v1.21.0

What's New

Trust Badges on Install

Install confirmation now shows trust level for each skill:

• [Official] for known sources (Anthropic, Vercel, Expo, Remotion, Supabase, Stripe)
• [Trusted] / [Review] / [Caution] for community sources via TrustScorer

Checksum-Based Update Detection

skillkit update no longer blind-clones. It checks GitHub pushed_at first, then compares SHA-256 checksums after clone. Unchanged skills are skipped. Use --force to bypass.

Centralized Lock File

All installed skills tracked in ~/.skillkit/lock.json — source, checksum, agents, timestamps. Written on install, updated on update, cleaned on remove.

Custom Taps

skillkit tap add owner/repo --name "My Skills"
skillkit tap list
skillkit tap remove owner/repo

User-managed source repositories stored at ~/.skillkit/taps.json. Tap sources appear in search results.

Federated Search by Default

skillkit find now always includes GitHub API results. No need for --federated flag. Use --no-federated to disable.

Quarantine Cleanup

Temp directories are always cleaned up via finally, even when users cancel prompts or errors occur mid-flow.

Direct Publish via CLI

skillkit publish submit creates GitHub issues directly via gh CLI with quality score, stars, and push date. Auto-publish workflow merges submissions with quality >= 75 automatically.

Documentation

• Agent count updated to 45 across all docs, website, and metadata
• Full command docs for tap, check, update, remove, publish submit
• Trust badges, lock.json, and taps.json documented in configuration and security docs