stacklok / toolhive / 21825315201

62%

push

github

Add SKILL.md parser and skill directory validator (#3702)

* Add SKILL.md parser and skill directory validator

Implement SKILL.md frontmatter parsing (YAML extraction) and skill
directory validation for the skills lifecycle management feature.

Parser:
- Extract YAML frontmatter between --- delimiters
- Parse name, description, version, allowed-tools, license,
  compatibility, and metadata fields
- Support allowed-tools as space-delimited, comma-delimited,
  or YAML array (StringOrSlice custom unmarshaler)
- Parse skillet.requires from metadata as OCI dependencies
- Enforce 64KB frontmatter size limit and 100 dependency limit

Validator:
- Validate SKILL.md existence in skill directory
- Validate name matches directory name
- Validate name regex (2-64 chars, lowercase alphanumeric + hyphens,
  no consecutive hyphens)
- Enforce required fields (name, description)
- Enforce field constraints (description <= 1024 chars,
  compatibility <= 500 chars)
- Detect symlinks and path traversal patterns
- Warn on large SKILL.md (> 500 lines)

Closes #3646

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Regenerate swagger docs for ValidationResult.Warnings

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Address PR review feedback

- Add early size-limited search for closing delimiter to avoid scanning
  arbitrarily large inputs (defense-in-depth)
- Document comma-over-space delimiter precedence in StringOrSlice
- Document metadata map[string]string limitation for extension fields
- Combine checkSymlinks and checkPathTraversal into single WalkDir call
- Switch from filepath.Walk to filepath.WalkDir for efficiency

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Promote requires to top-level frontmatter field

Move dependency declarations from metadata to a top-level
toolhive.requires frontmatter field using StringOrSlice. This
supports both YAML arrays and newline-delimited strings, consiste... (continued)

193 of 207 new or added lines in 3 files covered. (93.24%)

41969 of 68576 relevant lines covered (61.2%)

78.47 hits per line