Skip to main content
Full guide: CONTRIBUTING.md in the repo. Summary:

​
Before opening a PR

All three run again in CI on every PR — running them locally first just saves a round trip.

​
Adding or changing a skill

Update skills/<name>/SKILL.md, then update the skill table and layout tree in the repo’s README.md — validate.py fails the PR if a skill directory isn’t mentioned there. New templates go in templates/ and must be referenced from the skill that uses them.

​
Changing the CLI or installer

bin/cli.mjs (npx) and install.sh (bash) are meant to behave identically. validate.py runs both for real and checks the resulting tree — a behavior drift between them fails CI.

​
Security

Found a vulnerability? See SECURITY.md — please don’t open a public issue for it.

​
Release process (maintainer-only)

Bumping package.json’s version and merging to main triggers the publish workflow: validate, tag, GitHub Release, npm publish --provenance. Contributors don’t need to think about this.