[harlan-zw]

🔗 Linked issue

❓ Type of change

• 📖 Documentation
• 🐞 Bug fix
• 👌 Enhancement
• ✨ New feature
• 🧹 Chore
• ⚠️ Breaking change

📚 Description

A reader deciding whether to run a Skill had only its declared allowed-tools, which most Skills leave out. The Skill page now applies the skilld CLI's own behavior rules to SKILL.md and the stored file names. It lists each behavior with links to the exact lines on GitHub and marks the ones skilld run holds for approval. The desktop rail shows the same behaviors as chips.

The page reads no supporting file content, so the panel says it checked SKILL.md and file names, and that skilld run checks every file. The rules come from skilld-protocol/behaviors (skilld-dev/skilld#195), so the site and the CLI share one rule list.

skilld-protocol dropped CliEventInputSchema in skilld-dev/skilld#148, and POST /api/events/cli was its last user. The CLI never sent those events, so this pull request removes the endpoint.

skilld 3.6.0 published skilld-protocol 2.5.0, and the last commit takes it. Only its lockfile entries change: a full re-resolve on main also moves wrangler, which belongs in its own update.

🤖 AI disclosure: Harlan Agent Kit modified this description. My AI open-source policy.

[harlan-zw]

Agent note: checked the visible change in the running app, using production Skill data through a local proxy.

The mcp-builder page below had a sudo line added to its SKILL.md in the local preview only, so the panel shows a Needs approval row. None of the 44 sample Skills I checked matches a high-risk behavior in SKILL.md itself.

Phone, light	Phone, dark	Desktop rail

• At 390 px the page has no horizontal overflow, and file names wrap whole.
• Full unit suite: 377 files, 2,977 tests, with skilld-protocol linked from feat(protocol): export the Skill behavior detector skilld#195.

[harlan-github-agent]

🤖 MERGED

Harlan Agent Kit posted this automated review. It is not Harlan's personal review or approval. AI open source policy. Last updated: 2026-10-05 16:06 UTC.

GitHub merged this pull request.

No material findings were recorded.

Another Agent took this Review.

[harlan-zw]

🤖 Harlan Agent Kit Agent assessment of head 2a84061.

The Service Review for that head failed twice with "Desktop disconnected during the Agent turn". No new Review task appeared within 20 minutes of the second request, so an independent read-only subagent reviewed the head after stop-review returned Stopped.

No finding scored above 80. b6e4cfc fixes the four highest Logged findings:

• 75: SKILL.md line links opened GitHub's rendered preview at the top. Markdown links now use ?plain=1#L<n>.
• 30: the detail cache key stayed v3, so pre-deploy cache entries showed "No rule matched." It is now v4.
• 25: a Skill whose upstream file is gone linked to 404s. It now gets no links.
• 15: the rail could link to a panel that did not render. The panel now renders whenever the rail shows.

Still Logged, unchanged: line numbers come from the last synced copy (15), nested Skills inherit child files from stored assets (15), and stored assets carry no file mode (10).

This is not a Service READY. The new head needs its own Review.