v1.0.1

Pins ai-plugin-scanner-action to an immutable commit.

Dependabot proposed v1.2.551 to v1.2.618. Checking what the v1 tag actually resolves to showed it had moved twice in three days: the pull request named v1.2.618 from 5 September, and v1 now points at v1.2.651 published on the 8th. Anything tracking the tag silently ran three different bundles across that window.

Now pinned to bb4f519 (v1.2.651). Dependabot keeps SHA pins updated, so this costs nothing in maintenance and removes the window where a tag can be repointed at unreviewed code. The same pin is applied across the seven sibling skill bundles.

v1.0.0

First tagged release. The skills had shipped unversioned since March, so nobody could tell what they were running or what had changed.

What changed for an agent

It stops acting on facts that were wrong. Before this release an agent following these skills would quote a Premium plan that does not exist, call four MCP tools that were never on the server, and write the Claude Desktop config to a path Claude Desktop does not read. All three are fixed, along with a Threads section that described auto-threading and then said auto-threading was disabled, and four platform limits that had drifted from the API (X video 2:20 not 2:00, Bluesky exactly 2,000,000 bytes not ~1 MB, Threads 1 GB video and 2-20 image carousels).

It also gains capabilities the product already had and the skills never mentioned: mediaUrls attaches up to 10 public URLs on create_post before validation, so media and scheduling take one call instead of four; complete_media and list_connections are documented; linkedin_create_reshare and linkedin_list_mentionables appear for the first time. And scheduledTime is optional, not required: omit it for a draft.

All nine descriptions were rewritten as triggers, which is the field agents and directories actually match on.

What changed in the API

Nothing. Every fix here brings the skills into line with what the API already did. See the API changelog for the server side, in particular update_post gaining content and platforms patching in July.

How to update

npx skills add publora/skills

Two new install paths ship with this release: Claude Code and Codex plugin manifests, alongside the skills CLI.

Keeping it from drifting again

Prices are gone from the repo entirely and linked instead. CI now fails on a price literal, a stale config path, a link to a host we do not control, malformed frontmatter, or a broken link. A weekly job compares every documented MCP tool against the live tools/list and fails on any that does not exist, which is the check that would have caught the four phantom tools the week they went stale rather than six months later.

Full detail in CHANGELOG.md, and the rules in CONTRIBUTING.md.