v0.1.0 — the safety release

0.1.0

Minor Changes

• Warn on plaintext secrets at write time — add/add-json now scan env/headers for known token patterns and warn on stderr and in --json (values never printed). New --from-env KEY resolves secrets from the process environment so they never touch the command line or LLM conversation context: pnpx nopeek run .env --only GITHUB_TOKEN -- mcpick add ... --from-env GITHUB_TOKEN. Also warns on unpinned npx -y <pkg> and @latest server args.
• mcpick doctor — read-only validation of every known client config: JSON validity, per-client schema shape, missing commands on PATH, duplicate servers across scopes, plaintext secrets, and unpinned server packages. Exits non-zero on errors; --json for CI and agents.
• Skills backend replaced — the unpinned npx -y skills@latest passthrough is gone. Skills now install via the GitHub CLI's gh skill commands, staged in a temp dir and validated with check-skills before anything is written to your agent directories. Every install records provenance (source repo, pinned ref, target agents), shown in skills list --json.
  • Adds skills search / skills preview, add --pin / --all, update --dry-run / --unpin.
  • Breaking for scripts: skills remove exits 1 with manual deletion paths (gh skill has no uninstall); skills add --yes now defaults to false; windsurf agent and --copy/--full-depth flags removed. Requires an authenticated gh CLI.

Patch Changes

• Document new gh skill backend, doctor command, --from-env secrets flow, and refreshed CLI help examples