francylisboacharuto bac2b27bb8 feat: v4.0 Cross-Platform Modernization — Agent Skills Open Standard compliance

BREAKING CHANGES:
- Remove -cskill suffix from all skill names (use standard kebab-case)
- Simplify marketplace.json to only official fields (fixes Issue #5)
- SKILL.md body must be <500 lines (progressive disclosure via references/)

New features:
- Cross-platform support for 8+ platforms (Claude Code, Copilot, Cursor, Windsurf, Cline, Codex CLI, Gemini CLI)
- scripts/install-template.sh: Auto-detect platform installer with --dry-run
- scripts/validate.py: Spec compliance checker for generated skills
- scripts/security_scan.py: Security scanner for hardcoded keys and dangerous patterns
- MIGRATION.md: v3.x to v4.0 migration guide
- 6 new reference files for progressive disclosure from lean SKILL.md

Key changes:
- SKILL.md: 4,116 → 272 lines with spec-compliant YAML frontmatter
- marketplace.json: Stripped to {name, plugins} only
- article-to-prototype-cskill/ → article-to-prototype/
- stock-analyzer-cskill/ → stock-analyzer/
- Export system integrates validation + security scanning
- README.md rewritten for all supported platforms
- Phase 5 pipeline outputs SKILL.md-first, spec-compliant skills

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-26 14:52:09 -03:00

1.2 KiB

Raw Blame History

SC-046: Hardcoded API Key Replaced with Environment Variable Reference

Covers: FR-013, Edge case 2.3 — Generated script contains hardcoded API key: fail scan, replace with env var, warn user Type: Edge Case

Given

During Phase 5, the generated scripts/main.py contains:

API_KEY = "sk-abc123def456"
headers = {"Authorization": f"Bearer {API_KEY}"}

When

The security scan runs on the generated skill

Then

The security scan fails and identifies the hardcoded key

The script is updated to use an environment variable:

API_KEY = os.environ.get("API_KEY")
headers = {"Authorization": f"Bearer {API_KEY}"}

The user is warned about the replacement

Verification Method

Method: Automated test

Steps:

Generate a skill where a script would contain a hardcoded API key
After Phase 5 completes, read scripts/main.py
Assert the hardcoded key string sk-abc123def456 is NOT present
Assert os.environ.get or os.getenv is present
Verify security scan output mentions the replacement

Expected evidence: No hardcoded key in final script. os.environ.get("API_KEY") is used instead. Security warning present in output.

1.2 KiB Raw Blame History