SkillRadar v0.5.0 — Measurable project-aware routing quality

SkillRadar v0.5.0 — Measurable routing quality

SkillRadar v0.5.0 moves routing quality from intuition to an auditable product contract.

Highlights

Matching v2.1: task-first, project-aware

$skill-router still treats the user's explicit task as the primary signal. v0.5.0 can additionally read a small set of non-secret project metadata — dependency names in package.json, common config filenames, and framework directories — to break close ties.

Project context is deliberately bounded:

• maximum project-context bonus: 6 points;
• if a candidate has zero user-task coverage, project context can add at most 2 points;
• source files, environment-variable values, credentials and candidate third-party scripts are not read for project-context routing;
• route output separates task evidence from project-context evidence.

New route evidence includes:

• context.mode
• context.signals
• match_details.matched_signal_weights
• match_details.project_context_signals
• match_details.project_context_bonus

Complementary Top-3 task coverage

The Top-3 reranker now rewards candidates that cover important task facets not already covered by earlier selections. It still considers skill similarity and source diversity, but no longer treats “three different skills” as sufficient when all three cover the same part of the task.

For the golden multi-capability task:

Build a Next.js React shadcn/ui AI dashboard with streaming, tool calling and App Router

v0.5.0 must return all three core capabilities in the Top-3:

• nextjs
• ai-sdk
• shadcn

Golden Router Quality Benchmark

A new benchmark is part of CI and release gating. The initial v0.5 baseline is:

• 7 / 7 golden routing cases passed;
• pass rate: 100%;
• unsafe D/Blocked results in Top-3: 0;
• average Top-1 match score: 85.1;
• project-context fixture: passed;
• explicit task-dominance fixture: passed.

The benchmark covers AI streaming/tool calling, Next.js App Router, shadcn design systems, React performance, frontend polish, a multi-capability AI dashboard, and Chinese multi-facet spatial rendering.

Results are persisted in data/router-benchmark-latest.json on main so ranking changes can be compared over time.

No hidden auto-tuning

v0.5.0 does not introduce opaque self-learning or automatic production weight changes. Ranking weights remain code-reviewed and benchmark-gated. Future optimization work must improve the benchmark without weakening safety or acceptance thresholds.

Existing v0.4 guarantees retained

• bundled offline-first schema-v2 registry;
• core + design + general discovery pool;
• fail-closed security scanning and retained-candidate provenance gating;
• D / Blocked exclusion from automatic routing;
• C-grade safer-alternative advisory;
• read-only Skill Budget Doctor;
• public Codex marketplace installation and upgrade smoke tests.

Install

codex plugin marketplace add changchangidea-oss/SkillRadar --ref v0.5.0
codex plugin add skillradar@skillradar

For an existing pinned SkillRadar marketplace, remove the old plugin and marketplace first, then add the v0.5.0 ref.

SkillRadar v0.4.0 — Wider discovery, Matching v2, Skill Budget Doctor

SkillRadar v0.4.0 — Wider discovery, Matching v2, Skill Budget Doctor

v0.4.0 moves SkillRadar from a design-heavy registry/router into a broader Agent Skills intelligence layer while keeping the v0.3 safety boundary: discovery is not execution.

Highlights

General Agent Skills Radar

The daily pipeline now maintains a second discovery lane across 10 general domains:

AI Agents · Frontend · Backend & API · Data & Database · Testing & Quality · DevOps & Cloud · Security · Mobile · Automation & Integrations · Docs & Research.

Discovery combines repository search, SKILL.md code search, and ecosystem-wide Agent/Claude/Codex skill queries. Each candidate records discovery channels, coverage metrics, maintenance, popularity, quality, security findings, and domain classifications. Temporary search misses can be retained for 14 days instead of immediately disappearing.

Bundled registry schema v2

The Codex plugin snapshot now bundles three safety-gated shards:

core + design + general

D and Blocked discovered skills are rejected before packaging. Cross-source duplicate entries are collapsed before the snapshot hash is generated. The router remains backward-compatible with schema v1 snapshots.

Matching v2

The router no longer relies on raw substring hit counts. Matching v2:

• recognizes task phrases/concepts such as App Router, tool calling and design systems;
• avoids short-token substring errors such as ai accidentally matching tailwind;
• weights evidence differently across identity, tags, domain, summary and source fields;
• measures task-signal coverage;
• combines relevance with SkillRadar quality, security and freshness priors;
• diversity-reranks the Top 3 to reduce redundant recommendations;
• returns match_details and ranking.version: 2.0 for auditability.

The C-grade safer-alternative advisory remains in force.

Skill Budget Doctor

$manage-skills is now backed by a real read-only diagnostic command:

node ../../scripts/skill-budget.mjs audit '<project or task focus>'

It inventories visible user/project/plugin skills, estimates metadata pressure using current Codex budget behavior, detects near duplicates, uses project/task relevance as a pruning signal, and generates projected savings plus [[skills.config]] enabled = false snippets.

The doctor does not edit ~/.codex/config.toml, disable a skill, remove a plugin, install a skill, or execute a third-party script unless the user separately and explicitly authorizes a later change.

Verification added

CI now verifies:

• schema-v2 core/design/general bundle integrity and safety gates;
• Ranking v2 evidence in plugin-only offline routing;
• schema-v1 backward compatibility;
• C-grade safety advisory behavior;
• Skill Budget Doctor overflow detection, duplicate detection and projected savings;
• public Codex marketplace installation after release.

Upgrade

codex plugin remove skillradar@skillradar
codex plugin marketplace remove skillradar
codex plugin marketplace add changchangidea-oss/SkillRadar --ref v0.4.0
codex plugin add skillradar@skillradar

Start a fresh Codex thread after upgrading.

SkillRadar v0.3.2 — Registry-first explicit routing

SkillRadar v0.3.2 — Registry-first explicit routing

v0.3.2 fixes a routing-policy regression discovered during a real Codex acceptance test.

What was wrong

The v0.3.1 plugin correctly bundled the safety-gated Registry and could route fully offline, but skill-router/SKILL.md still told Codex to inspect obvious local skills first and allowed it to skip the Registry when local skills already looked suitable.

That meant an explicit $skill-router request could return a plausible local shortlist without proving that SkillRadar's Registry, scoring, or safety evidence had been used.

Fix

• Explicit $skill-router, Top N, recommendation, comparison, ranking, and routing requests are now Registry-first.
• Codex must run the bundled read-only lookup before selecting candidates.
• Installed/local skills are supplemental availability metadata only; they cannot replace the SkillRadar ranking.
• Successful explicit routes must expose source: skillradar-registry, registry.mode, match_score, skillradar_score, security, source, and reason.
• If Registry lookup fails, the skill must say so instead of presenting a local-only shortlist as a successful SkillRadar route.
• Offline acceptance now includes a static policy-contract guard so the local-first bypass cannot be accidentally reintroduced.

Safety boundary

Discovery is still not execution. D/Blocked entries remain excluded from automatic routing, and SkillRadar's internal lookup CLI remains read-only.

SkillRadar v0.3.1 — Offline-first Codex routing

SkillRadar v0.3.1 — Offline-first Codex routing

v0.3.1 fixes the packaging and routing gaps found during a real Codex CLI acceptance test on macOS.

Fixed

• Bundles the complete safety-gated SkillRadar registry inside the Codex plugin.
• Routes from the local bundled registry first; GitHub/network access is fallback only.
• Clarifies that skillradar.mjs is SkillRadar's own read-only lookup CLI, not a discovered third-party script.
• Standardizes routing output as match_score, skillradar_score, security, source, and reason.
• Adds a safety advisory when a C-grade Top-1 result has a nearby A/B alternative.
• Adds plugin-only offline CI that copies only the installed plugin directory into a temporary location and proves Top-3 routing with networking disabled.
• Adds a deterministic C-grade policy fixture so the safer-alternative advisory cannot silently regress.
• Daily Radar refreshes now rebuild and commit the bundled plugin registry snapshot.

Safety boundary

Discovery is still not execution. D and Blocked candidates remain excluded from automatic routing. A/B/C recommendations are discovery results only and do not authorize third-party scripts, secrets access, deployments, database writes, or external network actions.

Install

codex plugin marketplace add changchangidea-oss/SkillRadar --ref v0.3.1 && codex plugin add skillradar@skillradar

Start a new Codex thread after installation.

SkillRadar v0.3.0 — Closed-loop Radar

SkillRadar v0.3.0 — Closed-loop Radar

SkillRadar v0.3.0 turns the project from a curated skill list into an auditable Agent Skills intelligence pipeline.

Highlights

• Closed-loop Radar: discover → parse → static security scan → classify → rank → publish → Codex route.
• 12 design domains with daily dynamic Top 20 rankings.
• Live registry: seed skills and safety-gated Radar discoveries share the same registry used by the web UI and Codex plugin.
• Safety gate: D and Blocked candidates remain inspectable but cannot enter automatic Codex routing or dynamic Top 20 lists.
• Ranking history: daily snapshots are stored in data/ranking-history.json.
• Codex Plugin v0.3.0: routes real tasks to a small Top-3 skill shortlist.
• Agent Skills compatibility: a standard skills/skillradar/SKILL.md entry enables skills.sh-compatible installation and discovery.
• Public metrics: metrics.html exposes current indexed skills, domain count, latest Radar status, safety outcomes, and ranking history.

One-line Codex install

codex plugin marketplace add changchangidea-oss/SkillRadar --ref v0.3.0 && codex plugin add skillradar@skillradar

Standard Agent Skill install

npx skills add changchangidea-oss/SkillRadar --skill skillradar

Safety

SkillRadar is a discovery and routing layer, not an execution sandbox or formal security audit. Always review third-party skills before granting shell, filesystem, network, secret, package-install, deployment, or database permissions.