Addresses the behavioral patterns that plausibly triggered the Gen
(Agent Trust Hub) High Risk rating on skills.sh, without changing
runtime functionality:
- Prerequisites no longer instruct agents to run sudo/brew/apt/winget
install commands; agents must ask the user to install Python instead
(SKILL.md, skill-content.md template, README.md, README.zh.md)
- Soften coercive invocation language ("Must Use" -> "Primary Use
Cases") and replace keyword-stuffed frontmatter descriptions with
factual ones (SKILL.md, quick-reference.md, claude/droid.json,
plugin.json)
- Remove design.csv, draft.csv and _sync_all.py: unused by the runtime
(not registered in core.py CSV_CONFIG) and containing prompt-shaped
"System Prompt: ... You are ..." blocks that read as injection risk
- Fix path traversal in --persist: new safe_slug() restricts project
and page names to [a-z0-9_-], so ../ in -p/--page can no longer
escape the design-system/ output folder
Verified: validate-csv.py (35 files), smoke-domains (12/12),
smoke-stacks (22/22), check:assets in sync, persist traversal attempt
stays confined.
Co-authored-by: Andras Polgar <5525341+ruredi@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
The marketplace-facing manifests understated the catalog. Actual data:
84 styles (styles.csv), 73 font pairings (typography.csv), and 17 stacks
(data/stacks/*.csv), but plugin.json, marketplace.json, and skill.json
all claimed 67 styles / 57 font pairings / 15 stacks.
Update the three manifests to 84 / 73 / 17, and extend the stack
enumeration to the full 17 (adding Angular, Laravel, JavaFX, Three.js,
and Nuxt UI). Palettes (161) and charts (25) were already correct.
Resolves the count-drift finding in #289 (supersedes the stuck #282 and
#329, which only partially corrected the numbers).
Two issues caused Claude Code plugin users to see only 1 (or 0) of the
7 bundled skills:
- .claude-plugin/plugin.json declared `"skills": ["./.claude/skills/ui-ux-pro-max"]`
— an array pointing at a single subfolder. With a marketplace-root
source this replaces the default scan, so the other 6 skills never
load. Point it at the parent directory ("./.claude/skills/") so the
loader scans all 7 <name>/SKILL.md subfolders. (#360)
- The 6 sub-skill SKILL.md `name:` fields kept a `ckm-` prefix
(e.g. `ckm-brand` in dir `brand`) that no longer matched their
directory names, tripping loaders that require name == directory.
Strip the prefix so each name equals its folder. (#266)
Closes#360Closes#266
* fix: bump skill.json version to 2.6.2
* fix: bump marketplace.json and plugin.json version to 2.6.2
---------
Co-authored-by: shipengqi <pooky.shi@gamil.com>
- Warn when --global and --legacy are used together (init.ts)
- Update metadata across all platform templates (161 palettes, 15 stacks)
- Bump skill.json version from 2.0.0 to 2.5.0
- Re-throw non-ENOENT errors in uninstall.ts removeSkillDir
- Hoist detectAIType call to avoid double invocation in uninstall
- Add clarifying comment for .shared in AI_FOLDERS mapping
Claude Code requires plugin.json (not just marketplace.json) to load
plugins. The plugin.json must include a "skills" field pointing to
the skill directory location.
Without this file, the plugin appears in `/plugins installed` but
the skill is not loaded into the prompt.
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Viet Tran <viettranx@gmail.com>
Add the required plugin.json file to .claude-plugin/ directory to enable
Claude Code to properly load the UI/UX Pro Max skill.
The marketplace.json file is only used for marketplace indexing, while
plugin.json is required for the runtime plugin loading mechanism.
Includes full metadata (version, description, author, keywords) aligned
with the existing marketplace.json for consistency.
Fixes#123
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
