0.6.9
Added 6
- Advanced per-agent configuration guide for keeping SKILL.md frontmatter portable and pushing vendor-specific runtime controls into metadata or per-agent adapters
- Rejected skill-change ledger as an append-only record of proposed and rejected skill changes with eval scores to prevent re-litigation of the same ideas
- Documentation distinguishing between the standalone Copilot CLI and Copilot inside VS Code with their different invocation models
- Documentation on lifecycle phases explaining that spec, plan, and task artifacts are handoffs between sessions
- Documentation of the command-wrapper discoverability limitation for Antigravity
- Database-migration and dependency-audit vocabulary added to relevant skill descriptions for routing
Changed 3
- security-and-hardening skill now requires symlink resolution, an allowlisted root, minimum depth, and ownership check for destructive path operations
- Rate limiting in security-and-hardening skill now uses a shared store across instances instead of per-instance counters
- observability-and-instrumentation skill now stamps the entry point next to the correlation ID when runs start across multiple entry points
From agent-skills
Agent Skills 0.6.9 is a docs, hardening, and contributor-process release. No new skills this time; it sharpens the security and observability guidance in existing skills, adds setup and workflow docs, and lands a governance mechanism for the catalog's own development.
Highlights
- Advanced per-agent configuration guide (#316, @nucliweb). The canonical reference for keeping
SKILL.mdfrontmatter portable and pushing vendor-specific runtime controls (model, tools, turn limits, thinking level) intometadataor a per-agent adapter, so the same skill file works across Claude Code, Cursor, Gemini, Antigravity, and other spec-conformant clients. - Rejected skill-change ledger (#544, from #535). An append-only record of skill and description changes that were proposed and rejected, together with the eval score that rejected them, so the same idea does not get re-litigated in a new PR. Checking it is now a pre-flight step in CONTRIBUTING, and the ledger row lands on the default branch so closing the rejected PR cannot erase the record.
Hardening (existing skills)
- security-and-hardening: destructive path operations (delete, move, overwrite) now require symlink resolution, an allowlisted root, a minimum depth, and an ownership check read before the call (#547, @notbucki). And rate limiting must count in a shared store across instances, since a per-instance counter silently stops working the moment you run more than one instance (#536, @CahidArda).
- observability-and-instrumentation: when several entry points write to one log stream, stamp the entry point next to the correlation ID at the point the run starts. A correlation ID says which run; it does not say which code path started it (#546, @notbucki).
Docs
- Copilot: the standalone
copilotCLI (plugin install) and Copilot inside VS Code are separate setups with different invocation models, now documented as such (#550, @DEOWL-kan, addressing #542). - Lifecycle: the spec, plan, and task artifacts are the handoff between sessions. Run the whole lifecycle in one session for a small task; use a fresh session per phase for anything non-trivial (#549, @DEOWL-kan, from #513).
- Antigravity: the command-wrapper discoverability limitation is documented (#532, @ayobamiseun, from #445).
- Routing: database-migration and dependency-audit vocabulary added to the relevant skill descriptions (#537, @notbucki).
Thanks
Thanks to everyone who contributed this release: @nucliweb, @DEOWL-kan, @notbucki, @CahidArda, @ayobamiseun, @mvanhorn, and @federicobartoli.
Full Changelog: https://github.com/addyosmani/agent-skills/compare/0.6.8...0.6.9