false,
"headline": "feat(cli,core): Phase 3 — wire @skillerr/skill-score in",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-13T18:07:19Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "57972688efcb28bb16a05d9b1d5e8fd48b27d94a",
"body": "Phase 2: native eval/benchmark loop",
"is_bot": false,
"headline": "Merge pull request #4 from dot-skill/feature/phase-2-eval-benchmark",
"author_name": "bharatdudeja13-cmd",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-13T17:49:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "86f0b8e12d0e1147746ea3a66ea68b2c794a3786",
"body": "A .skill can now be run and measured, not just structurally validated —\nthe native counterpart to skill-creator's test-prompt-and-grade loop.\n\n- protocol: SkillContract.evals? (optional, unlike every other contract\n field — not required for either compile profile) with EvalCase\n {id, prompt, asser\n[…]\nked bytes. Full suite:\n 126/126 passing across all 6 workspaces; test:examples green.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
"is_bot": false,
"headline": "feat(core,workspace,cli): Phase 2 — native eval/benchmark loop",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-13T17:45:21Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1f3ef0d704cf32c5385bd792fd1eae4c2731536e",
"body": "…mark\n\nOne master SVG traced from the real logo, a reproducible build script, and\na completed icon-slot container convention — replacing ~7 duplicated PNG\ncopies with no master vector.\n\n- assets/source/dot-skill-official.png: the official reference mark\n (supplied by the brand owner), kept permanen\n[…]\nple-touch-icon, and OG/Twitter image meta\n tags wired into docs/.vitepress/config.ts.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
"is_bot": false,
"headline": "feat(brand): Phase 6 — single-source branding from the real official …",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-13T17:30:06Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "47e331a0b4495f2f7a4957d6f4a0554e0ece9891",
"body": "The headline on-ramp: an existing skill-creator-style folder (SKILL.md +\noptional scripts/, references/, assets/, evals/evals.json) becomes a\nsealed, typed .skill in one command. Distinct from the existing lossy\nto-skill-md export (that's the reverse adapter; markdown is never the\nsource of truth). \n[…]\n\n all get the copy-paste prompt, docs/ROADMAP.md moves the round-trip item\n to done.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
"is_bot": false,
"headline": "feat(core,cli): Phase 1 — SKILL.md -> .skill ingest (skill ingest)",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-13T17:27:07Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "6879744d80ad3ab8dae49843f8bc034482905105",
"body": "Implements RFC 0001 (PROTO-2) for real, replacing the \"spec-only\" status\nfrom the Tier 4 RFC batch. The public-dev HMAC path is completely\nunchanged (still the zero-config local default, still hard-capped at\ntrust_state=development) — this adds an alternative, opt-in path so\nverified_issuer can mean\n[…]\n) + 1 adversarial.test.ts case. Full\n suite: 110/110 passing across all 6 workspaces.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
"is_bot": false,
"headline": "feat(core,cli): Phase 10 — pluggable Ed25519 issuer signer + trust store",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-13T17:07:02Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "7b5309e960b75051d0e43e5863b55dcfef08f54c",
"body": "…ecklist\n\nCloses out the original task's required final deliverable: every\nsilent-fallback instance found during the BUG-3 sweep with its disposition\n(fixed vs. intentional-and-documented vs. open-RFC), plus a checklist\nmapping every SEC-*/PROTO-* item to the test file or spec section that\nproves it holds.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nSigned-off-by: Bharat Dudeja <bharat.dudeja13@gmail.com>",
"is_bot": false,
"headline": "docs: Tier 0-4 final summary — BUG-3 disposition table + SEC/PROTO ch…",
"author_name": "Bharat Dudeja",
"author_login": "bharatdudeja13-cmd",
"committed_at": "2026-07-13T16:50:11Z",
"body_truncated": false,
"is_coding_agent": true
}
],
"releases_count": 22,
"commits_last_year": 153,
"latest_release_at": "2026-07-15T17:04:33Z",
"latest_release_tag": "v1.1.0",
"releases_from_tags": false,
"days_since_last_push": 6,
"active_weeks_last_year": 3,
"days_since_latest_release": 12,
"mean_days_between_releases": 0.1
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": true,
"health_percentage": 87,
"has_issue_template": false,
"has_code_of_conduct": true,
"has_pull_request_template": true
},
"ecosystem": {
"packages": [
{
"name": "@skillerr/cli",
"exists": true,
"license": "Apache-2.0",
"keywords": [
"skill",
"skillerr",
".skill",
"ai-agents",
"agent-skills",
"cli",
"protocol"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@skillerr/cli",
"is_deprecated": false,
"latest_version": "1.7.0",
"repository_url": "https://github.com/dot-skill/skillerr",
"versions_count": 26,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 4471,
"first_published_at": "2026-07-13T01:21:29.050000Z",
"latest_published_at": "2026-07-21T03:19:15.292000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 6
},
{
"name": "@skillerr/core",
"exists": true,
"license": "Apache-2.0",
"keywords": [
"skill",
".skill",
"ai-agents",
"agent-skills",
"compile",
"mint"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@skillerr/core",
"is_deprecated": false,
"latest_version": "1.7.0",
"repository_url": "https://github.com/dot-skill/skillerr",
"versions_count": 27,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 5762,
"first_published_at": "2026-07-13T01:21:11.528000Z",
"latest_published_at": "2026-07-21T03:18:53.859000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 6
},
{
"name": "@skillerr/runtime",
"exists": true,
"license": "Apache-2.0",
"keywords": [
"skill",
".skill",
"ai-agents",
"agent-skills",
"runtime",
"dry-run"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@skillerr/runtime",
"is_deprecated": false,
"latest_version": "1.7.0",
"repository_url": "https://github.com/dot-skill/skillerr",
"versions_count": 27,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 4895,
"first_published_at": "2026-07-13T01:21:15.891000Z",
"latest_published_at": "2026-07-21T03:18:59.066000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 6
},
{
"name": "@skillerr/protocol",
"exists": true,
"license": "Apache-2.0",
"keywords": [
"skill",
".skill",
"ai-agents",
"agent-skills",
"protocol",
"types"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@skillerr/protocol",
"is_deprecated": false,
"latest_version": "1.7.0",
"repository_url": "https://github.com/dot-skill/skillerr",
"versions_count": 26,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 5720,
"first_published_at": "2026-07-13T01:21:06.729000Z",
"latest_published_at": "2026-07-21T03:18:46.744000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 6
},
{
"name": "@skillerr/registry",
"exists": true,
"license": "Apache-2.0",
"keywords": [
"skill",
".skill",
"ai-agents",
"transparency-log",
"registry"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@skillerr/registry",
"is_deprecated": false,
"latest_version": "1.7.0",
"repository_url": "https://github.com/dot-skill/skillerr",
"versions_count": 26,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 4617,
"first_published_at": "2026-07-13T01:21:19.559000Z",
"latest_published_at": "2026-07-21T03:19:03.986000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 6
},
{
"name": "skillerr",
"exists": true,
"license": "Apache-2.0",
"keywords": [
"skill",
"skillerr",
".skill",
"ai-agents",
"agent-skills",
"cli",
"protocol",
"portable",
"inspectable",
"provenance",
"signing",
"ed25519",
"sigstore",
"attestation",
"transparency-log",
"content-addressed",
"supply-chain",
"verifiable",
"trust"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/skillerr",
"is_deprecated": false,
"latest_version": "1.7.0",
"repository_url": "https://github.com/dot-skill/skillerr",
"versions_count": 31,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 5224,
"first_published_at": "2026-07-13T00:49:58.464000Z",
"latest_published_at": "2026-07-21T03:19:19.233000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 6
},
{
"name": "@skillerr/workspace",
"exists": true,
"license": "Apache-2.0",
"keywords": [
"skill",
".skill",
"ai-agents",
"agent-skills",
"workspace",
"continuity"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@skillerr/workspace",
"is_deprecated": false,
"latest_version": "1.7.0",
"repository_url": "https://github.com/dot-skill/skillerr",
"versions_count": 26,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 4652,
"first_published_at": "2026-07-13T01:21:23.501000Z",
"latest_published_at": "2026-07-21T03:19:09.276000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 6
}
]
},
"popularity": {
"forks": 0,
"stars": 3,
"watchers": 1,
"fork_history": {
"days": [],
"complete": true,
"collected": 0,
"total_forks": 0
},
"star_history": null,
"open_issues_and_prs": 2
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [
"examples"
],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [
"packages/cli/tsconfig.json",
"packages/core/tsconfig.json",
"packages/protocol/tsconfig.json",
"packages/registry/tsconfig.json",
"packages/runtime/tsconfig.json",
"packages/workspace/tsconfig.json"
],
"toolchain_manifests": [],
"largest_source_bytes": 114102,
"source_files_sampled": 68,
"oversized_source_files": 2,
"agent_instruction_files": [
"docs/AGENT.md"
],
"agent_instruction_max_bytes": 8517
},
"dependencies": {
"manifests": [
"package.json"
],
"advisories": {
"error": null,
"scope": "published_package",
"source": "osv",
"findings": [],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 74,
"malicious_count": 0,
"assessed_package": "npm:skillerr@1.7.0",
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"npm"
],
"dependencies": [
{
"name": "@skillerr/core",
"manifest": "packages/cli/package.json",
"ecosystem": "npm",
"version_constraint": "^1.7.0"
},
{
"name": "@skillerr/protocol",
"manifest": "packages/cli/package.json",
"ecosystem": "npm",
"version_constraint": "^1.7.0"
},
{
"name": "@skillerr/registry",
"manifest": "packages/cli/package.json",
"ecosystem": "npm",
"version_constraint": "^1.7.0"
},
{
"name": "@skillerr/runtime",
"manifest": "packages/cli/package.json",
"ecosystem": "npm",
"version_constraint": "^1.7.0"
},
{
"name": "@skillerr/workspace",
"manifest": "packages/cli/package.json",
"ecosystem": "npm",
"version_constraint": "^1.7.0"
},
{
"name": "@sigstore/bundle",
"manifest": "packages/core/package.json",
"ecosystem": "npm",
"version_constraint": "^5.0.0"
},
{
"name": "@sigstore/core",
"manifest": "packages/core/package.json",
"ecosystem": "npm",
"version_constraint": "^4.0.1"
},
{
"name": "@sigstore/sign",
"manifest": "packages/core/package.json",
"ecosystem": "npm",
"version_constraint": "^5.0.0"
},
{
"name": "@sigstore/tuf",
"manifest": "packages/core/package.json",
"ecosystem": "npm",
"version_constraint": "^4.0.2"
},
{
"name": "@sigstore/verify",
"manifest": "packages/core/package.json",
"ecosystem": "npm",
"version_constraint": "^4.1.0"
},
{
"name": "@skillerr/protocol",
"manifest": "packages/core/package.json",
"ecosystem": "npm",
"version_constraint": "^1.7.0"
},
{
"name": "ajv",
"manifest": "packages/core/package.json",
"ecosystem": "npm",
"version_constraint": "^8.17.1"
},
{
"name": "ajv-formats",
"manifest": "packages/core/package.json",
"ecosystem": "npm",
"version_constraint": "^3.0.1"
},
{
"name": "fflate",
"manifest": "packages/core/package.json",
"ecosystem": "npm",
"version_constraint": "^0.8.2"
},
{
"name": "@skillerr/core",
"manifest": "packages/registry/package.json",
"ecosystem": "npm",
"version_constraint": "^1.7.0"
},
{
"name": "@skillerr/protocol",
"manifest": "packages/registry/package.json",
"ecosystem": "npm",
"version_constraint": "^1.7.0"
},
{
"name": "@skillerr/core",
"manifest": "packages/runtime/package.json",
"ecosystem": "npm",
"version_constraint": "^1.7.0"
},
{
"name": "@skillerr/protocol",
"manifest": "packages/runtime/package.json",
"ecosystem": "npm",
"version_constraint": "^1.7.0"
},
{
"name": "@skillerr/cli",
"manifest": "packages/skillerr/package.json",
"ecosystem": "npm",
"version_constraint": "^1.7.0"
},
{
"name": "@skillerr/core",
"manifest": "packages/workspace/package.json",
"ecosystem": "npm",
"version_constraint": "^1.7.0"
},
{
"name": "@skillerr/protocol",
"manifest": "packages/workspace/package.json",
"ecosystem": "npm",
"version_constraint": "^1.7.0"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 57,
"open_issues": 2,
"closed_ratio": 0.333,
"closed_issues": 1,
"closed_unmerged_prs": 1
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "bharatdudeja13-cmd",
"commits": 153,
"avatar_url": "https://avatars.githubusercontent.com/u/251474831?v=4"
}
],
"contributors_sampled": 1,
"top_contributor_share": 1
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"ci.yml",
"enforce-branch-flow.yml",
"publish.yml"
],
"has_docs_dir": true,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"package-lock.json"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 3,
"reason": "branch protection is not maximal on development and all release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 10,
"reason": "12 out of 12 merged PRs checked by a CI test -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/12 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 0,
"reason": "project has 0 contributing companies or organizations -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 0,
"reason": "project was created within the last 90 days. Please review its contents carefully",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 2,
"reason": "dependency not pinned by hash detected -- score normalized to 2",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 4,
"reason": "security policy file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 8,
"reason": "2 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "20ff4245fff289095642e74c1febf3f6a30e4b04",
"ran_at": "2026-07-27T23:07:55Z",
"aggregate_score": 4,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": true,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-21T03:19:37Z",
"oldest_open_prs": [],
"last_merged_pr_at": "2026-07-21T03:17:43Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 1,
"created_at": "2026-07-12T14:59:41Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 3,
"created_at": "2026-07-12T14:59:44Z",
"last_comment_at": null,
"last_comment_author": null
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/dot-skill/skillerr",
"host": "github.com",
"name": "skillerr",
"owner": "dot-skill"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 61,
"inputs": {
"security": 52,
"vitality": 74,
"community": 53,
"governance": 45,
"engineering": 81
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 74,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 56,
"inputs": {
"commits_last_year": 153,
"human_commit_share": 1,
"days_since_last_push": 6,
"active_weeks_last_year": 3
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 6 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 6
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "3/52 weeks with commits",
"points": 2.1,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 3
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "153 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 153
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"releases_count": 22,
"latest_release_tag": "v1.1.0",
"releases_from_tags": false,
"days_since_latest_release": 12,
"mean_days_between_releases": 0.1
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "22 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 22
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 12 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 12
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~0.1 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 0.1
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "moderate",
"name": "Community & Adoption",
"value": 53,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 5,
"inputs": {
"forks": 0,
"stars": 3,
"watchers": 1,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "3 stars",
"points": 4.9,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 3
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "0 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 0
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "1 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 1
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "excellent",
"name": "Community health",
"note": null,
"notes": [],
"value": 92,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": true,
"has_issue_template": false,
"has_code_of_conduct": true,
"has_pull_request_template": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (Apache-2.0)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "Apache-2.0"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 18,
"status": "met",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 13.5,
"status": "met",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 6.3,
"status": "met",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "good",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 76,
"inputs": {
"packages": [
"@skillerr/cli",
"@skillerr/core",
"@skillerr/runtime",
"@skillerr/protocol",
"@skillerr/registry",
"skillerr",
"@skillerr/workspace"
],
"dependents": null,
"ecosystems": "npm",
"total_downloads": null,
"monthly_downloads": 35341
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "35,341 downloads/month across npm",
"points": 60.6,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 35341,
"ecosystems": "npm"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "at_risk",
"name": "Sustainability & Governance",
"value": 45,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 10,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 1,
"top_contributor_share": 1
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0,
"status": "missed",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "1 contributors",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 1
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "moderate",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 53,
"inputs": {
"merged_prs": 57,
"open_issues": 2,
"closed_issues": 1,
"issue_closed_ratio": 0.333,
"closed_unmerged_prs": 1
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "33% of issues closed",
"points": 15.6,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 33
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "57/58 decided PRs merged",
"points": 37.6,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 57,
"decided": 58
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/12 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "at_risk",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 35,
"inputs": {
"followers": 0,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "dot-skill",
"public_repos": 4,
"account_age_days": 15
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "0 followers of dot-skill",
"points": 0,
"status": "missed",
"details": [
{
"code": "owner_followers",
"params": {
"count": 0,
"login": "dot-skill"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "4 public repos, account ~0 yr old",
"points": 5.2,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 4
}
},
{
"code": "account_age_years",
"params": {
"years": 0
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"@skillerr/cli",
"@skillerr/core",
"@skillerr/runtime",
"@skillerr/protocol",
"@skillerr/registry",
"skillerr",
"@skillerr/workspace"
],
"ecosystems": "npm",
"any_deprecated": false,
"min_days_since_publish": 6
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "7 package(s) on npm",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 7,
"ecosystems": "npm"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 6 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 6
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "31 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 31
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "good",
"name": "Engineering Quality",
"value": 81,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 68,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "3 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 3
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "12 out of 12 merged PRs checked by a CI test -- score normalized to 10",
"points": 20,
"status": "met",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "excellent",
"name": "Documentation",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"topics": [
"ai-agents",
"mcp",
"open-source",
"protocol",
"skill",
"agents",
"ai-skills",
"cli",
"dot-skill",
"skillerr"
],
"has_wiki": true,
"homepage": "https://www.skillerr.com/docs/",
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://www.skillerr.com/docs/",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "10 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 10
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "moderate",
"name": "Security",
"value": 52,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 40,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 17,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 1,
"scorecard_aggregate": 4
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection is not maximal on development and all release branches",
"points": 2.2,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "12 out of 12 merged PRs checked by a CI test -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/12 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 2",
"points": 1,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file detected",
"points": 2,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "2 existing vulnerabilities detected",
"points": 6,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "excellent",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the npm:skillerr@1.7.0 runtime dependency closure — what installing the published package pulls in — 74 packages. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_published",
"params": {
"package": "npm:skillerr@1.7.0",
"assessed": 74
}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 0,
"affected_packages": 0,
"assessed_packages": 74,
"unassessed_packages": 0,
"affected_by_severity": "none",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "no indirect dependency carries a known advisory",
"points": 25,
"status": "met",
"details": [
{
"code": "no_indirect_advisories",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 74,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 68,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "excellent",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.99,
"agent_instruction_files": [
"docs/AGENT.md"
],
"agent_instruction_max_bytes": 8517
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "docs/AGENT.md",
"points": 45,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "docs/AGENT.md"
}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "99 of 100 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 99,
"sampled": 100
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 55,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"package-lock.json"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [
"packages/cli/tsconfig.json",
"packages/core/tsconfig.json",
"packages/protocol/tsconfig.json",
"packages/registry/tsconfig.json",
"packages/runtime/tsconfig.json",
"packages/workspace/tsconfig.json"
],
"agent_commit_share": 0.38,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "packages/cli/tsconfig.json, packages/core/tsconfig.json, packages/protocol/tsconfig.json, packages/registry/tsconfig.json, packages/runtime/tsconfig.json, packages/workspace/tsconfig.json",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "packages/cli/tsconfig.json, packages/core/tsconfig.json, packages/protocol/tsconfig.json, packages/registry/tsconfig.json, packages/runtime/tsconfig.json, packages/workspace/tsconfig.json"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "38 of the last 100 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 38,
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 2",
"points": 2,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 98,
"inputs": {
"primary_language": "TypeScript",
"largest_source_bytes": 114102,
"source_files_sampled": 68,
"oversized_source_files": 2
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "TypeScript (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "TypeScript"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "2/68 source files over 60KB",
"points": 53.4,
"status": "partial",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 68,
"oversized": 2
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "at_risk",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"example_dirs": [
"examples"
],
"has_mcp_signal": false,
"api_schema_files": []
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": "examples",
"points": 40,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "examples"
}
}
],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
],
"report_type": "repository",
"generated_at": "2026-07-27T23:08:11.623950Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/d/dot-skill/skillerr.svg",
"full_name": "dot-skill/skillerr",
"license_state": "standard",
"license_spdx": "Apache-2.0"
}