SkillPreflight v0.3.0

Added

• Explicit JSON policy files through --config.
• Repeatable --exclude path globs and --ignore-rule rule patterns.
• --fail-on <severity> gates for local use and CI.
• GitHub Action inputs for policy files, severity gates, exclusions, and ignored rules.
• Detection for bidirectional controls, hidden Unicode tags, and unexpected zero-width characters.
• Suppressed finding counts and an auditable suppressedFindings JSON trail.

Improved

• Repeated locations remain visible, while each rule ID deducts points only once per skill.
• Full remote reports now use repository-relative paths instead of temporary local paths.
• Oversized files are measured without being loaded into text analysis.
• Added English and Chinese policy documentation.
• Updated examples to current GitHub Actions versions.

Security and maintenance

• Updated tar to 7.5.22 and undici to 6.28.0.
• Removed the unnecessary tsx / esbuild development dependency chain.
• Regenerated the lockfile entirely from the official npm registry.
• npm audit reports 0 vulnerabilities.

Verified

• 16 automated tests pass.
• GitHub CI passes on Node.js 20 and 24.
• npm pack --dry-run succeeds.
• Real-world summary scan completed against 894 skills in affaan-m/ECC.
• Clean npx skill-preflight@0.3.0 remote scan and policy gate succeeded.