Pin copy-pasteable npx invocations to explicit versions so agents
executing them verbatim get reproducible behavior:
- playwright docs: npx playwright@1.62.1 (SKILL.md, README.md,
references 02-selectors / 05-ci-integration / 07-accessibility)
- mermaid-diagrams: @mermaid-js/mermaid-cli@11.16.0 (SKILL.md,
references/pdf-rendering-pipeline.md)
- hugo-theme seo-outputs-testing: @axe-core/cli@4.13.0
- agent-skills using-scripts.md: strengthen version-pinning bullet
into a normative rule for copy-pasteable commands
Reword the anydoc cli-reference "Version pinning" prose so the
anti-pattern is explained didactically without presenting an unpinned
command as a recipe; the @0.1.6 house pin is unchanged.
Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
Adds references/vetting-third-party-skills.md with a dependency-style
vetting checklist (provenance, SKILL.md body, scripts, references),
safe first-run practice, and reporting guidance, citing the Snyk
ToxicSkills audit as the primary source for ecosystem risk statistics.
SKILL.md gains the match-prescriptiveness-to-fragility decision rule,
the run-vs-reference intent rule for bundled scripts, and an
Adopting Third-Party Skills section. README and eval manifest updated.
Closes#311
2026-08-12 00:44:58 -04:00
Magnus HedemarkGitHubfactory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
* feat(validation): enforce 60K-char cap on skill reference files
Implements issue #277:
- validate-references.rb: new oversized_reference_errors check — every
references/*.md must be <= 60,000 characters; error reports path, size,
and the split-and-reindex remediation; wired into validate-skills.rb
- test-validate-skills.rb: 5 fixture tests (under-limit passes, over-limit
fails with path+size, exactly-at-limit passes, remediation message,
non-.md ignored); the suite now runs in validate.yml after the format
check (it was previously untested in CI)
- Docs: agent-skills/SKILL.md, agent-skills/references/best-practices.md,
and the AGENTS.md Format Compliance table document the cap and the
split-and-reindex procedure
- Compliance: split remote-systems-administration/references/ansible.md
and programming-principles/references/refactoring-guru.full.md into an
index + focused parts (content moved verbatim); SKILL.md routing,
README, and source-index references updated; pre-existing stale
refactoring-guru-smells.md reference repointed to the index
- Fix pre-existing quality-gate violations in the programming-principles
and remote-systems-administration descriptions (imperative verb +
negative boundary) so this PR's CI quality step passes; regenerated
llms.txt and marketplace artifacts
Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
* test(evals): add eval manifests to modified skills for ratchet
The eval-coverage ratchet requires schema-valid eval manifests for any
skill modified once coverage is past 50%. This PR modifies
programming-principles and remote-systems-administration (splitting
their oversized references), so add evals/evals.json to both:
- programming-principles: 6 output-quality cases (task-to-book mapping,
principled code review, refactor-vs-rewrite, no-op detection, rule
distillation, principle conflicts)
- remote-systems-administration: 6 output-quality cases (discovery
before change, smallest control plane, rollback planning, platform
identification, verification evidence, escalation on missing
authority)
Coverage: 87/145 (60.0%) schema-valid; ratchet clean.
Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
---------
Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
SKILL.md distills the full specification from agentskills.io — directory
structure, frontmatter schema, naming rules, progressive disclosure model,
and best practices for skill creation. Includes all 8 source pages as
reference files for on-demand loading.
Magnus Hedemarkandfactory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
Magnus Hedemark