addyosmani/agent-skills 0.6.11

Agent Skills 0.6.11

on GitHub

Agent Skills 0.6.11 is a correctness and tooling release. A few fixes change what you actually get from the pack, so they come first; the rest tightens the evals, validators, and CI that keep the catalog honest.

Fixes worth knowing about

• The floor-guard reference now does what it promised (#600, @mavericksea-ai, fixes #599). The reference guard in constraint-driven-development silently passed on untracked suppressions, deleted test files, and loosened maximum budgets, 7 of the 14 cases it claimed to catch. It now catches all of them, respects .gitignore, and has a test suite in CI. If you adapted it into your own project, pull the new version.
• security-and-hardening is slimmer and keeps its rules (#579, @Syamsuddin; #589, @nucliweb). Code patterns moved into a skill-local references/hardening-patterns.md, cutting SKILL.md from 524 to 216 lines. The condensed prose had dropped a few rules, and #589 restores them: sameSite as the CSRF defense, npm audit signatures / pnpm audit signatures, retention with a working deletion path, and validating every tool argument an LLM passes.
• simplify-ignore no longer corrupts restored blocks on bash 5.2 (#501, @ayobamiseun). With patsub_replacement on by default, & and backslashes in protected code were mangled on restore. Fixed, with sdd-cache and simplify-ignore regression suites now running in CI.
• code-review-and-quality fires on pasted diffs and pull requests (#612, @federicobartoli), a finding from the plugin eval pilot below.

Skills

• interview-me stops its turn once intent is confirmed instead of starting downstream work (#497, @Varun-Chinthoju).
• frontend-ui-engineering adds reference-led finish checks: references as evidence, never templates (#496, @samuelbushi).

Evals

• claude plugin eval pilot (#596, #611, @federicobartoli): loads the whole plugin and measures whether Claude Code's own router picks a skill and what it adds to the reply. On demand only, scoped to evals/plugin/ through the manifest.
• Graders are stricter: stale grading from a crashed run can no longer pass as current, and runs record their identity (#587, @mavericksea-ai); the ADR eval grades status and date instead of an expectation the skill never states (#598, @mavericksea-ai); negative trigger cases now name their owner, so they can't pass vacuously (#493, @Zlobin-K).

Validators and CI

• Validators run on macOS and Windows as well as Linux (#590, @ayobamiseun).
• Links inside a skill's own references/ files are now checked (#588, @nucliweb, fixes #585), on shared CommonMark fence parsing (#586, @ayobamiseun).
• Frontmatter must be valid YAML for both skills and commands (#594, #595), negated trigger clauses are all stripped rather than only the first (#605), and the skill-anatomy layout rules plus a 500-line SKILL.md budget are enforced (#571), all @abhisheksharma2411.
• The artifact-path guard covers every command surface, including the Gemini and root TOML copies (#607, @ayobamiseun).
• Manifest versions are validated against the root plugin.json rather than the latest git tag (#498, @aoright).

Thanks

Thanks to everyone who contributed and reviewed this release: @nucliweb, @federicobartoli, @mavericksea-ai, @ayobamiseun, @abhisheksharma2411, @Syamsuddin, @aoright, @Zlobin-K, @samuelbushi, and @Varun-Chinthoju.

Full Changelog: 0.6.10...0.6.11