# Reported issues for Skillsmith

Pod holds 20 of 41 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [Skillsmith](/mcp/skillsmith).

## Most discussed

### [VS Code UX] MCP-powered features (parity Waves 2–4)

## Outcome
Extension UI surfaces MCP tools already available in CLI/MCP server: recommend, compare, diff, audit, and team inventory audit.

## Why
- `McpClient` today only wraps `search`, `getSkill`, `installSkill`, `uninstallSkill`.
- `McpClient.patterns.md` documents conventions for **30+ wrappers** planned in Waves 2–4.
- Align implementation with `docs/internal/implementation/vscode-mcp-parity.md` (internal submodule).

## Reference docs
| Doc | Audience | Purpose |
|-----|----------|-------

[Read the thread](https://github.com/smith-horn/skillsmith/issues/1452) · 2026-06-15 · closed · 4 comments

### Security Scan: 0 critical, 1 high findings - 2026-05-10

## Weekly Security Scan Report

**Scan Date:** 2026-05-10T02:35:15Z
**Workflow Run:** [#22](https://github.com/smith-horn/skillsmith/actions/runs/25617754585)

### Summary

| Metric | Value |
|--------|-------|
| Total Skills Scanned | 676 |
| Passed (Safe) | 675 |
| Quarantined | 1 |

### Findings by Severity

| Severity | Count |
|----------|-------|
| CRITICAL | 0 |
| HIGH | 1 |
| MEDIUM | 2 |
| LOW | 673 |

### Risk Scores

- **Average Risk Score:** 0
- **Maximum Risk Score:** 1

### Action 

[Read the thread](https://github.com/smith-horn/skillsmith/issues/1059) · 2026-05-10 · closed · external user · 4 comments

### [Feature Request] Support Google Antigravity as a first-class client target

### Description
Google Antigravity is an agentic AI coding assistant and desktop harness. It supports project-specific configurations under the `.agents/` folder at the workspace root:
- Custom skills: `<workspace-root>/.agents/skills/<skill-folder>/`
- MCP configuration: `<workspace-root>/.agents/mcp_config.json`

Currently, there is no first-class `antigravity` target in the `--client <id>` enum of `skillsmith install`, forcing users to use the generic `--client agents` or manually configure h

[Read the thread](https://github.com/smith-horn/skillsmith/issues/2166) · 2026-07-31 · open · 2 comments

### [Bug]: MCP vs CLI trust/security vocabulary mismatch; host fallback noise; audit false positives

## Summary

Parent: #2130 · Report IDs: **C-15, C-16, C-18, C-19, C-20** (P2)

Consistency and packaging polish from Cursor host installs:

| ID | Issue |
|---|---|
| C-15 | MCP search/get `security.passed: true` vs CLI `info` `Security Status: Not scanned` |
| C-16 | CLI trust label `unverified` vs MCP `unknown` (enum mismatch) |
| C-18 | CLI warns missing `@huggingface/transformers`; falls back to mock embeddings |
| C-19 | Persistent WASM SQLite notice instead of native `better-sqlite3` on ma

[Read the thread](https://github.com/smith-horn/skillsmith/issues/2138) · 2026-07-29 · closed · 2 comments

### [Docs]: Cursor MCP setup — require client env, Node ≥22.22, prefer binary over cold npx

## Summary

Parent: #2130 · Report IDs: **C-02, C-03, C-17** (P0 docs / P2 polish)

Minimal Cursor MCP snippets omit `SKILLSMITH_CLIENT=cursor`, so installs default to Claude paths. Cold `npx` startup is fragile under Cursor (Node 20 `EBADENGINE`, intermittent `ENOTEMPTY` npm cache races). Cursor built-ins vs Skillsmith installs live in different dirs and confuse users.

## Problem

Cursor users following the minimal docs snippet miss required client targeting and hit unreliable MCP process boot

[Read the thread](https://github.com/smith-horn/skillsmith/issues/2132) · 2026-07-29 · closed · 2 comments

### [Bug]: CLI ignores SKILLSMITH_CLIENT; list/tips/remove not multi-client

## Summary

Parent: #2130 · Report IDs: **C-01, C-04, C-05, C-06** (P0/P1)

`SKILLSMITH_CLIENT=cursor` is ignored by CLI install defaults; post-install tips always mention Claude Code; `list` has no `--client` and ignores Cursor installs; `remove` requires interactive confirm and fails in non-TTY agent sessions.

## Steps to reproduce

1. `export SKILLSMITH_CLIENT=cursor`
2. `skillsmith install <author/skill> --skip-optimize --json` (no `--client`)
3. Observe `installPath` under `~/.claude/skill

[Read the thread](https://github.com/smith-horn/skillsmith/issues/2131) · 2026-07-29 · closed · 2 comments

### skillsmith MCP server fails to reconnect — missing skillsmith-mcp bin symlink causes global npx config to conflict with project .mcp.json

## Summary

Running `/mcp` in Claude Code reports `Failed to reconnect to skillsmith` despite the project's MCP launcher working correctly. The project's `skillsmith` server (`.mcp.json`) is shadowed or conflicted by a broken global config in `~/.claude/settings.json`.

## Environment

- Claude Code CLI, project root: `skillsmith` monorepo
- Node.js v22.22.0, npm 10.9.4
- macOS (darwin 24.5.0)

## Steps to Reproduce

1. Add `@skillsmith/mcp-server` to `~/.claude/settings.json` using the standard

[Read the thread](https://github.com/smith-horn/skillsmith/issues/1384) · 2026-06-01 · closed · 2 comments

### [Bug]: 10 integration tests fail in Docker due to minimatch version resolution conflict in doc-retrieval-mcp

### Summary

10 integration tests in `packages/doc-retrieval-mcp` always fail when run inside Docker because `import { minimatch }` resolves to `minimatch@3.x` (which has no named ESM export) instead of the declared `minimatch@10.2.5`. Tests are silently skipped in local development (Mac), making the bug invisible until Docker/CI.

### Steps to reproduce

1. Start the Docker dev container: `docker compose --profile dev up -d`
2. Run the doc-retrieval-mcp integration tests inside Docker:
   ```
 

[Read the thread](https://github.com/smith-horn/skillsmith/issues/866) · 2026-05-01 · closed · 2 comments

## Most recent

### [UAT] RBAC Permission System — Synthetic E2E (staging, 2026-08-29)

## Summary

Synthetic end-to-end UAT of the RBAC permission system (SMI-6200 Enterprise RBAC+SSO initiative, Wave 2-3), run against staging (ref `ovhcifugwqnzoebwfuku`) via the new re-runnable harness `scripts/staging/smi-6267-rbac-uat-e2e.{sh,sql}` (SMI-6267, PR #2604, merged `e542f2bb6`).

**Date:** 2026-08-29
**Environment:** Staging Supabase (real, non-mocked RPCs — not a local Postgres container)
**Result:** 33/33 assertions passing, including a deliberate negative control proving the harne

[Read the thread](https://github.com/smith-horn/skillsmith/issues/2607) · 2026-08-29 · open · 0 comments

### [Bug] MCP Search tool ignores the 'limit' parameter

### Description
The `search` tool exposed by the `@skillsmith/mcp-server` ignores the `limit` argument in its payload.

### Expected Behavior
If `limit: 3` is specified, the results array should be truncated to at most 3 items.

### Reproduction Steps
1. Call the `search` tool via the MCP interface with `limit: 3` and `query: "testing"`.
2. Notice that the response contains 10 items (the default limit).

[Read the thread](https://github.com/smith-horn/skillsmith/issues/2163) · 2026-07-31 · closed · 1 comment

### [Bug] MCP startup stderr logs hardcoded database path instead of resolved path

### Description
The startup diagnostic stderr log in `@skillsmith/mcp-server` hardcodes the database location to `~/.skillsmith/skills.db`:
`console.error(\`Database initialized at: \${process.env.SKILLSMITH_DB_PATH || '~/.skillsmith/skills.db'}\`);`

### Expected Behavior
It should log the resolved database path (e.g., matching the value returned by `getDefaultDbPath()` which takes `HOME` relocations and overrides into account).

### Reproduction Steps
1. Run the MCP server with a custom `HOME`

[Read the thread](https://github.com/smith-horn/skillsmith/issues/2162) · 2026-07-31 · closed · 1 comment

### Design partners wanted: UAT Team-tier private skills (publish_private)

# Design partners wanted: UAT Team-tier private skills (`publish_private`)

**Need access?** This is a Team-tier feature. You'll need at least a free Community-tier Skillsmith account to get started — comment on this issue expressing interest, or email support@skillsmith.app directly, and we'll set you up with complimentary Team-tier access for UAT (up to 10 seats, 90 days).

---

Skillsmith's `publish_private` MCP tool (Team tier) lets you mark an installed skill as private, hiding it from your

[Read the thread](https://github.com/smith-horn/skillsmith/issues/2144) · 2026-07-30 · open · 0 comments

### [Bug]: skill_compare fails for searchable published author skills

## Summary

Parent: #2130 · Report ID: **C-09** (P1)

`skill_compare` by slug and UUID for published author skills (`hytonylee/*`) returned “not found”, even though those skills appear in `search`.

## Steps to reproduce

1. `search` finds `hytonylee/<skill>`
2. `skill_compare` with the same slug and/or UUID → not found

## Expected behavior

Any skill resolvable via search/`get_skill` should be comparable by the same IDs.

## Actual behavior

Compare fails with not found for searchable publishe

[Read the thread](https://github.com/smith-horn/skillsmith/issues/2137) · 2026-07-29 · closed · 1 comment

### [Bug]: skill_recommend / CLI recommend empty-stack crash and weak recall

## Summary

Parent: #2130 · Report ID: **C-07** (P1)

MCP `skill_recommend` returned `candidates_considered: 0` despite project context. CLI `recommend` on a real workspace crashed with `Error: stack is required and must be a non-empty array`.

## Steps to reproduce

1. In Cursor Agent (MCP healthy), call `skill_recommend` with project context → `candidates_considered: 0`
2. In same workspace CLI: `skillsmith recommend` (or equivalent) → empty-stack error

## Expected behavior

- CLI should not 

[Read the thread](https://github.com/smith-horn/skillsmith/issues/2136) · 2026-07-29 · closed · 1 comment

### [Bug]: skill_updates returns registry-wide set instead of installed skills

## Summary

Parent: #2130 · Report ID: **C-08** (P1)

MCP `skill_updates` returned `updatesAvailable: 2833` with a huge payload — does not appear scoped to locally installed skills. Unusable for Cursor Agent sessions and likely to blow context.

## Steps to reproduce

1. Install a small number of skills locally (or none beyond fixtures)
2. Call MCP `skill_updates`
3. Observe thousands of updates / oversized payload

## Expected behavior

Only report updates for skills installed on the active cli

[Read the thread](https://github.com/smith-horn/skillsmith/issues/2134) · 2026-07-29 · closed · 1 comment

### [Bug]: Install does not persist registry source — update fails after install

## Summary

Parent: #2130 · Report ID: **C-10** (P1)

After a successful registry install, `skillsmith update <skill>` fails with `"has no recorded registry source"`, so maintain/update flows break immediately after install.

## Steps to reproduce

1. `skillsmith install <author/skill> --client cursor --skip-optimize`
2. `skillsmith update <skill-name>` (or slug used at install)

## Expected behavior

Install persists registry source metadata so `update` / `outdated` can resolve the origin skill

[Read the thread](https://github.com/smith-horn/skillsmith/issues/2133) · 2026-07-29 · closed · 1 comment

### Design partners wanted: UAT the CycloneDX AI-BOM export (Team/Enterprise compliance_report)

# Design partners wanted: UAT the CycloneDX AI-BOM export (Team/Enterprise compliance_report)

We just extended the CycloneDX output on Skillsmith's `compliance_report` MCP tool
(Team and Enterprise tier) into a full AI/ML-BOM. One call converts your installed
agent-skill inventory — skills, inferred dependencies, MCP server dependencies, model
requirements — into a CycloneDX JSON document.

## What to expect right now

This is a newly launched feature, not yet validated at scale. If your machin

[Read the thread](https://github.com/smith-horn/skillsmith/issues/1987) · 2026-07-20 · open · 0 comments

### [VS Code UX] Inventory audit UI (Team+)

Parent: #1452

## Problem
Team MCP tools `skill_inventory_audit`, `apply_namespace_rename`, and `apply_recommended_edit` (**SMI-4590**) have no VS Code surface. Namespace collisions and prose edits require agent/CLI today.

## Why this reference
**Docker** (`ms-azuretools.vscode-docker`) — aggregated problems list with actionable fix entries (similar to inventory audit results).

## Reference docs
- Public: [MCP tools reference](https://skillsmith.app/docs/mcp-tools) — Team+ inventory audit tool

[Read the thread](https://github.com/smith-horn/skillsmith/issues/1459) · 2026-06-15 · closed · 1 comment

### [VS Code UX] skill_audit — security advisory block on detail panel

Parent: #1452

## Problem
Detail panel shows static security scan copy; MCP `skill_audit` tool is not wired in the extension (Team+ tier).

## Why this reference
**SonarLint** (`SonarSource.sonarlint-vscode`) — security/advisory panel on detail without blocking browse for users below tier.

## Reference docs
- Public: [MCP tools reference — skill_audit](https://skillsmith.app/docs/mcp-tools)
- Repo: `packages/vscode-extension/src/mcp/McpClient.patterns.md`
- Team: `docs/internal/implementation/v

[Read the thread](https://github.com/smith-horn/skillsmith/issues/1458) · 2026-06-15 · closed · 1 comment

### [VS Code UX] skill_diff — installed skill version diff

Parent: #1452

## Problem
No UI for reviewing `SKILL.md` changes between installed and registry versions, or between two installed versions.

## Why this reference
**Built-in Git diff editor** (built-in) — familiar native diff UX for reviewing updates before applying.

## Reference docs
- Public: [MCP tools reference — skill_diff](https://skillsmith.app/docs/mcp-tools)
- Repo: `packages/vscode-extension/src/mcp/McpClient.patterns.md`
- Team: `docs/internal/implementation/vscode-mcp-parity.md` — 

[Read the thread](https://github.com/smith-horn/skillsmith/issues/1457) · 2026-06-15 · closed · 1 comment

The remaining reports are on [the project's issue tracker](https://github.com/smith-horn/skillsmith/issues).