v0.20.0

• The audit reads the whole skill folder. Besides the SKILL.md, the skill's other text files (scripts, references, configs) are checked: a clean SKILL.md that runs a curl | sh script now fails. Findings name their file (scripts/setup.sh:12) on the review screen, with install -y, show, the web page and MCP. Binaries, large files and unreadable ones are reported as not audited.
• See what an update changes. In the tree, p on a skill marked for update shows the diff between the installed SKILL.md and the new one, with only the warning signs the new version adds. skills-atlas update (and --dry-run) prints the changed line counts and those warning signs first; MCP's outdated_skills returns them.
• Roll back an update. Each update first records the commit the skill was installed from. skills-atlas rollback <id> reinstalls it for the skill's own agents, audited at that revision; --list shows the recorded versions (five per skill) and --to <sha> picks one.
• Prerequisites in the catalog. Each crawl reads the SKILL.md of the 3,000 most installed skills for the programs they need and their compatibility text, and dates the folder's last change for the top 1,000 (about 3 KB more in the snapshot). The tree's details show them, missing programs in red; the web page shows them as tags; MCP returns requires and updated_at. --ready (browse, list) keeps only the skills whose programs are all installed.
• Trending without clone networks. Repositories that grow the same skills as at least two others (three shared names, 1,000+ installs each) stay out of Trending; in the current snapshot, six copies of one bundle held nearly half of the theme. Their details say why.
• Repository health. The crawl records each repository's license, archive state and last push (GitHub GraphQL, 5,000 repositories). Skills of archived or year-old repositories sort after the others, --active leaves them out, and the tree, the web page and MCP show license and state.
• The web demo link pointed to devohmycode.github.io/skills-atlas, which answers 404 since the repository became Skills-Atlas (GitHub Pages paths are case-sensitive). Links, package metadata, the plugin manifest and the catalog URL now use the repository's own name.
• Prerequisites. The risk check reads what a SKILL.md frontmatter says it needs. Programs under requires.bins that are not on your PATH are a medium warning, named on the review screen and by install -y before any command runs. The compatibility field is shown as information in p, show and MCP's show_skill.

Validation: 249 tests and TypeScript checks.

v0.12.0

• Pinned project skills. skills-atlas.json takes optional revisions, a full commit SHA per skill. skills-atlas lock writes them, and lock --dry-run shows the old and new commits with compare links. sync then installs and audits that exact revision and checks every installed copy byte for byte against it. sync --check also reports drifted content.
• sync checks every target agent. A skill installed for Cursor alone no longer satisfies a request for Claude Code. Only the missing skill/agent combinations are installed. -a overrides the file's agents, and -a '*' means every supported agent.
• skills-atlas doctor diagnoses installed skills without changing anything: dangling links, unreadable folders or SKILL.md, a malformed lock file, and lock entries whose skill is gone. Use -p or -g for one scope, and --json for scripts. It exits with 1 when it finds issues.
• Better search. Search ignores case and accents and checks names, descriptions and labels. Every word must match. Name matches rank first, and installs break ties. This applies to the CLI, the tree, the web page, the demo and MCP.
• Web page: details and audit. Details (or p) shows a skill's SKILL.md, its warning signs and any replacements. The changes panel runs the security audit. A skill that fails it is blocked until you tick install anyway for that skill, and Apply audits again before running.
• Web page: retry what failed. After a partial failure or a lost connection, the page keeps only what is still outstanding. Retry remaining changes installs only for the agents that still lack the skill.
• Web page: save as pack. The checked catalog skills become a personal pack in packs.json. It is available right away, and existing packs are never overwritten.
• Catalog health. A snapshot records each source's status. The tree and the web page warn when a source was unavailable during the crawl. Packs show how many of their members are in the catalog and which are missing, in skills-atlas packs too.

Validation: 229 tests and TypeScript checks.

v0.11.0

• Security audit before installing. The risk check now runs on every skill to install or update. A skill with a high warning sign fails: on the review screen it is listed unticked, with its warning signs, and space installs it anyway; without a person at the keyboard (install -y, import, sync, update) it is left out; the MCP server refuses it unless ignore_audit: true. skills-atlas audit on|off sets it for good, --no-audit for one command.
• install with questions now installs what its review screen kept, not every id it was given.
• Update everything. skills-atlas update updates every outdated global skill, or only the ones named, each for its own agents (--dry-run available). In the tree, U marks every outdated skill at once.

Validation: 161 tests and TypeScript checks.

Install: npx skills-atlas@0.11.0

v0.10.0

• 📦 Packs. Curated sets of skills to install together: Frontend dev, Security review, Code quality & testing, Writing & docs. Each is a theme in the tree and on the web page (tick it to take the pack), skills-atlas packs lists them and install --pack <id> installs one. A personal packs.json replaces them.
• A project's skills. A skills-atlas.json at a repository's root lists the skills it expects, in the export format with optional agents. skills-atlas sync installs the missing ones in the project; sync --check lists them and exits with 1, for CI.
• Per agent. skills-atlas installed lists the installed skills under each agent that sees them; -a codex claude-code shows only those, side by side, and --json is available. In the tree, an installed skill's details name its agents.
• Shell completion for bash, zsh, fish and PowerShell: skills-atlas completion <shell> prints the script. It completes commands, options, skill ids, agents, themes and languages, from the cached catalog.
• Same name, one folder. The skills CLI installs by name, so a skill from another repository silently replaced an installed one of the same name, or another one selected in the same run. The review screen now lists such replacements, install and import warn before running, and the MCP server refuses them unless replace: true.
• Risk check. The p preview, show and the MCP server's show_skill point at what a SKILL.md asks for beyond its description: downloading and running code, credential files, broad deletions, instructions to hide things from the user (high); administrator commands, secrets read from the environment, data sent to a server (medium); packages or scripts run (info). A pattern check on the text, tuned on the 150 most installed skills, which it leaves without a false high alert; it points at lines to read, it does not prove a skill safe.
• 🔥 Trending. Each crawl records the installs every skill gained since the previous snapshot. The 50 that gained the most form a Trending theme, right after Recommended, sorted by growth, with the gain shown in the details.

Validation: 158 tests and TypeScript checks.

Install: npx skills-atlas@0.10.0

v0.9.2

fix(catalog): read a root SKILL.md path as the repository root; relea…

v0.9.0

• Preview a skill before installing it. Press p on a skill to read its SKILL.md, fetched from GitHub, in place of the list; ↑↓, PgUp/PgDn or the wheel scroll it, esc goes back. A skill runs with your agent's permissions, so reading it first is worth it. The text is shown without its escape sequences, so that it cannot drive the terminal.
• Export and import a selection. skills-atlas export > my-skills.json writes the installed skills; skills-atlas import my-skills.json installs them on another machine or in another project, with the same options as install. The file is checked first: a malformed id, or a skill name that could pass for a flag, stops the import.
• New version notice. A dim line tells when a newer skills-atlas is published, above the tree and under the ui address. npm is asked at most once a day, in the background.
• Web demo. A read-only copy of the web interface, with the 3,000 most installed skills, rebuilt with each catalog: https://devohmycode.github.io/skills-atlas/demo/ (npm run demo).
• README. An animated terminal session and npm badges.
• Internals. The terminal and the web page share one grouping by repository for Recommended, and the return to the list after a run is tested.

Validation: 134 tests and TypeScript checks.

v0.8.0

chore: release 0.8.0 with skill updates

v0.7.2

Recommended groups its skills by repository; browse returns to the list after each run.

v0.7.1

0.7.1 — 2026-10-16

• ★ Recommended now lists four whole repositories: Ponytail, mattpocock/skills, obra/superpowers and addyosmani/agent-skills.
• A recommendation without name stands for its whole repository. Installing it runs npx skills add <repository> in the terminal, without -s, so the skills CLI asks which of its skills to install. The web interface shows that command to run from a terminal instead.

Validation: 114 tests and TypeScript checks.

Install: npx skills-atlas@0.7.1

v0.7.0

Changelog

0.7.0 — 2026-10-15

• Add ★ Recommended below installed skills in the terminal and web interface, starting with Ponytail. Maintain the shared selection in data/recommended.json, or replace it with a personal JSON file in the user configuration directory.
• Press g on a focused skill to open its GitHub repository.
• Add Italian and translate the new interface labels in all nine languages. Keep support for locale forms including it-IT and zh-CN.
• Apply the Decker-inspired blue–lavender–pink palette, with candy-pink terminal selections and gold recommendation stars.
• Improve list navigation with cached views, reliable rapid keyboard input, production React and a 60 FPS limit. Update web selections and pagination without rebuilding every loaded row.
• Keep Ink's stable terminal renderer to prevent duplicate lines, with screen replay regression tests for multiple terminal sizes.

Validation: 112 tests, TypeScript checks, production build and package-content verification.