feat(skills): add metadata.author "AutoVault" and source for host UI grouping - #98
Open
jack-arturo wants to merge 4 commits into
Open
feat(skills): add metadata.author "AutoVault" and source for host UI grouping#98jack-arturo wants to merge 4 commits into
jack-arturo wants to merge 4 commits into
Conversation
…grouping - Make metadata schema tolerant of author/source via .passthrough() - Add getMetadata, extractAuthor, extractSource helpers (parse-aware) - Extend SkillSummary with author and source (from frontmatter metadata) - Return author + frontmatter_source (distinct from provenance source) from get_skill - Declare author + source on AutoVault curated skills pre-existing on main - Update skill-author guidance, autovault-skill docs, README, and test - Enables Grok (and other hosts) to group AutoVault skills like Resend ones' "Resend" attribution
Contributor
Author
|
/copilot-review |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds publisher-style attribution metadata (metadata.author and metadata.source) to curated AutoVault skills and surfaces that attribution in skill list/get outputs so host UIs can group and label skills by publisher.
Changes:
- Allow extra keys in
metadataduring schema validation and add helpers to extractauthor/sourcefrom frontmatter. - Extend stored skill summaries and
get_skilloutput to includeauthorplus frontmattersource(asfrontmatter_sourceinget_skill). - Update bundled meta skills, README docs, and tests to reflect/verify the new fields.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/list-search-get.test.ts | Updates tests and fixtures; should additionally assert new author/frontmatter source fields in listSkills() output. |
| src/validation/schema.ts | Adjusts zod schema so metadata accepts extra keys via .passthrough(). |
| src/validation/frontmatter.ts | Adds getMetadata / extractAuthor / extractSource helpers (needs parse-error guarding). |
| src/types.ts | Adds optional author and source fields to SkillSummary (naming differs from PR description). |
| src/tools/get-skill.ts | Exposes author and frontmatter_source in get_skill responses while keeping provenance source object. |
| src/storage/index.ts | Persists author and frontmatter source in SkillSummary / readSkillSummary. |
| skills/skill-author/SKILL.md | Adds metadata.author / metadata.source and updates guidance examples. |
| skills/autovault-skill/SKILL.md | Adds metadata.author / metadata.source and updates documentation text. |
| README.md | Documents metadata.author/metadata.source in the validation gate section (formatting/text needs a small correction). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
280
to
285
| 5. Cross-check declared capabilities against observed behavior. | ||
|
|
||
| Skills may include `metadata.author` and `metadata.source` (see Agent Skills spec). | ||
| AutoVault-curated skills ship with `author: AutoVault` so hosts can group and | ||
| attribute them in skill browsers (matching how Resend skills appear as "Resend"). | ||
| 6. Deduplicate exact, near-exact, and functionally similar proposals. |
Contributor
Author
There was a problem hiding this comment.
The relevant lines were updated in the follow-up commit (formatting corrected and reference clarified to metadata.author). This thread is now outdated relative to the current diff.
- Guard getMetadata() parse with try/catch (return {} on error)
- Fix README list formatting and clarify metadata.author reference
- Rename SkillSummary field to frontmatter_source for consistency with get_skill
- Update test md() fixture and listSkills assertions for new author/frontmatter_source fields
- Propagate field rename in buildSummary / readSkillSummary / getSkill
Contributor
Author
|
/copilot-review |
…pe pollution - getMetadata now returns a null-prototype object and copies only own enumerable properties (skips __proto__/constructor/prototype). - buildSummary now uses Object.hasOwn before reading metadata.author / .source / .version. - These were flagged as high-severity in Copilot review on current head. - Matches existing repo defenses (FORBIDDEN_PATH_SEGMENTS, hasForbiddenPathSegment, etc.).
Contributor
Author
|
/copilot-review |
| return Object.create(null); | ||
| } | ||
| // Defend against prototype pollution (repo already forbids __proto__ etc in other paths). | ||
| // Copy only own enumerable properties into a null-prototype object. |
Contributor
Author
|
/copilot-review |
Comment on lines
+59
to
+62
| const rawMeta = (data as Record<string, unknown>).metadata; | ||
| if (typeof rawMeta !== "object" || rawMeta === null || Array.isArray(rawMeta)) { | ||
| return Object.create(null); | ||
| } |
Comment on lines
+326
to
+327
| const author = Object.hasOwn(metadata, "author") && typeof metadata.author === "string" && metadata.author.length > 0 ? metadata.author : undefined; | ||
| const frontmatterSource = Object.hasOwn(metadata, "source") && typeof metadata.source === "string" && metadata.source.length > 0 ? metadata.source : undefined; |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add
metadata.author: AutoVault(andmetadata.source) to curated AutoVault skills. This follows the Agent Skills spec convention used by publishers like Resend so that host UIs (Grok, etc.) can group and attribute skills.getMetadata,extractAuthor,extractSource.SkillSummaryandget_skillnow exposeauthorandfrontmatter_source.main, docs, test, and README.Other bundled skill updates remain on the current feature branch (their source files landed via the render-fidelity work).
Changes
src/validation/schema.ts,frontmatter.tssrc/types.ts,storage/index.tssrc/tools/get-skill.tsskills/{autovault-skill,skill-author}/SKILL.md+ docsREADME.md+tests/list-search-get.test.tsVerification
npm run buildget_skillverified to surface the fieldsThis is additive and keeps 3rd-party skill authorship intact.