Repository navigation
v3.2.1 — post-release hardening
Post-release hardening following the independent v3.2.0 audit and a CodeRabbit security review. 17 commits; no new features, no breaking changes.
What changed and why
Applied independent audit findings — the v3.2.0 review surfaced critical (C1), high (H1, H2), medium (M2, M4, M6, M8, M11), and low (L11) findings. C1 was a flag-shaped argument accepted as a positional skill name in the generator CLI — --flag passed as a skill name would silently create a broken skill. Promoted to error and rejected before execution. (#37)
Gate wiring into pre-commit hook — review_gate.py, pyright, and a version-consistency check were missing from the hook. Previously a commit could pass locally while blocking the package pipeline. The hook now runs quick-validate → lint → static-analysis → review-gate → pyright → version-check in order. (#39)
Security hardening — CodeRabbit's repository security review flagged six execution and packaging boundary issues: path traversal in skill loading, unsandboxed subprocess execution in skill_test, and missing input validation in the package compiler. Addressed in a dedicated security PR. (#40)