feat: achieve full compliance with Agent Skills spec#117
Merged
Conversation
- Replace skill.yaml/skill.json with SKILL.md YAML frontmatter parsing - Drop inputSchema/outputSchema fields (not part of Agent Skills spec) - Add license, compatibility, metadata, allowed-tools fields - Implement progressive disclosure (catalog + getSkillBody) - Rewrite validator with lenient spec constraint enforcement - Replace fork with spawn in sandbox runner for cross-language support - Add cross-client directory scanning (.agents/skills/) - Remove skills_list from tool permissions, keep skill_view for TUI - Add trustProjectSkills and skillScanPaths config defaults - Update full test suite for new skill discovery and validation
Add ensureSkillsDir() similar to ensureSessionsDir() so the application creates the skills/ directory on startup, matching the initialization pattern used for memory/sessions/.
The directory contains only skill-specific modules (dispatcher, types, validator, permissions, registry). Renaming to 'skills' matches the naming convention used for the skills/ directory and is more intuitive.
Fix TypeError: the barrel export (src/skills/index.js) was missing ensureSkillsDir, so index.js could not call it.
- Remove dead code from validateSkillName (regex already covers hyphen rules) - Log reason when skill is rejected for validation failures (name mismatch) - Emit warning when .agents/skills shadows a previously found skill
avoidwork
changed the title
Prepend generated skill catalog to the system prompt so the model knows what tools are available for the task. Catalog follows the system prompt and precedes memory entries.
All incomplete tasks were verified as actually implemented. Updated tasks.md to reflect reality.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Complete implementation compliant with the Agent Skills specification. Skills are discovered from
SKILL.mdfiles using YAML frontmatter parsing, validated against spec constraints, and loaded progressively for minimal token usage.Spec Compliance
Frontmatter Fields
Directory Structure
skill-name/directories containingSKILL.md(required)scripts/,references/,assets/directories supportedProgressive Disclosure
name,description, andlocationloaded at startupChanges
Core Implementation
src/skills/discoverer.js: SKILL.md frontmatter parsing with YAML error recovery, recursive directory scanning, dotfile/node_modules filtering, .agents/skills/ shadow detectionsrc/skills/validator.js: Spec-compliant validation of name, description, and optional fields with lenient warning-based approachsrc/skills/registry.js: SkillRegistry with getCatalog() for tier 1, getSkillBody() for tier 2, progressive disclosure lifecycle, error logging for silent rejectionssrc/skills/types.js: Zod schemas for metadata, permissions, and execution contextTool Integration
src/tools/skills.js: Updated to use catalog-based API, generates skill catalog prompt for system injectionsrc/tools/index.js: Updated tool factories and permissionsSafety Improvements
.agents/skills/skills that override others produce console.warnTesting
tests/unit/Threat Model