feat(skills): surface private frontmatter validation warnings

[harlan-zw]

🔗 Linked issue

❓ Type of change

• 📖 Documentation
• 🐞 Bug fix
• 👌 Enhancement
• ✨ New feature
• 🧹 Chore
• ⚠️ Breaking change

📚 Description

Malformed Skill metadata stays hidden when maintainers connect GitHub. Shared source validation supports Owner or Repository selections. Private /me warnings link issues to source files and exclude GitHub forks. Claude Code extensions show portability notices. Consented accounts receive one email summary, with signed unsubscribe headers and fenced delivery retries.

🤖 AI disclosure: Harlan Agent Kit modified this description. My AI open-source policy.

[harlan-github-agent]

🤖 MERGED

Harlan Agent Kit posted this automated review. It is not Harlan's personal review or approval. AI open source policy. Last updated: 2026-10-10 12:45 UTC.

GitHub merged this pull request.

• Logged (30/100): The PR's only visual evidence (four screenshots) is unavailable to this review because the reviewing model cannot read images, so the visible-UI gate for the new validation alert and details panel is documented rather than verified. View code Optional follow-up: Re-run the visual gate with an image-capable reviewer or manually confirm the repositories panel and alert at 375px before merge.
  • Ask an agent to verify and fix this finding
• Logged (35/100): The new private validation endpoint re-pages and re-parses every skill the account owns on each /me load and each re sign-in, with cost unbounded in skill count. View code Optional follow-up: Persist a per-owner validation summary (refreshed by the nightly recompute or the sync sweep) and serve /api/me/validation from it, or cap pages and degrade to a count.
  • Ask an agent to verify and fix this finding
• Logged (20/100): The deploy-time fork-confirmation invalidation re-dues the whole repository corpus at once, delaying ordinary sync freshness and withholding per-skill issues until the sweep catches up. View code Optional follow-up: Watch rate-limit pause and sync backlog events after deploy; if the burst is too large, stage the invalidation in bounded slices as was done for historical discovery (0070 pattern).
  • Ask an agent to verify and fix this finding

925a9688-3716-419a-8158-44253d8112c0

Selected findings run after merge and open separate pull requests.

[harlan-zw]

🤖 Harlan Agent Kit Agent verification of head d37f4be.

Checked the running app with local account fixtures. The warning opens source-linked details. Claude Code notices remain separate from errors.

At 375px, the page has no horizontal overflow. The action and disclosure controls measure 44px tall.

An unauthenticated request to the real /api/me/validation route returns 403. No real emails were sent.

[harlan-github-agent]

Harlan Agent Kit posted this automated review. AI open source policy.

Automated Review: BLOCKED.

Read the Review results

[harlan-zw]

🤖 Harlan Agent Kit Agent verification of head 7dd239a.

The logged image finding is not reproducible. All four existing attachment URLs return HTTP 200 with valid image content types. Fresh fixture screenshots are below.

Checked the running app with local account fixtures. Both repeated non-string-key issues render. The warning opens source-linked details, and Claude Code notices remain separate. Desktop and 375px mobile views have no horizontal overflow.

The naming finding was partly valid. Root Skills now compare against the registry Repository slug. Actual nested folders keep the specification's matching rule, with rename-folder guidance when needed.

The launch migration prioritizes unknown fork metadata through the existing bounded refresh queue. Confirmation remains asynchronous and respects GitHub quota controls. No production backfill or real email send occurred.

[harlan-github-agent]

Harlan Agent Kit posted this automated review. AI open source policy.

Automated Review: READY.

Read the Review results