skillmeld 0.3.0 — a wider security gate and a scout for SkillsMP
Four new core rules close gaps a taxonomy coverage benchmark surfaced, NVIDIA SkillSpector joins the optional scanners, the weekly catalog build detects licenses with scancode, and a new scout searches the SkillsMP registry for candidates.
skillmeld 0.3.0 widens the security gate. Four core rules cover cron and login persistence, ClickFix-style paste-to-fix lures, and directed false reassurance, and a coverage benchmark now maps every publicly named category of the agentskill.sh threat model to at least one live rule. NVIDIA SkillSpector joins semgrep and gitleaks as a PATH-optional, escalate-only scanner that always runs without an LLM, so scanned content stays on the machine. The weekly catalog build consults scancode-toolkit for license texts the lightweight fingerprints cannot identify, keeping gold-standard SPDX detection in the signed catalog while the client stays light. A new skillsmp-scout command runs budget-capped discovery over the SkillsMP registry and prints candidate repositories; catalog membership stays a hand-curated decision. Also in this release: a scan without an optional scanner now says so plainly, the quality gate warns instead of failing on inherited html-like tags, marketplace emit carries a version so plugin updates see a re-composition, and cryptography moved to 50.0.
Read the source