skill-index-updater

Name: skill-index-updater
Author: luongnv89

742stars61forks

How to install skill-index-updater?

luongnv89/asm/skill-index-updater

$npx -y skills add luongnv89/asm --skill skill-index-updater

Installs into the current project.

Summary

Add GitHub skill repos to the ASM index: clone, audit, eval, regenerate index, rebuild catalog, open PR. Use when given GitHub URLs to onboard. Don't use for authoring (skill-creator), improving (skill-auto-improver), or install (asm install).

Files · 1

View on GitHub

SKILL.md

1	# Skill Index Updater
2
3	You are adding new skill repository sources to the ASM (Agent Skill Manager) curated index. This is the pipeline that powers the skill catalog at https://luongnv.com/asm/ — every repo you add here becomes discoverable and installable by thousands of users.
4
5	## Example
6
7	```
8	User: add github.com/anthropics/skills to the index
9	Skill output:
10	Step 1: Parsed 1 URL → anthropics/skills (NEW)
11	Step 2: Discovered 14 SKILL.md files
12	Step 3: Audit OK on 14/14, eval scores 71–94
13	Step 6–8: data/skill-index-resources.json + data/skill-index/anthropics_skills.json updated, catalog rebuilt
14	Step 10: PR #312 opened — feat(index): add anthropics/skills (14 skills)
15	```
16
17	## Repo Sync Before Edits (mandatory)
18
19	Before modifying any files, pull the latest remote branch:
20
21	```bash
22	branch="$(git rev-parse --abbrev-ref HEAD)"
23	git fetch origin
24	git pull --rebase origin "$branch"
25	```
26
27	If the working tree is dirty: stash, sync, then pop. If `origin` is missing or conflicts occur: stop and ask the user before continuing.
28
29	## Input
30
31	The user provides one or more GitHub repository URLs. These can be in various formats:
32
33	- `https://github.com/owner/repo`
34	- `github.com/owner/repo`
35	- `github:owner/repo`
36	- `owner/repo` (shorthand)
37
38	Normalize all inputs to extract `owner` and `repo`.
39
40	## Pipeline
41
42	Follow these steps in order. Each step has a verification check — do not proceed to the next step if verification fails.
43
44	### Step 1: Parse and Validate Input URLs
45
46	For each URL provided:
47
48	1. Extract `owner` and `repo` from the URL
49	2. Verify the repository exists by checking `https://api.github.com/repos/{owner}/{repo}`
50	3. Check if the repo is already in `data/skill-index-resources.json` — if so, mark it for update instead of add
51
52	Output a summary table:
53
54	```
55	\| # \| Owner/Repo \| Status \| Notes \|
56	\|---\|---------------------\|----------\|--------------------------\|
57	\| 1 \| owner/repo \| NEW \| Will be added \|
58	\| 2 \| other/repo \| EXISTS \| Will be re-indexed \|
59	\| 3 \| bad/repo \| INVALID \| 404 - repo not found \|
60	```
61
62	If ALL repos are invalid, stop and tell the user.
63
64	### Step 2: Discover Skills in Each Repository
65
66	For each valid repository, clone it to a temp directory and scan for SKILL.md files (up to 5 levels deep). This is what the ASM tool does internally, and we replicate the logic here:
67
68	```bash
69	# Clone to temp
70	TEMP_DIR=$(mktemp -d)
71	git clone --depth 1 "https://github.com/{owner}/{repo}.git" "$TEMP_DIR/{repo}"
72
73	# Find SKILL.md files (max 5 levels deep, matching ASM's discoverSkills)
74	find "$TEMP_DIR/{repo}" -maxdepth 5 -name "SKILL.md" -type f
75	```
76
77	`discoverSkills` (used by `asm index ingest` and preindex) indexes a root `SKILL.md` when present and continues scanning subdirectories for additional skills. A repo with both root and nested skills should list every skill in the index entry — not only the root.
78
79	For each discovered SKILL.md, parse the YAML frontmatter to extract:
80
81	- `name` (required)
82	- `description` (required)
83	- `version` (defaults to "0.0.0")
84	- `license`
85	- `creator`
86	- `compatibility`
87	- `allowed-tools` / `allowedTools`
88
89	Report how many skills were found per repo. If a repo has zero SKILL.md files, flag it and ask the user whether to still include it (it might have skills added later).
90
91	### Step 3: Audit and Evaluate Discovered Skills
92
93	For each discovered skill, perform two checks — a lightweight audit and a quality evaluation using `asm eval`. Both run against the temp clone from Step 2; do not re-clone.
94
95	#### 3a. Lightweight audit
96
97	1. Frontmatter completeness: Does it have at minimum `name` and `description`?
98	2. Content check: Does the SKILL.md have meaningful instruction content (not just frontmatter)?
99	3. Security scan: Check for suspicious patterns in the skill files:
100	- Shell execution (`exec`, `spawn`, `child_process`, `bash -c`)
101	- Network access (`curl`, `wget`, `fetch(`, `axios`)
102	- Credential patterns (`API_KEY=`, `SECRET_KEY=`, `PASSWORD=`)
103	- Obfuscation (`atob(`, base64 encoded strings, hex escape sequences)
104
105	This is a lightweight check — the full security audit runs when users install individual skills via `asm install`. The goal here is to catch obvious red flags before adding a repo to the curated index.
106
107	#### 3b. Quality evaluation with `asm eval`
108
109	Run `asm eval` on each discovered skill directory and capture the JSON report. This gives reviewers a quality signal (structure, description, prompt engineering, safety, testability, na

People who liked this also viewed

6 picks

Type

skill-index-updater

742stars61forks

View on GitHub

How to install skill-index-updater?

luongnv89/asm/skill-index-updater

$npx -y skills add luongnv89/asm --skill skill-index-updater

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Skill Index Updater
2
3	You are adding new skill repository sources to the ASM (Agent Skill Manager) curated index. This is the pipeline that powers the skill catalog at https://luongnv.com/asm/ — every repo you add here becomes discoverable and installable by thousands of users.
4
5	## Example
6
7	```
8	User: add github.com/anthropics/skills to the index
9	Skill output:
10	Step 1: Parsed 1 URL → anthropics/skills (NEW)
11	Step 2: Discovered 14 SKILL.md files
12	Step 3: Audit OK on 14/14, eval scores 71–94
13	Step 6–8: data/skill-index-resources.json + data/skill-index/anthropics_skills.json updated, catalog rebuilt
14	Step 10: PR #312 opened — feat(index): add anthropics/skills (14 skills)
15	```
16
17	## Repo Sync Before Edits (mandatory)
18
19	Before modifying any files, pull the latest remote branch:
20
21	```bash
22	branch="$(git rev-parse --abbrev-ref HEAD)"
23	git fetch origin
24	git pull --rebase origin "$branch"
25	```
26
27	If the working tree is dirty: stash, sync, then pop. If `origin` is missing or conflicts occur: stop and ask the user before continuing.
28
29	## Input
30
31	The user provides one or more GitHub repository URLs. These can be in various formats:
32
33	- `https://github.com/owner/repo`
34	- `github.com/owner/repo`
35	- `github:owner/repo`
36	- `owner/repo` (shorthand)
37
38	Normalize all inputs to extract `owner` and `repo`.
39
40	## Pipeline
41
42	Follow these steps in order. Each step has a verification check — do not proceed to the next step if verification fails.
43
44	### Step 1: Parse and Validate Input URLs
45
46	For each URL provided:
47
48	1. Extract `owner` and `repo` from the URL
49	2. Verify the repository exists by checking `https://api.github.com/repos/{owner}/{repo}`
50	3. Check if the repo is already in `data/skill-index-resources.json` — if so, mark it for update instead of add
51
52	Output a summary table:
53
54	```
55	\| # \| Owner/Repo \| Status \| Notes \|
56	\|---\|---------------------\|----------\|--------------------------\|
57	\| 1 \| owner/repo \| NEW \| Will be added \|
58	\| 2 \| other/repo \| EXISTS \| Will be re-indexed \|
59	\| 3 \| bad/repo \| INVALID \| 404 - repo not found \|
60	```
61
62	If ALL repos are invalid, stop and tell the user.
63
64	### Step 2: Discover Skills in Each Repository
65
66	For each valid repository, clone it to a temp directory and scan for SKILL.md files (up to 5 levels deep). This is what the ASM tool does internally, and we replicate the logic here:
67
68	```bash
69	# Clone to temp
70	TEMP_DIR=$(mktemp -d)
71	git clone --depth 1 "https://github.com/{owner}/{repo}.git" "$TEMP_DIR/{repo}"
72
73	# Find SKILL.md files (max 5 levels deep, matching ASM's discoverSkills)
74	find "$TEMP_DIR/{repo}" -maxdepth 5 -name "SKILL.md" -type f
75	```
76
77	`discoverSkills` (used by `asm index ingest` and preindex) indexes a root `SKILL.md` when present and continues scanning subdirectories for additional skills. A repo with both root and nested skills should list every skill in the index entry — not only the root.
78
79	For each discovered SKILL.md, parse the YAML frontmatter to extract:
80
81	- `name` (required)
82	- `description` (required)
83	- `version` (defaults to "0.0.0")
84	- `license`
85	- `creator`
86	- `compatibility`
87	- `allowed-tools` / `allowedTools`
88
89	Report how many skills were found per repo. If a repo has zero SKILL.md files, flag it and ask the user whether to still include it (it might have skills added later).
90
91	### Step 3: Audit and Evaluate Discovered Skills
92
93	For each discovered skill, perform two checks — a lightweight audit and a quality evaluation using `asm eval`. Both run against the temp clone from Step 2; do not re-clone.
94
95	#### 3a. Lightweight audit
96
97	1. Frontmatter completeness: Does it have at minimum `name` and `description`?
98	2. Content check: Does the SKILL.md have meaningful instruction content (not just frontmatter)?
99	3. Security scan: Check for suspicious patterns in the skill files:
100	- Shell execution (`exec`, `spawn`, `child_process`, `bash -c`)
101	- Network access (`curl`, `wget`, `fetch(`, `axios`)
102	- Credential patterns (`API_KEY=`, `SECRET_KEY=`, `PASSWORD=`)
103	- Obfuscation (`atob(`, base64 encoded strings, hex escape sequences)
104
105	This is a lightweight check — the full security audit runs when users install individual skills via `asm install`. The goal here is to catch obvious red flags before adding a repo to the curated index.
106
107	#### 3b. Quality evaluation with `asm eval`
108
109	Run `asm eval` on each discovered skill directory and capture the JSON report. This gives reviewers a quality signal (structure, description, prompt engineering, safety, testability, na

People who liked this also viewed

6 picks

Type