v1.4.1

Improve Socket.dev Supply Chain Security Score

• Remove @scarf/scarf dependency and scarfSettings (eliminates obfuscated code + telemetry HIGH alerts)
• Escape eval regex pattern in patterns.ts to avoid "uses eval" false positive
• Exclude build/__tests__/ from published npm tarball
• Bump version to 1.4.1

v1.4.0 — Multi-scope skill management

What's New

• Multi-scope skill management: Support for both global (~/.claude/) and project-scoped (./.claude/) skills
• Scope resolver: New scope-resolver.ts for path resolution and validation across scopes
• All tools updated: Every MCP tool now accepts an optional scope parameter (defaults to global for backward compatibility)
• CI/CD pipeline: GitHub Actions workflow for build/test (Node 20/22) and automated npm publish on release
• 135 tests passing across security scanner, skill manager, sync engine, and scope resolver

Full Changelog

v1.3.1...v1.4.0

v1.3.0 — Community Launch

What's New

8 MCP Tools

• skillsmp_search — Keyword search across SkillsMP marketplace
• skillsmp_ai_search — AI-powered semantic search (Cloudflare AI)
• skillsmp_scan_skill — Security scan a GitHub skill repo (60+ patterns)
• skillsmp_search_safe — Search + auto-scan top results
• skillsmp_install_skill — Scan, gate, and install to ~/.claude/skills/
• skillsmp_uninstall_skill — Remove an installed skill
• NEW skillsmp_list_installed — List installed skills with risk levels
• NEW skillsmp_audit_installed — Deep security audit of installed skills

Security Scanner

• 95 threat patterns across 20 categories
• Critical patterns block installation unconditionally
• Multi-line evasion detection
• Content hashing for TOCTOU verification
• Output sanitization against prompt injection

Cloud Sync Engine

• Subscription-based skill sync from SkillsMP API
• Lock file for stable change detection
• Conflict policies (skip/overwrite)
• Dry run support

Multi-Client Support

• Claude Code, OpenClaw, Cursor, Windsurf, nanobot
• Configuration examples for all clients

Community Infrastructure

• Issue templates (bug report, feature request, skill submission)
• PR template with checklist
• CONTRIBUTING.md with contribution guides
• SKILL.md for agent discoverability
• docs/THREAT_PATTERNS.md documenting all 95 patterns

Install

{
  "mcpServers": {
    "skillsmp": {
      "command": "npx",
      "args": ["-y", "@stranzwersweb2/skillsync-mcp"]
    }
  }
}