v0.4.2 - SARIF Code Scanning, OpenAPI Importer, Skill Evals & Context Optimizer

What's Changed in v0.4.2

• OASIS SARIF v2.1.0 Export: Export audit results via \skillforge audit --sarif <file.sarif>\ for native GitHub Code Scanning integration.
• OpenAPI & Swagger Importer: Instant conversion from OpenAPI 3.0/3.1 or Swagger 2.0 specs into progressive disclosure skill packages via \skillforge import-openapi .
• Skill Trigger & Output Testing Harness: Run deterministic test suites with \skillforge test [--init] [--json]\ using \evals/evals.json\ standard.
• Progressive Disclosure Context Optimizer: Refactor oversized skills exceeding progressive disclosure limits (\QUAL-003) into clean references via \skillforge optimize .
• GitHub Action SARIF Integration: Added \sarif\ parameter to composite GitHub Action for automated security scanning in Pull Requests.

v0.4.1 — Verify Command, Git Commit Pinning, Security Badges & GitHub Action

Changes in v0.4.1

• SkillForge Badge: Added \skillforge badge\ command to generate verified shields.io badges for skill repositories.
• GitHub Action: Added official composite action (\�ction.yml) for automated security auditing and token budgeting on Pull Requests.
• Verify Command: Added \skillforge verify\ command to check installed skills against \skillforge.lock\ for file drift, tampering, or missing packages.
• Commit Pinning: Added reproducible Git commit SHA-40 pinning in \skillforge.lock\ with support for @\ in remote specs.
• Security Hardening: Blocked path traversal in
  emove\ and git option injection in \GitRemoteRegistry.
• Non-Destructive Copilot: Preserved hand-written instructions in .github/copilot-instructions.md\ using marker blocks.
• Playbook & Quickstart: Added \docs/LAUNCH_PLAYBOOK.md\ and zero-install quickstart via \uvx agent-skillforge.

v0.4.0 — Workstation Doctor, Skill Diffing, Advanced Secret/Exfil Scanner & 22 Skills

Highlights in v0.4.0

• Workstation Diagnostics (skillforge doctor): Full-environment health and security scanner across all assistant configurations (Claude Code, Cursor, Antigravity, Windsurf) with total startup context token calculation and issue reporting.
• Skill Version Diffing (skillforge diff): Interactive visual diff of frontmatter, Markdown instructions, scripts, and SHA-256 package digests before updating or syncing.
• 2026 Threat Model Defenses (SEC-005 & SEC-006): Detects outbound data exfiltration attempts (webhook.site, pipedream, curl exfil) and hardcoded API tokens (GitHub, Anthropic, Google, AWS).
• Applicability Poisoning Guard (QUAL-006): Catches overbroad trigger descriptions that attempt to hijack all agent requests.
• Smart Defensive Context Filter: Differentiates malicious prompt injections from defensive guidelines discussing attacks in quotes.
• 3 New Built-in Engineering Skills (22 Total): Added supply-chain-sentinel, secret-sanitizer, and contract-test-generator.

v0.3.0 — Context Budget Profiler, Progressive Disclosure Linter & SHA-256 Lockfile Sync

Highlights in v0.3.0

• Context Budget Profiler (skillforge budget): Measure startup pointer token cost vs on-demand body and disclosed resource token cost across installed or built-in skills.
• Progressive Disclosure Linting (QUAL-003 & QUAL-004): Detect oversized SKILL.md bodies (>500 lines / 5,000 tokens) and broken pointers to missing references/ or scripts/ files.
• User-Invoked Skill Support (disable-model-invocation): Native frontmatter support with zero startup pointer token calculation and automatic QUAL-001 exemption.
• Cryptographic Lockfile & Team Sync (skillforge sync): Pin deterministic SHA-256 package digests in skillforge.lock and verify integrity on sync.
• MCP On-Demand Disclosure (get_skill_resource): Read bundled references/* and scripts/* files over MCP.
• 3 New Built-in Skills (19 Total): Added skill-architect (with references/mechanics.md), security-threat-modeler, and performance-profiler.

v0.2.0 - Security Auditor, GitHub Installer & 16 Core Skills

Changelog

0.2.0 - 2026-10-27

• Full compliance with the open SKILL.md directory package specification (AAIF / Agentic AI Foundation).
• Added multi-file SkillPackage support preserving scripts/, references/, and assets/.
• Added skillforge audit security scanner detecting invisible zero-width unicode (SEC-001), prompt injections (SEC-002), dangerous shell/exfiltration commands (SEC-003), and credential access (SEC-004).
• Added skillforge add for direct installation and security auditing from remote GitHub/Git repositories.
• Added skillforge list and skillforge remove commands for managing active skills across assistants.
• Added new assistant adapters: Google Antigravity / Gemini CLI, Windsurf, Cline / Roo-Code, and universal AGENTS.md.
• Added support for --global assistant installations.
• Expanded built-in skills to 16 zero-slop production workflows, addressing critical SWE-bench failure modes (blast-radius-containment, cognitive-loop-breaker, flaky-test-isolation, runtime-api-verification, zero-downtime-migration).
• Added audit_skill tool to the official MCP server.
• Updated packaging to PEP 639 standards and added workflow_dispatch / tag triggers to GitHub Actions publish workflow.

0.1.0 - 2026-10-03

• Added universal SKILL.md parsing and validation.
• Added local registry and Copilot/Claude adapters.
• Added Typer CLI commands.
• Added official MCP server with resources and read-only tools.
• Added test coverage gate and strict type checking.
• Added built-in skills, explicit built-in registry fallback, and Cursor adapter support.
• Distribution name is agent-skillforge; CLI command remains skillforge.

v0.1.1 - Add JSON skill validation output

What's Changed

• Added skillforge validate PATH --json for machine-readable output.
• Updated documentation and validation test suite.

v0.1.0 — Initial Release

First public release 🎉

Install

pip install agent-skillforge

text

What's included

• Universal SKILL.md parser and validator
• CLI commands: skillforge search | install | validate | create | pack | serve-mcp
• Adapters for Copilot, Claude Code, Cursor
• MCP server with resources (skill://) and tools (search_skills, get_skill, validate_skill)
• 7 built-in skills:
  • caveman — ultra-compressed output, ~65-75% token savings
  • self-improving-agent — learn from mistakes
  • summarize — YouTube/PDF/web summarizer
  • tavily-search — real-time web search
  • spec-driven-development — production-grade workflow
  • agent-observability — telemetry instrumentation
  • human-in-the-loop — critical action approval
• 37 tests, 90.63% coverage, mypy clean

Documentation

https://gintingism.github.io/skillforge