Reported issues for Skillsmith

Pod holds 20 of 41 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to Skillsmith.

Most discussed

[VS Code UX] MCP-powered features (parity Waves 2–4)

Outcome

Extension UI surfaces MCP tools already available in CLI/MCP server: recommend, compare, diff, audit, and team inventory audit.

Why

McpClient today only wraps search, getSkill, installSkill, uninstallSkill.
McpClient.patterns.md documents conventions for 30+ wrappers planned in Waves 2–4.
Align implementation with docs/internal/implementation/vscode-mcp-parity.md (internal submodule).

Reference docs

Doc	Audience	Purpose

Read the thread · 2026-06-15 · closed · 4 comments

Security Scan: 0 critical, 1 high findings - 2026-05-10

Weekly Security Scan Report

Scan Date: 2026-05-10T02:35:15Z Workflow Run: #22

Summary

Metric	Value
Total Skills Scanned	676
Passed (Safe)	675
Quarantined	1

Findings by Severity

Severity	Count
CRITICAL	0
HIGH	1
MEDIUM	2
LOW	673

Risk Scores

Average Risk Score: 0
Maximum Risk Score: 1

Action

Read the thread · 2026-05-10 · closed · external user · 4 comments

[Feature Request] Support Google Antigravity as a first-class client target

Description

Google Antigravity is an agentic AI coding assistant and desktop harness. It supports project-specific configurations under the .agents/ folder at the workspace root:

Custom skills: <workspace-root>/.agents/skills/<skill-folder>/
MCP configuration: <workspace-root>/.agents/mcp_config.json

Currently, there is no first-class antigravity target in the --client <id> enum of skillsmith install, forcing users to use the generic --client agents or manually configure h

Read the thread · 2026-07-31 · open · 2 comments

[Bug]: MCP vs CLI trust/security vocabulary mismatch; host fallback noise; audit false positives

Summary

Parent: #2130 · Report IDs: C-15, C-16, C-18, C-19, C-20 (P2)

Consistency and packaging polish from Cursor host installs:

ID	Issue
C-15	MCP search/get `security.passed: true` vs CLI `info` `Security Status: Not scanned`
C-16	CLI trust label `unverified` vs MCP `unknown` (enum mismatch)
C-18	CLI warns missing `@huggingface/transformers`; falls back to mock embeddings
C-19	Persistent WASM SQLite notice instead of native `better-sqlite3` on ma

Read the thread · 2026-07-29 · closed · 2 comments

[Docs]: Cursor MCP setup — require client env, Node ≥22.22, prefer binary over cold npx

Summary

Parent: #2130 · Report IDs: C-02, C-03, C-17 (P0 docs / P2 polish)

Minimal Cursor MCP snippets omit SKILLSMITH_CLIENT=cursor, so installs default to Claude paths. Cold npx startup is fragile under Cursor (Node 20 EBADENGINE, intermittent ENOTEMPTY npm cache races). Cursor built-ins vs Skillsmith installs live in different dirs and confuse users.

Problem

Cursor users following the minimal docs snippet miss required client targeting and hit unreliable MCP process boot

Read the thread · 2026-07-29 · closed · 2 comments

[Bug]: CLI ignores SKILLSMITH_CLIENT; list/tips/remove not multi-client

Summary

Parent: #2130 · Report IDs: C-01, C-04, C-05, C-06 (P0/P1)

SKILLSMITH_CLIENT=cursor is ignored by CLI install defaults; post-install tips always mention Claude Code; list has no --client and ignores Cursor installs; remove requires interactive confirm and fails in non-TTY agent sessions.

Steps to reproduce

export SKILLSMITH_CLIENT=cursor
skillsmith install <author/skill> --skip-optimize --json (no --client)
Observe installPath under `~/.claude/skill

Read the thread · 2026-07-29 · closed · 2 comments

skillsmith MCP server fails to reconnect — missing skillsmith-mcp bin symlink causes global npx config to conflict with project .mcp.json

Summary

Running /mcp in Claude Code reports Failed to reconnect to skillsmith despite the project's MCP launcher working correctly. The project's skillsmith server (.mcp.json) is shadowed or conflicted by a broken global config in ~/.claude/settings.json.

Environment

Claude Code CLI, project root: skillsmith monorepo
Node.js v22.22.0, npm 10.9.4
macOS (darwin 24.5.0)

Steps to Reproduce

Add @skillsmith/mcp-server to ~/.claude/settings.json using the standard

Read the thread · 2026-06-01 · closed · 2 comments

[Bug]: 10 integration tests fail in Docker due to minimatch version resolution conflict in doc-retrieval-mcp

Summary

10 integration tests in packages/doc-retrieval-mcp always fail when run inside Docker because import { minimatch } resolves to minimatch@3.x (which has no named ESM export) instead of the declared minimatch@10.2.5. Tests are silently skipped in local development (Mac), making the bug invisible until Docker/CI.

Steps to reproduce

Start the Docker dev container: docker compose --profile dev up -d
Run the doc-retrieval-mcp integration tests inside Docker:

Read the thread · 2026-05-01 · closed · 2 comments

Most recent

[UAT] RBAC Permission System — Synthetic E2E (staging, 2026-08-29)

Summary

Synthetic end-to-end UAT of the RBAC permission system (SMI-6200 Enterprise RBAC+SSO initiative, Wave 2-3), run against staging (ref ovhcifugwqnzoebwfuku) via the new re-runnable harness scripts/staging/smi-6267-rbac-uat-e2e.{sh,sql} (SMI-6267, PR #2604, merged e542f2bb6).

Date: 2026-08-29 Environment: Staging Supabase (real, non-mocked RPCs — not a local Postgres container) Result: 33/33 assertions passing, including a deliberate negative control proving the harne

Read the thread · 2026-08-29 · open · 0 comments

[Bug] MCP Search tool ignores the 'limit' parameter

Description

The search tool exposed by the @skillsmith/mcp-server ignores the limit argument in its payload.

Expected Behavior

If limit: 3 is specified, the results array should be truncated to at most 3 items.

Reproduction Steps

Call the search tool via the MCP interface with limit: 3 and query: "testing".
Notice that the response contains 10 items (the default limit).

Read the thread · 2026-07-31 · closed · 1 comment

[Bug] MCP startup stderr logs hardcoded database path instead of resolved path

Description

The startup diagnostic stderr log in @skillsmith/mcp-server hardcodes the database location to ~/.skillsmith/skills.db: console.error(\Database initialized at: ${process.env.SKILLSMITH_DB_PATH || '~/.skillsmith/skills.db'}`);`

Expected Behavior

It should log the resolved database path (e.g., matching the value returned by getDefaultDbPath() which takes HOME relocations and overrides into account).

Reproduction Steps

Run the MCP server with a custom HOME

Read the thread · 2026-07-31 · closed · 1 comment

Design partners wanted: UAT Team-tier private skills (publish_private)

Design partners wanted: UAT Team-tier private skills (`publish_private`)

Need access? This is a Team-tier feature. You'll need at least a free Community-tier Skillsmith account to get started — comment on this issue expressing interest, or email support@skillsmith.app directly, and we'll set you up with complimentary Team-tier access for UAT (up to 10 seats, 90 days).

Skillsmith's publish_private MCP tool (Team tier) lets you mark an installed skill as private, hiding it from your

Read the thread · 2026-07-30 · open · 0 comments

[Bug]: skill_compare fails for searchable published author skills

Summary

Parent: #2130 · Report ID: C-09 (P1)

skill_compare by slug and UUID for published author skills (hytonylee/*) returned “not found”, even though those skills appear in search.

Steps to reproduce

search finds hytonylee/<skill>
skill_compare with the same slug and/or UUID → not found

Expected behavior

Any skill resolvable via search/get_skill should be comparable by the same IDs.

Actual behavior

Compare fails with not found for searchable publishe

Read the thread · 2026-07-29 · closed · 1 comment

[Bug]: skill_recommend / CLI recommend empty-stack crash and weak recall

Summary

Parent: #2130 · Report ID: C-07 (P1)

MCP skill_recommend returned candidates_considered: 0 despite project context. CLI recommend on a real workspace crashed with Error: stack is required and must be a non-empty array.

Steps to reproduce

In Cursor Agent (MCP healthy), call skill_recommend with project context → candidates_considered: 0
In same workspace CLI: skillsmith recommend (or equivalent) → empty-stack error

Expected behavior

CLI should not

Read the thread · 2026-07-29 · closed · 1 comment

[Bug]: skill_updates returns registry-wide set instead of installed skills

Summary

Parent: #2130 · Report ID: C-08 (P1)

MCP skill_updates returned updatesAvailable: 2833 with a huge payload — does not appear scoped to locally installed skills. Unusable for Cursor Agent sessions and likely to blow context.

Steps to reproduce

Install a small number of skills locally (or none beyond fixtures)
Call MCP skill_updates
Observe thousands of updates / oversized payload

Expected behavior

Only report updates for skills installed on the active cli

Read the thread · 2026-07-29 · closed · 1 comment

[Bug]: Install does not persist registry source — update fails after install

Summary

Parent: #2130 · Report ID: C-10 (P1)

After a successful registry install, skillsmith update <skill> fails with "has no recorded registry source", so maintain/update flows break immediately after install.

Steps to reproduce

skillsmith install <author/skill> --client cursor --skip-optimize
skillsmith update <skill-name> (or slug used at install)

Expected behavior

Install persists registry source metadata so update / outdated can resolve the origin skill

Read the thread · 2026-07-29 · closed · 1 comment

Design partners wanted: UAT the CycloneDX AI-BOM export (Team/Enterprise compliance_report)

We just extended the CycloneDX output on Skillsmith's compliance_report MCP tool (Team and Enterprise tier) into a full AI/ML-BOM. One call converts your installed agent-skill inventory — skills, inferred dependencies, MCP server dependencies, model requirements — into a CycloneDX JSON document.

What to expect right now

This is a newly launched feature, not yet validated at scale. If your machin

Read the thread · 2026-07-20 · open · 0 comments

[VS Code UX] Inventory audit UI (Team+)

Parent: #1452

Problem

Team MCP tools skill_inventory_audit, apply_namespace_rename, and apply_recommended_edit (SMI-4590) have no VS Code surface. Namespace collisions and prose edits require agent/CLI today.

Why this reference

Docker (ms-azuretools.vscode-docker) — aggregated problems list with actionable fix entries (similar to inventory audit results).

Reference docs

Public: MCP tools reference — Team+ inventory audit tool

Read the thread · 2026-06-15 · closed · 1 comment

[VS Code UX] skill_audit — security advisory block on detail panel

Parent: #1452

Problem

Detail panel shows static security scan copy; MCP skill_audit tool is not wired in the extension (Team+ tier).

Why this reference

SonarLint (SonarSource.sonarlint-vscode) — security/advisory panel on detail without blocking browse for users below tier.

Reference docs

Public: MCP tools reference — skill_audit
Repo: packages/vscode-extension/src/mcp/McpClient.patterns.md
Team: `docs/internal/implementation/v

Read the thread · 2026-06-15 · closed · 1 comment

[VS Code UX] skill_diff — installed skill version diff

Parent: #1452

Problem

No UI for reviewing SKILL.md changes between installed and registry versions, or between two installed versions.

Why this reference

Built-in Git diff editor (built-in) — familiar native diff UX for reviewing updates before applying.

Reference docs

Public: MCP tools reference — skill_diff
Repo: packages/vscode-extension/src/mcp/McpClient.patterns.md
Team: docs/internal/implementation/vscode-mcp-parity.md —

Read the thread · 2026-06-15 · closed · 1 comment

The remaining reports are on the project's issue tracker.