Repository navigation
skill/plugin 0.1.3: address Anthropic directory validator findings - #39
Open
alexshapalov wants to merge 1 commit into
Open
alexshapalov wants to merge 1 commit into
alexshapalov wants to merge 1 commit into
Conversation
The developer-portal validation of pgrundev/pgx-plugin (main @ cc5c211) passed with 11 warnings and 4 policy holds. This addresses the ones the report's fix hints point at, without changing what the skill does: - Pin every package the skill installs or launches to an exact version: npm i -g pgxdb@0.1.2 and npx pgxdb@0.1.2 instead of unpinned or @latest (SKILL.md, installation.md, security.md, check-pgx.sh hints, plugin README). - The piped remote installer (curl … | sh) is no longer something the skill runs or tells Claude to run; it stays documented in installation.md as a command the user runs in their own shell, and the skill is told never to pipe a download into a shell on the user's behalf. - Plugin README discloses exactly what detect-project.sh reads on the machine (DATABASE_URL and .env* files, printing host/port/db only) and where the connection string goes (pgx copy on the local machine, never the conversation, never elsewhere). Reading the project's own database URL is inherent to the plugin and remains a reviewer hold. - Version 0.1.2 -> 0.1.3 for the plugin and the skill so installed users receive the change; the runtime requirement stays PGX 0.1.2 or newer. The skill version now moves independently of the runtime version. Not addressed here: the icon (no PGX logo asset exists in the repository; the directory fixes the icon at first save/submit) and the 'unknown field' warning, whose field name the summary did not include. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The developer-portal validation of
pgrundev/pgx-plugin(main @ cc5c211) passed with 11 warnings and 4 policy holds. This PR addresses the findings the report's fix hints point at, without changing what the skill does.npm i -g pgxdb@0.1.2andnpx pgxdb@0.1.2everywhere instead of unpinned or@latest(SKILL.md, installation.md, security.md,check-pgx.shhint strings, plugin README).curl … | shis no longer an action the skill takes or tells Claude to take. It stays documented in installation.md as a command the user runs in their own shell, and the skill now says never to pipe a download into a shell on the user's behalf.detect-project.shreadsDATABASE_URLand.env*files, prints host/port/database only, and that the connection string goes only topgx copyon the local machine. Reading the project's own database URL is inherent to the plugin, so this remains a reviewer hold by design.claude plugin update. The runtime requirement stays PGX 0.1.2 or newer; the skill version now moves independently of the runtime version.Not in this PR: the listing icon (no PGX logo asset exists in the repository; the directory fixes the icon at first save or submit, so it needs a deliberate asset) and the "unknown field" warning, whose field name the summary did not include.
Verified:
skills/tests/pgx/run.sh,plugins/tests/pgx/run.sh,skills-ref validate,claude plugin validate --strictand--profile directoryon the assembled standalone tree (only the icon warning remains).The regenerated tree is already pushed to
pgrundev/pgx-plugin; its drift job fails until this merges, as designed.🤖 Generated with Claude Code