Reapplies @MatrixNeoKozak's PR #47 onto current main (resolves the
bin/cli.mjs conflict with the star-nudge changes):
- resolve() the install target and refuse system-critical dirs
(/, /usr, /etc, /root, ...) so a typo'd --target can't clobber the system
- skillcheck frontmatter parser tolerates leading whitespace and CRLF/LF
Claude-Session: https://claude.ai/code/session_016JWn5jRD5tcEFKrubjQ6Px
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: MatrixNeoKozak <MatrixNeoKozak@users.noreply.github.com>
More touchpoints to convert users into stargazers: the `list` command
footer and the MCP server's stderr startup banner (stderr is safe — it
never corrupts the JSON-RPC stream on stdout).
Claude-Session: https://claude.ai/code/session_016JWn5jRD5tcEFKrubjQ6Px
Co-authored-by: Claude <noreply@anthropic.com>
- CLI prints a star CTA after a successful install and in --help
- README adds a prominent star line below the badges (npm renders this)
- package.json gains a funding field so npm shows a Fund/Star link
Claude-Session: https://claude.ai/code/session_016JWn5jRD5tcEFKrubjQ6Px
Co-authored-by: Claude <noreply@anthropic.com>
The "Run evals" step ran 24 API calls sequentially with no request timeout, so
it was slow and could stall indefinitely if one call hung.
- bin/lib/anthropic.mjs: per-request timeout (120s) via AbortController + retry
(2x, backoff) on 429/5xx/timeout. Fails fast on 4xx (bad key/model).
- evals/run-evals.mjs: run (case × model) tasks through a concurrency pool
(default 4, --concurrency to tune); preserves result order.
- eval-leaderboard.yml: job timeout-minutes: 20 as a safety net.
Applies to the next run. The hardening also benefits the Action runner and
`generate`, which share the client.
Claude-Session: https://claude.ai/code/session_016JWn5jRD5tcEFKrubjQ6Px
Co-authored-by: Claude <noreply@anthropic.com>
Three features riding 2026 trends (agentic CI, codegen, evals), sharing one
dependency-free Anthropic client (bin/lib/anthropic.mjs).
1. GitHub Action (action/) — run any skill in a consumer repo's CI:
uses: mohitagw15856/pm-claude-skills/action@main. Composite action +
run.mjs (loads the bundled SKILL.md, calls the API, exposes result as a
step output / file). Docs with auto-PR-description example.
2. generate command — `npx pm-claude-skills generate --from <url|file>` turns
a team's docs into a SKILL.md following the authoring standard
(bin/generate.mjs, wired into the CLI; needs ANTHROPIC_API_KEY).
3. Skill evals + Leaderboard — evals/run-evals.mjs runs each case across models
and scores output with an LLM judge (structure/completeness/usefulness/
grounding); scripts/build-leaderboard.mjs renders web/leaderboard.html
(built in the Pages deploy, falls back to clearly-labelled example data).
Linked from README, catalog, and playground.
Offline-testable parts verified (prompt building, skill loading, graceful
errors, leaderboard render). SkillCheck/audit/exports all green.
Claude-Session: https://claude.ai/code/session_016JWn5jRD5tcEFKrubjQ6Px
Co-authored-by: Claude <noreply@anthropic.com>
Closes the remaining gaps vs alirezarezvani/claude-skills across trust, content
types, discoverability, and community.
Security (trust signal + useful):
- scripts/skill-audit.mjs scans skills/*/SKILL.md + each skill's scripts/ for
prompt injection, exfiltration, dynamic code exec, destructive shell, secrets,
and hidden text. HIGH fails CI (.github/workflows/skill-audit.yml) + a badge.
- New skill-security-auditor skill teaches the same review (production tier).
Content types:
- output-styles/ — 4 personas (Startup CTO, Growth Marketer, Solo Founder,
Product Leader) as Claude Code output styles; --agent claude installs them too.
- ORCHESTRATION.md — Skill Chain / Multi-Agent Handoff / Domain Deep-Dive /
Solo Sprint patterns.
Discoverability:
- scripts/build-docs.mjs generates a server-rendered, SEO-indexable
web/catalog.html of all skills (built in the Pages deploy; gitignored).
Linked from README + playground.
Community:
- ROADMAP.md (now/next/later + good-first-issues).
README badges/sections, TIERS (47 production), CHANGELOG, package.json files,
and exports/web index all updated. SkillCheck + security audit + exports verified.
Claude-Session: https://claude.ai/code/session_016JWn5jRD5tcEFKrubjQ6Px
Co-authored-by: Claude <noreply@anthropic.com>
Broadens both reach (more tools) and content types (an MCP server), continuing
the multi-platform story.
Windsurf + Aider:
- build-exports.mjs gains two platforms: exports/windsurf/*.md (workspace rules,
trigger: model_decision) and exports/aider/*.md (conventions for `aider --read`).
Now 5 platforms (ChatGPT, Gemini, Cursor, Windsurf, Aider).
- install.sh + bin/cli.mjs install both (windsurf -> .windsurf/rules, aider ->
.aider/skills with a --read hint); generated README index is excluded from copies.
- One-line windsurf-install.sh / aider-install.sh wrappers for parity.
MCP server (new content type):
- mcp/server.mjs — zero-dependency stdio MCP server exposing list_skills,
search_skills, get_skill. Published as a second bin (pm-claude-skills-mcp).
Logs to stderr; reads bundled skills/ at startup. mcp/README.md documents
client config.
Also: README hero "See it in action" demo placement (ready to swap in a GIF;
recording guide in web/docs-assets/README.md), Works-With table + exports +
install docs updated, CHANGELOG Unreleased. package.json files/bin updated.
Claude-Session: https://claude.ai/code/session_016JWn5jRD5tcEFKrubjQ6Px
Co-authored-by: Claude <noreply@anthropic.com>
Cross-platform one-command install (fixes the Windows gap; alirezarezvani's
repo has no npm CLI, so this is a genuine differentiator):
- bin/cli.mjs — pure-Node installer, no bash/git, works on Windows/macOS/Linux:
npx pm-claude-skills add --agent <claude|hermes|codex|openclaw|cursor>
with --link / --target / --dry-run. For claude it installs skills + subagents
+ commands. Includes list / --version / --help.
- package.json is now a publishable package: name pm-claude-skills (the name
"pm-skills" is already taken on npm), bin + files + keywords, version 17.0.0.
npm pack is ~1.8 MB / 711 files.
Version bump to v17.0.0 (Agents, Commands & the npx CLI) since v16.0.0 is
published: README badge/What's-New (v16 moved to collapsed history), CHANGELOG
promoted Unreleased -> [17.0.0] with the npx entry, SECURITY support table, and
the Quick Install + one-command sections now lead with npx and flag the
Windows/PowerShell path.
Claude-Session: https://claude.ai/code/session_016JWn5jRD5tcEFKrubjQ6Px
Co-authored-by: Claude <noreply@anthropic.com>
mohitagw15856