Changelog

Changelog

All notable changes to the **Antigravity Awesome Skills** collection are documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

---

[Unreleased]

[7.9.2] - 2026-03-15 - "npm CLI Packaging Fix"

**Patch release to fix the published npm CLI bundle so `npx antigravity-awesome-skills` resolves its runtime helper modules correctly**

This release fixes a packaging regression in the published npm artifact. Version `7.9.1` shipped `tools/bin/install.js` without the required `tools/lib` runtime helpers, causing `npx antigravity-awesome-skills` to fail with `MODULE_NOT_FOUND` for `../lib/symlink-safety`.

New Skills

• None in this release — 7.9.2 is a focused patch release for the npm installer bundle.

Improvements

• npm package contents: Expanded the published files whitelist to ship tools/lib/* alongside tools/bin/*, restoring the runtime dependency required by the installer entrypoint.
• Regression coverage: Added a package-contents test that checks npm pack --dry-run --json and asserts the published tarball includes both tools/bin/install.js and tools/lib/symlink-safety.js.
• CLI verification: Verified the extracted packaged entrypoint runs successfully with --help, confirming the published layout no longer reproduces the missing-module crash reported in issue #315.

Credits

• Issue #315 reporter for isolating the npm packaging regression in the published CLI artifact.

[7.9.1] - 2026-03-15 - "Security Hardening Follow-up"

**Follow-up release to 7.9.0: same security batch, additional hardening focused on mutating endpoints, markdown rendering, and doc-risk enforcement**

This release is a companion follow-up to `7.9.0` and applies security controls for the web app runtime, runtime refresh endpoint, and documentation quality gates.

New Skills

• None in this release — this is a follow-up security maintenance release.

Improvements

• Endpoint hardening (mutating API): The /api/refresh-skills endpoint is now protected by strict local-only ingress rules, explicit token support (SKILLS_REFRESH_TOKEN when configured), explicit method validation, and explicit host/Origin checks before any state-changing logic runs.
• Front-end hardening: Added POST-only sync from UI and removed unsafe HTML passthrough (rehype-raw) from SkillDetail, reducing the runtime XSS surface.
• Documentation risk controls: Added a full-repo SKILL.md security scan for dangerous command patterns (curl|bash, wget|sh, irm|iex, obvious command-line token examples), with opt-in comment allowlisting.
• Security test coverage: Added dedicated security tests for endpoint authorization/host/token behavior and markdown rendering behavior, and wired docs security checks into the shared test and CI pipeline.
• Tooling robustness: Impro