addyosmani/agent-skills 0.6.15

Agent Skills 0.6.15

on GitHub

Agent Skills 0.6.15 stops the security skill's staged-secret check from printing the secret it finds, fixes two simplify-ignore bugs that could corrupt protected code, and makes the constraints skill's security and accessibility gates actually fail CI.

Security

• The staged-secret check no longer echoes credentials (#718, @santhiprakash, reported by @xmxxc in #717). The old git diff --cached | grep printed every matching line, so a staged key landed in the terminal and in any agent's transcript. It also read as clean when git failed. The check is now git diff --cached -i -G'…' --name-only: it prints only file names, and a git failure exits non-zero by itself. Fixed in all three places it was documented.

Hooks

• simplify-ignore restores re-indented placeholders cleanly (#766, @Quinnod345, #765). If /code-simplify un-indented a placeholder or edited its reason, Stop wrote back a broken comment around the block, a syntax error in any /* */ language. Blocks marked with -- simplify-ignore-start (SQL, Lua, Haskell) no longer warn that they were deleted, and a missing lock directory no longer stops Stop before every file is restored.

Skills

• Quality gates that fail when they should (#694, @mavericksea-ai, #693). Semgrep and axe exit 0 even with blocking findings, so the constraints skill's examples could pass CI while breaking the written bar. The skill now ships a small report gate that blocks high and critical findings, and it says to run each enforced command against a deliberate violation before calling it enforced.
• Contrast thresholds corrected (#733, @CybotTM): large text is 18pt (24px) or 14pt bold, not 18px.
• One-line gotchas from @CybotTM: compact well before the host's context limit, which varies by host (#739); keep a contradicting caller or guard in the doubt review unit (#754); and an injected exception isn't a crash, and a mocked transaction isn't a rollback (#750).
• git-workflow-and-versioning fires on a pasted diff (#758), and security-and-hardening names session cookies in its description (#759), both @ayobamiseun as part of #620.
• The shipping error boundary types its children prop (#683, @rudycelekli).

Evals

• --eval <id> runs a single behavioral case (#742, @CybotTM).
• The runner names any positive prompt that passes top_k without ranking first (#760), and the plugin-eval graders no longer expect command names that #714 removed, with the re-run recorded (#756), both @ayobamiseun.

Thanks

Thanks to everyone who contributed and reviewed this release: @santhiprakash, @xmxxc, @Quinnod345, @mavericksea-ai, @CybotTM, @ayobamiseun, @rudycelekli and @federicobartoli.

Full Changelog: 0.6.14...0.6.15