Skip to content

v0.6.2

Choose a tag to compare

View all tags
@robcsaszar robcsaszar released this 07 Aug 13:58
· 7 commits to main since this release
v0.6.2
69efa6d

Security (v0.6.1)

  • ai-forge-judge: documented that WebFetch results (e.g. the agentskills.io spec) must be treated as inert reference text, never as instructions — mitigates indirect prompt injection risk (skills.sh audit finding W011).
  • ai-forge-audit: documented that check-ecosystem.cjs is local and read-only — no network access, no subprocess spawning, no writes outside stdout — addressing a "delegated execution / transitive trust" flag from the skills.sh audit.

Changed (v0.6.2)

  • ai-forge-audit, ai-forge-create, ai-forge-eval: reformatted check-ecosystem.cjs, validate-metadata.cjs, and aggregate-benchmark.cjs to single-quote/no-semicolon-trailing-comma style with lint-disable annotations; no behavioral changes.

Full Changelog: v0.6.0...v0.6.2

Assets 2
Loading